{ "Event": { "published": true, "date": "2021-09-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-29", "timestamp": 1632960181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "57be60d1-6e48-46c8-affc-dbf118064ec3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25543c43-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (FlawedAmmyy)", "timestamp": 1632901498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901498, "uuid": "9ceb6efa-d5b3-488f-a663-26e92ea97d3f", "comment": "Malware payload (FlawedAmmyy)", "value": "6b38cc8ae5261f5790e0aaf3f69984ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901498, "uuid": "19c2db5d-cf51-44ac-a035-cc8c23170246", "comment": "Malware payload (FlawedAmmyy)", "value": "00bca7bf091b6a71cc29943becde20225f02cd58ca3aa9c5fcb326a02c1eda3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901498, "uuid": "8fcc5091-df22-4608-b8a2-91d565f0ac39", "comment": "Malware payload (FlawedAmmyy)", "value": "08cd939e2cf2d56f988ac9d84832ee919a8bc3b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901498, "uuid": "adf37470-7c13-4a61-beec-13208be09de7", "comment": "Malware payload (FlawedAmmyy)", "value": "a992970365b97d52e9496e3763d0c5418cc8d1f25780ad8dbd07f7f793fb55296a6c3e62dccb250d3d3fa522718af2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901498, "uuid": "13786881-903c-4102-bfc4-0cc48ce65fe9", "value": "T10F25AF267EC241BBD373057189FAA7B1E9B5FE6019238A0F53C89B1C5977D01DA12B38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901498, "uuid": "435a6225-3f3b-43d6-b597-4803b03c6027", "value": "fc1209421f47fed5bb77de529b7e4fb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901498, "uuid": "2011688e-b5ec-4322-ae5c-597bb25aa1f0", "value": "24576:rMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxB:mJ5gEKNikf3hBfUiWxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901498, "uuid": "456b957f-bb6b-430f-a570-1da4a7061852", "value": 1024152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901498, "uuid": "a2064b92-092b-46f6-8138-91a971da5f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901498, "uuid": "00770696-a0a9-4e5a-a551-ebd8996f9593", "value": "00bca7bf091b6a71cc29943becde20225f02cd58ca3aa9c5fcb326a02c1eda3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2007292-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902244, "uuid": "d9f0f284-bd74-4fa4-a481-9d855a9e4799", "comment": "Malware payload", "value": "ce7ebb7eb0b7c2984fc7ab2bb519bb30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902244, "uuid": "48320e1e-4e58-4fa1-ab15-5095da6090b5", "comment": "Malware payload", "value": "00d3f840c7b0a914be81cda148cf840827f222bdeedb128b8215b7921163b7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902244, "uuid": "8ec9a2e4-08a8-4ab8-bb2c-a593ea8c6525", "comment": "Malware payload", "value": "897a250fe62cbcbbf2f04ed5ec95ffb33e86133d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902244, "uuid": "09abf5a8-e491-4540-9410-4a1db3047f3b", "comment": "Malware payload", "value": "ada6cbbdf3600ed485ea99f481733494135cbfb8f2e8b9a5dbe1e154372afb8b43fd7604719352bd0ee61abd8b7e7211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902244, "uuid": "da036caf-2396-4932-9b0e-d7094d7a6125", "value": "T1CB73CF127F821D14D7F90F321ACC31DA0ABFB78E9A705BCA1D2E99980F37A5459E0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902244, "uuid": "b4f18b79-8539-4d03-ae9a-a19f57f0b12b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902244, "uuid": "c5c03027-5ba3-4386-92f4-ac6bb91d9db3", "value": "1536:0c5jS9LT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtd61n9/E1+e:0c5jS9E2EwR4uY41HyvYmn9/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902244, "uuid": "d1830f30-28e1-4ce4-a840-14e46fbafcdc", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902244, "uuid": "8a05b85e-a834-48e6-8f24-ef1d29dc2abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902244, "uuid": "fb4cfc20-055d-4c8d-aee2-84c5369170ad", "value": "00d3f840c7b0a914be81cda148cf840827f222bdeedb128b8215b7921163b7ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5357f9-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632899359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899359, "uuid": "2924bf43-2622-48f8-b1e3-ed217f0e96ad", "comment": "Malware payload (RaccoonStealer)", "value": "761da2ef5bc79ec433d4ff74cad8f7d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899359, "uuid": "6b09b932-6025-4e9d-9d07-f11dc97e3699", "comment": "Malware payload (RaccoonStealer)", "value": "011f4d4636e0cb4cc857f7f87fc005315abaa07b17e2f5df2987c52f5bac2f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899359, "uuid": "50bade7e-c239-4122-a02e-c0c2d52025d0", "comment": "Malware payload (RaccoonStealer)", "value": "fc0dc47773f2e78d9d54cbf759cd3ff8ecac3dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899359, "uuid": "67f1d237-f0d5-4a13-b2a9-b04ebc8782f4", "comment": "Malware payload (RaccoonStealer)", "value": "dd08e2f3c03135c6c1675fdf3453efb4fa4be163ae4a7c22e54e6238989c00a2c2d6944d3062ec547ae4a5ca770a98ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899359, "uuid": "2b9e574b-3e41-4ff1-8b3f-3aa8dd324be6", "value": "T189A40200FA90D3B1C312403E7C25C6DDA52DBA4CEFE5663636891ADF5A7D2D3B822355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899359, "uuid": "09dcd1a5-b90d-42a8-a23b-f11dabb4c919", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899359, "uuid": "008ac7ed-742e-4b94-b5e7-75beb20ee45b", "value": "6144:kgMp4g+3xPTegR0r6czIQy74vS6hqgupD1TyYbO9kF5ZJNPrfxy5P90gcPI1LuS6:yXexLR0D9ytZD1+Yi9k71xyt90vI1n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899359, "uuid": "60d980fa-0648-47c0-b97f-fe74c77877f8", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899359, "uuid": "0eff432b-6855-41cc-9c03-b7559a59a0f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899359, "uuid": "361304ad-eaa0-43cf-abe4-65ea77e2dd6e", "value": "761da2ef5bc79ec433d4ff74cad8f7d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c869b085-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901342, "uuid": "f0249719-68fb-4803-b47d-eef155b44f76", "comment": "Malware payload (Dridex)", "value": "931c772ca052df65e8a154d0afa873c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901342, "uuid": "afe39a26-e4db-44e7-a438-7e38ccf0c7fa", "comment": "Malware payload (Dridex)", "value": "01489194478e815a2b3b20cd3bf0c0d02a0b61fda4c03b1c71bd6114fdfd106f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901342, "uuid": "198f1def-18cb-402d-ba8e-af42a1940e49", "comment": "Malware payload (Dridex)", "value": "8dce643a8936cb8f9a4522caca4b3d867fcc6a98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901342, "uuid": "650830b8-489c-40ac-826f-644c235c7100", "comment": "Malware payload (Dridex)", "value": "0141f78160b234f77a7c5e8c3b96931ef73d56792e03e1b1cf0d429102ae8df61e72d77e2a3d24b48c95fd2c60877bd8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901342, "uuid": "ea9dd0fc-eb68-4ffa-906d-4fbbab550a5a", "value": "T15775D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901342, "uuid": "a37ec806-034b-4449-b5a3-2c4e029dfdeb", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901342, "uuid": "0ac71c53-beb4-42e7-9e98-231b88f7feea", "value": "12288:AVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:lfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901342, "uuid": "f29d6bf9-8cec-4148-9e5d-6ceed847bee8", "value": 1679360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901342, "uuid": "6383f198-aaf4-469a-bc9f-4387c5f51c75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901342, "uuid": "70d9f692-76ad-4c16-beb8-d9878ce25e6e", "value": "01489194478e815a2b3b20cd3bf0c0d02a0b61fda4c03b1c71bd6114fdfd106f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7e44ab-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927572, "uuid": "7179ca28-aecf-4feb-b272-3b4c67f8a7b9", "comment": "Malware payload", "value": "6b2eba217bb5ea3cfd794cad118676a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927572, "uuid": "1b5e815b-daff-457a-9ac9-618a823c48f1", "comment": "Malware payload", "value": "0148b8275bab6e00a98da011489b6d3e84c809d99ee190a5b00840f3f63cba93", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927572, "uuid": "711d2307-fa32-4fcf-a43c-1351af8aa7e2", "comment": "Malware payload", "value": "fe92977bb5b5d7326cf8744408a214d92f07c689", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927572, "uuid": "1aabb2fc-1e51-46e3-8bfd-84f2afa2a021", "comment": "Malware payload", "value": "bc209cea52d477ca3a8864b67d41486beae67c690e5e57056e43fba6ff0cf822ea6efc2383eba6ed2008539622cea838", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927572, "uuid": "255b20b9-756a-4790-880e-96f48b39b3a0", "value": "T1FB723A42E770C5F9F2BA02F1AA7569BD7D1E8F82038E00D749D44E2D9A8C9DB3D71581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927572, "uuid": "86ba23c1-b6e9-4987-91da-315dbc215e5d", "value": "6ec93950ff4ca22c1dd9cde16e7bf24a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927572, "uuid": "01351393-dedb-4c5c-a4e8-a49643916016", "value": "192:E+woEnaJW9gMpDRUWF+vmFESJMGgS6rLNpC6AhJCGIDHxf0FdQOo316U:E+wo29gmZF4mFESJVgpIhJCXRcd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927572, "uuid": "9443c9f0-2e38-442e-a59d-66e6532fd173", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927572, "uuid": "b3ae9ce8-cec9-40e2-8462-aefdd1f7ed8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927572, "uuid": "2229ff57-974e-4116-9fa6-81a2acb766e8", "value": "SecuriteInfo.com.Trojan.Inject4.16715.23901.6265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97e2eec-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632899223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899223, "uuid": "a933f051-5e02-43e0-8870-24dd5e003379", "comment": "Malware payload (AgentTesla)", "value": "d120d18e68d276e7624a42f550dc8773", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899223, "uuid": "2a1c5f85-2908-405e-b80b-07dcfa44e6f4", "comment": "Malware payload (AgentTesla)", "value": "015284fdcdf7aec49da8473352254a074ac85b8d4fbbeb799ca1b30cf6be221d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899223, "uuid": "beb9b115-8a09-4cc1-a3a8-0170b9c467ee", "comment": "Malware payload (AgentTesla)", "value": "a255d5a2a6fcb19cc80502656984b41f9e4c1234", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899223, "uuid": "9a18fc20-f562-40e5-aa56-ef72b30c072f", "comment": "Malware payload (AgentTesla)", "value": "b908dec6d97af107c03734c7c71b2db5db82120704015f771fda5812e80734c47d5702079929f6ad95f58507ad94a9ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899223, "uuid": "99558744-a729-46f3-9f0d-bcf7013d5f62", "value": "T15764122AD2D068EBD85712B1227AFBB9F77F501C61694A9307501F233B7768A0E0D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899223, "uuid": "a40b4894-49dc-4609-97b8-e377c2f07c34", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899223, "uuid": "444578f9-b40f-4693-9a53-bf07607752cd", "value": "6144:F8LxBsckrQeCCUQj3ik11VsykMwCR9IkNpvfDLDC1UAKesCafr:/1hCCU9k10hTCR9xLzHUKz1fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899223, "uuid": "0f6c9635-bb91-4769-8c8d-ce39e8d93480", "value": 311740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899223, "uuid": "1e2388ce-8150-4e2c-8a43-7541a3c90dfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899223, "uuid": "84f94127-52f4-4dc8-afe0-1ca75416d233", "value": "d120d18e68d276e7624a42f550dc8773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfd38e5-20d5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632885995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885995, "uuid": "4f1fae3b-511f-45c0-b836-e243937fcec1", "comment": "Malware payload (RedLineStealer)", "value": "5b6c9bdb605a9ef8685e08998b24368b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885995, "uuid": "16fc6594-c699-47b1-bff6-0a9471aaf4e5", "comment": "Malware payload (RedLineStealer)", "value": "01b03e3685fc9fa6d7c59ddf16457c45c27e78cb09b9800e0689a23989c0d047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885995, "uuid": "fe27504f-dcda-4706-81c4-27e8fe5b934c", "comment": "Malware payload (RedLineStealer)", "value": "2d8a25ea7ad5f54bf22f5a4121ae672d4b53bace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885995, "uuid": "9a473e7c-a3c5-42c4-afe9-d58a067c1dd4", "comment": "Malware payload (RedLineStealer)", "value": "33777c7b394189dc40f33cd2e7d294da1053d78451618b62288d21adc4421cce564f85f31a17f5351d29e33ed9d44191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885995, "uuid": "b9255e36-3a2f-4577-8609-c816ddb983d5", "value": "T148A4F06772E40195DBB142FAC8A1034AE77034361B55A3CB5B6863B32B2F4DA9F3D391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885995, "uuid": "245da74e-d481-426a-8461-a2d47aa20c90", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885995, "uuid": "1a9ba452-6ac5-4efd-8bd7-73fe3887024e", "value": "12288:IbjDhu9TMsp4asV+MfbX50+TTZAcTKuS0+KW3j:21eTMsKBf1VTYKW3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885995, "uuid": "3d41c066-b384-4864-b187-dcefd2d1d8c8", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885995, "uuid": "dbe54149-00d1-497b-b165-ed1cef184af9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885995, "uuid": "94a42f7b-927b-41ed-af7d-1c0313b8c7ce", "value": "01b03e3685fc9fa6d7c59ddf16457c45c27e78cb09b98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f242fe-2121-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632918944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918944, "uuid": "c097ed50-d7a3-4745-a7a7-8ae2b52ac3da", "comment": "Malware payload (AgentTesla)", "value": "138084c25eec2ebb4d9b2f4b92d7f145", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918944, "uuid": "b06a60a3-8b7a-405b-b97a-307e83d9b317", "comment": "Malware payload (AgentTesla)", "value": "0275cb704377ad834932e002e948338d135f6ddf787ac2f0e24e94d014b8f14c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918944, "uuid": "65e7e645-bebf-4346-8ad5-961a6c123c52", "comment": "Malware payload (AgentTesla)", "value": "988b5ab614dbfb738acde319339247dd5f5c425f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918944, "uuid": "aa014edd-52ba-49c4-a867-65dcecfccb01", "comment": "Malware payload (AgentTesla)", "value": "676a69bff24432fa4b3c49513f76cd5c952fdb1dd9d429f71099e3d8106a191c431fcd69dc4591d9cf40b0eaa46fbf5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918944, "uuid": "34cd9675-aec5-4a11-9317-ace138da25e5", "value": "T178F48D5DF60CE29EFD0903F021297CD425E81CAD197CFA17BEA6B1E230AAD7651F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918944, "uuid": "99060b4e-b613-4cd6-a0bb-d68abe985bdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918944, "uuid": "12285e1e-bc49-4af6-b47b-1beebd12bd0f", "value": "12288:UD4VHfQe6ZyWshg+qbZxTZZWunAWvTBMX31mXqIbDsh2y3/F2W89Sj071biAK0c:UD4VHfQe6ZyWshg+qbZxTZZWunAWvFM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918944, "uuid": "5f2bf455-7e5b-430c-9a6a-e5ffc57a646b", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918944, "uuid": "96120ddc-290d-417b-8524-648be01e7b69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918944, "uuid": "75af6d59-615b-4cd0-b314-f61e93074d71", "value": "RUT21000383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a372da12-20e2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632891831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891831, "uuid": "9de15b80-178c-4cdf-8e76-5ee65329f7f4", "comment": "Malware payload (AgentTesla)", "value": "7df50c4d2a6bca14b13285ede177e71f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891831, "uuid": "c5d4dbc5-2863-4d09-8ca3-c803bcba5fa6", "comment": "Malware payload (AgentTesla)", "value": "03b6414475741482c01fc43d234ddb07ea3efb5d54cec940f763655dbf6ec1e3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891831, "uuid": "fcedc4cf-7ab0-4d3d-85d6-3e1c73c925d6", "comment": "Malware payload (AgentTesla)", "value": "30a1fa3e102e3117c9730242c6d1f0cddf5dadc1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891831, "uuid": "330017b9-5845-4eee-a2a5-bbd20bebdd94", "comment": "Malware payload (AgentTesla)", "value": "5de6cbaa6b351599f82f4f534b48e7bd3d6cdd276a167407290188f0ca4d1035a0dfb835b5dd69d975c223ea84daae40", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891831, "uuid": "0b0ccf33-79c1-49fa-ad81-725cd76c7877", "value": "T1DAC42325DF31395EF2D9B12AAB9C4331285AADB6843F1FEB4816C9B94B341885F4D270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891831, "uuid": "3af64d1a-95f2-4e11-9f1a-e36376c55442", "value": "12288:ju+xfcaBBIPyZfHZzE4h6AFZxe3WUPT+j796q3czFigRyfPMVCA:TxjqPkf5zE8Zg3VY6FsnfPqCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632891831, "uuid": "6246dfd9-62e1-4453-9ed4-4c6c1753dbcb", "value": 590653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632891831, "uuid": "6c2087bb-fca2-4139-bdea-2755b591c0ec", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891831, "uuid": "c0456f36-44be-4d7f-b5e4-f5eac5e38104", "value": "QUOTATION REQUEST.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5664bd-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898366, "uuid": "fa897d81-64a9-468b-a21d-cc3ebeaf85e4", "comment": "Malware payload (Dridex)", "value": "eac36b9e1da226b46fa5dbd3c4a27a1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898366, "uuid": "e8f5d304-7ef3-41bd-ab8a-69b6092ed25a", "comment": "Malware payload (Dridex)", "value": "03f47ebe1e725ff3db0afcc97e436dea47c222bfa62b5660432aad44d899e697", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898366, "uuid": "d73205dc-808e-4689-80a8-1c63ac898e9b", "comment": "Malware payload (Dridex)", "value": "1604ac27d18ea0e432e6d5cd187fed74a2c34079", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898366, "uuid": "43822a98-3aff-4bcf-82b1-b390beff7741", "comment": "Malware payload (Dridex)", "value": "21f1d8ed12555f17b74be606c1e5e3f65ec0094685feddc80333bd411fe2c24e00caf7a292204809c52057071715ae3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898366, "uuid": "0bc399c5-a6a3-41ab-9f1e-cc271d87ed88", "value": "T15016D020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898366, "uuid": "eb2aa9d9-b63f-44ae-b707-6bb8db695b81", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898366, "uuid": "a22a4403-455d-4177-8290-e044c54b9020", "value": "12288:qVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:3fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898366, "uuid": "ffaa7dd7-c011-4c37-adb5-d74fd833d5fa", "value": 4296704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898366, "uuid": "124fb502-5dad-4627-b013-02c61c7d92e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898366, "uuid": "4aad92b1-1ce1-4f32-b7ab-206b35f74871", "value": "03f47ebe1e725ff3db0afcc97e436dea47c222bfa62b5660432aad44d899e697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b67e57-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632898333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898333, "uuid": "8b4dd354-ecd6-49a2-ab3b-dce4c6367d07", "comment": "Malware payload (SakulaRAT)", "value": "56432de453702578cfcd2cedd545d2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898333, "uuid": "f1fbd850-54ab-44f7-9c33-3a4ca81129e2", "comment": "Malware payload (SakulaRAT)", "value": "0451f1e9e022be9236f1076a39f854f7085854df87b368e2743912b29b69df82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898333, "uuid": "f974b3d2-cc23-40fc-9eaa-c40a2a62d41c", "comment": "Malware payload (SakulaRAT)", "value": "00986892b4c19d0640333cd0986cec1a1b324856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898333, "uuid": "44300268-5308-4034-9afb-e42d1dfc1e47", "comment": "Malware payload (SakulaRAT)", "value": "cfddfa2a8c83aec94ab7ee3e1d965f196a69f5504f028d4c0da154d370b7da002024e82df2895294fbd9ac6f86a58fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898333, "uuid": "fe616c84-8400-426e-8b46-c4ec02579402", "value": "T1F726A21173F90895F2F3AB30AEB181555B36BDA59EF6C62E3144428E0D76A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898333, "uuid": "3e7328b6-dbc5-4137-84c0-4c117d57df75", "value": "539502771da573641ecc7f6497e39f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898333, "uuid": "c28f9b4c-8555-4016-9202-3ce4cc766f0d", "value": "24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYE:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898333, "uuid": "2f420e48-67fb-401a-ad17-0fe3f9c09e18", "value": 4694016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898333, "uuid": "63b09108-51b5-4691-878f-56075ff36f91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898333, "uuid": "e2d20488-84da-4f57-883b-e2717c6766ac", "value": "0451f1e9e022be9236f1076a39f854f7085854df87b368e2743912b29b69df82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba37d72-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884705, "uuid": "af5bac8b-c34d-4bd1-a646-30f151305ae0", "comment": "Malware payload (Gafgyt)", "value": "18d8e3028f02c8949214392154c231b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884705, "uuid": "915091c9-1cfa-40bc-bada-54fe7cc25081", "comment": "Malware payload (Gafgyt)", "value": "04bc77415181b3a253187cb7edf8cfdf0627cc1bfb3fa3e9caf7c326b0a4f592", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884705, "uuid": "ec855d55-ee49-47e1-8089-c3fcf4eddea9", "comment": "Malware payload (Gafgyt)", "value": "f3033fc4d2f68da5570f4279087ee29fc8c327ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884705, "uuid": "405c29fa-dc46-4dcf-8d81-c49831e3a575", "comment": "Malware payload (Gafgyt)", "value": "b5d39cf8d4d38d3f6e4126e29c2ded31785d96c3edd1c6e434b8196c0961dc10a87c58041b8dabf2965cd2d2fd7a44b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884705, "uuid": "0e2bd17d-cfa8-4436-80e8-175d3ece1fd2", "value": "T19DA3491A7240D5B3D04319F222979B210632FA7B192FFB5BF7593CB4AF154C4B222B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884705, "uuid": "8fe3b6b0-ace2-4ab3-a50a-01e6bcc2c8d3", "value": "3072:I/Ya7PGzUCUDbOCOJIRXHr7oySNxrc1/oqmmqkc/EJEc8hG:I/ZGz/6O9GNLgxrc1fmmqkc/EJEc8hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884705, "uuid": "bb816ce4-5af0-4d01-b7d3-cac65a3591d8", "value": 100715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884705, "uuid": "1fb84edc-8db1-4425-a226-98d07c59b12a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884705, "uuid": "dc5e36c3-4be0-440c-9745-03ea302740c8", "value": "18d8e3028f02c8949214392154c231b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dc3233-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (HawkEye)", "timestamp": 1632884799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884799, "uuid": "52afdff5-d90e-4c3b-85b5-aa9ab778cc34", "comment": "Malware payload (HawkEye)", "value": "a3a411523aa5bf3818e8925e908be9a2", "object_relation": "md5", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884799, "uuid": "a716b3ef-f423-450c-ac21-556451817709", "comment": "Malware payload (HawkEye)", "value": "052a6543d8392cf4c54e7f88f80b41f571ea4e937e3caa6fa9b42a860b40b30c", "object_relation": "sha256", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884799, "uuid": "0961f840-473d-4a74-857d-6ea0f7aced97", "comment": "Malware payload (HawkEye)", "value": "e356ce5f29c820c5fc7ca65c242be082bafc8fe8", "object_relation": "sha1", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884799, "uuid": "3036bd2e-ea44-4009-93de-6412435cba52", "comment": "Malware payload (HawkEye)", "value": "3272fad9d5e38b0d57ff024ed8aaf2370cebe07aa6b3074f947beed630bfe24a12f396ed7e22e90333f1dba985976563", "object_relation": "sha3-384", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884799, "uuid": "9b089bab-06e4-42d9-ac35-21663387217a", "value": "T1A1465FC2B6ADBA32B796DD06C2595B1B5560C613091F3C11FB823F98EF5E88474F89E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884799, "uuid": "0174c552-d2c7-4af2-9b14-dc6d152278e2", "value": "6144:iIVT3SDxCADuWlW9bTXGgqMeSbONT+VrNydIy8PMU1AWvfiWRVSwy1PsBUZmXah1:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884799, "uuid": "78c3efd5-8e3b-442a-9dcd-28d0f6af7b39", "value": 5446675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884799, "uuid": "86791211-e5b9-446c-b7f2-6cda54e59c1b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884799, "uuid": "37672d59-50c5-427c-ad96-ac8b906a4dcb", "value": "Scano005110.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6eec249-213b-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632930116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930116, "uuid": "37a68df1-a6b8-49f0-887c-9848d7377b29", "comment": "Malware payload (GuLoader)", "value": "f9911af7dc71c2dc8692d73ef661b6a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930116, "uuid": "56115764-2bf6-4c0d-bca0-67f205e2ddbb", "comment": "Malware payload (GuLoader)", "value": "0557d7be3d3d7b353dd4339e660c177cba1421c61eb8f5ddbd5c66053ea02874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930116, "uuid": "825b3c3c-0de4-41bf-a234-69ee9384b23b", "comment": "Malware payload (GuLoader)", "value": "028f1cfac73f667cf5551ae8d3009dc19c97ce89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930116, "uuid": "0d590276-a1d0-43f9-8a77-9d7a07542887", "comment": "Malware payload (GuLoader)", "value": "c7b4a01dd3ed0999d49196f55a8e225953065877f7f3a86a87f844e407e6bb98c608395630caf373b6b9b25cd1c285c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930116, "uuid": "043c0669-2ada-4910-89c9-07dd02b4f588", "value": "T1CBC307976539682BC573B9F6E314926E120D3CF712D0484A16D4B71FBE23CBA78A7D02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930116, "uuid": "38ad6452-3382-4197-ae12-bc7dacd7d032", "value": "71d5a9f33de2f7c250bf122de57cb463", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930116, "uuid": "36a31f21-c420-4e18-93f4-c8d67b03afc1", "value": "1536:WD/fn1kdwiRYhbfXUJj5yL8IEQ2p/FFDWua9dUwypPIlP9L:k1Ji8XUJj5yQIEQY/rDWd9dUwuIJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632930116, "uuid": "a59c8e65-fcc2-4729-9aa3-1aad0ec7291e", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632930116, "uuid": "16a427c1-e7fd-4e66-8f5b-86befc56acc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930116, "uuid": "9b7c08a4-5c72-4544-9cdc-3273463fa621", "value": "komunikat bankowy001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af075f1d-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632919768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919768, "uuid": "0700a1df-7ead-4cbe-a86a-196ea6027cc3", "comment": "Malware payload (GuLoader)", "value": "dd1587fcec7d9c61b5b564898714ccd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919768, "uuid": "2c3e673c-8ad6-4801-9607-9703a2f70bf0", "comment": "Malware payload (GuLoader)", "value": "068c246a584ef5cb5bf4eed36c06be63bef42cb4a1ce606349e1289b63acf8e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919768, "uuid": "5f09c7f6-c4e8-4b6f-abd2-a40f8fa8564e", "comment": "Malware payload (GuLoader)", "value": "50a04052d69e2b382ed37df8e29d814311f7e1c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919768, "uuid": "bf0e1c7d-4a7a-425c-8d9b-e37e2c61a96f", "comment": "Malware payload (GuLoader)", "value": "64f6b36b65949bdd922412f45cc27a9d6d50c4787a0f496a68a0011124418a263cf7faf4651566eb409e5bdac8c86c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919768, "uuid": "3db94340-8d8e-4f7e-8c22-5ec8d4db28f7", "value": "T1DDB39D8DBA5C7ED1EC899131E917896CC2A37D46575A8F2F26B3B90F1C362C19B37006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919768, "uuid": "159a58cf-9cf4-4018-9b7f-2bbbf1c8a771", "value": "2baf2cf5457a6cbc889a1294e9abb0e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919768, "uuid": "443da41d-4e93-4e09-a3dc-28ed0a43606e", "value": "1536:4cqyAJ418XIpCE+fmljKfB9CqGAaHAKIu2tNizGsotk4DL:47JGB+fmC9CqmAJCznik4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919768, "uuid": "9a2849bc-2047-4d86-abc0-e219b79e6d17", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919768, "uuid": "194812b5-e448-43ec-a1fc-899530710393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919768, "uuid": "939fd743-aa99-42d9-bf47-d95bc6116a38", "value": "URGENT INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c65e22-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900076, "uuid": "54ff1b53-0259-4358-bf3d-c81975e34ae9", "comment": "Malware payload (Dridex)", "value": "1e03b16f8d9d971536dd566d488b9d9c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900076, "uuid": "7e91246a-8e04-406e-a708-29c5b4bdc706", "comment": "Malware payload (Dridex)", "value": "076d8c2ec80b0f702f92aa0aaf5e6b93b0095b1802db8c231decdc79d27d7c59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900076, "uuid": "ec7580e6-8727-4a4c-88b7-5754b958cbe5", "comment": "Malware payload (Dridex)", "value": "959d571734800cefef22f5e19786a95bd5b2e815", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900076, "uuid": "4a1a896f-192a-45e7-9e80-7b7a377922aa", "comment": "Malware payload (Dridex)", "value": "6be3e462843ff5453dfbbfa436b8ed4f12cca63d8abaa22d79a309725b20fcb39192b9020335500cd8f0ab551cfa02d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900076, "uuid": "3c0037c2-8331-4a8c-b38e-fab7b0ff836f", "value": "T14CF5E020EF69E1E6C6B89F3E9408352327B93D75110D618CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900076, "uuid": "e8e38e14-23b6-4788-b75e-56f1dd27eb3e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900076, "uuid": "ae5a3c05-448f-4676-9fe6-9bdef8de8503", "value": "12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900076, "uuid": "9ce8a9a7-6a2e-46d9-bd12-0b06916a2a5b", "value": 3620864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900076, "uuid": "1855841b-3b08-4d29-92b3-64b74149bb84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900076, "uuid": "c15e2528-7a0d-4902-91b6-775dfc2de9f1", "value": "076d8c2ec80b0f702f92aa0aaf5e6b93b0095b1802db8c231decdc79d27d7c59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7efe8f7-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901422, "uuid": "710b4e63-0b2c-421c-bdb0-86116b5a0429", "comment": "Malware payload (Dridex)", "value": "eb5758e060448957fd2cf8f3876672c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901422, "uuid": "7c86caca-564d-4aaf-9bac-8983ff55cb07", "comment": "Malware payload (Dridex)", "value": "077ca69d18f7faf9189e071dfa81a77a899363a214907abf996a0c242913c9f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901422, "uuid": "2b8179d5-eeae-45fa-9f9e-d0234e3cf8a0", "comment": "Malware payload (Dridex)", "value": "fdbbc94f2f709f0a696d1f612b24aea3eed57f34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901422, "uuid": "351f003e-bcab-48bc-91bb-e838ef1c478c", "comment": "Malware payload (Dridex)", "value": "98be25688cf748bdc0d4c1d4485c558a5e3376fec224d0d05bc6cc795c810c8485e18b18c284c8b8af8d8dde5d3ecabb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901422, "uuid": "85d2ab65-f8e6-437d-94a0-066ad7916023", "value": "T18A45E020EE69E1E6C6B89F3E9408352327F93D75110D608CC396604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901422, "uuid": "3fbe1ec4-e2b3-4dca-9610-7cf3581cd57b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901422, "uuid": "834507a2-62fc-4ea2-84ca-ad0e91080de4", "value": "12288:4VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:tfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901422, "uuid": "676b2633-1e7f-4e37-919f-fe4b877df22e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901422, "uuid": "ea79dd1d-a69b-45bc-b466-7811e0720dbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901422, "uuid": "fde851a5-36f3-405a-aba6-3ad392449208", "value": "077ca69d18f7faf9189e071dfa81a77a899363a214907abf996a0c242913c9f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8261cf0f-2110-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1632911533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911533, "uuid": "e9f0f3f5-5185-4e16-99ad-5ea51df62591", "comment": "Malware payload (DCRat)", "value": "a86c769bf720961f383d3adb134c7365", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911533, "uuid": "0eace067-34b3-4410-b6cb-49dfd5db0d52", "comment": "Malware payload (DCRat)", "value": "07df44c8c194ae93a713ff62e81a65f7deba348f322029b97db182520e57c86b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911533, "uuid": "a66a1489-3f42-468a-b5d6-18c21538929e", "comment": "Malware payload (DCRat)", "value": "de72c54086f07c34cf24399c3121b6fa5a2023d7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911533, "uuid": "fe391c72-6057-47e0-b4db-9e01a99c0387", "comment": "Malware payload (DCRat)", "value": "8743f544ab27160a1ac0a0b8ab6b8727e072207a09fdee6a346ad10201c330689e4ae93f1c4e62c18f65a12f607cc007", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911533, "uuid": "862e37f2-2f03-427c-8f4d-da5ec5f20013", "value": "T10B556A167A84CE12D1791A3BC5EF516487BCBD413A62CB1B7EAE335C25513AB0E0E1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911533, "uuid": "0748923c-c550-4fcc-bdef-c2c28aa4e939", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911533, "uuid": "94102f9c-97e1-4aa1-81fe-8607e66f6486", "value": "24576:P2G/nvxW3Wi00mGc+iFBWsxdHz7uKHsHS5LnpH6dngp+42:PbA3KLlriAal/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632911533, "uuid": "3679c3d3-86f1-47a0-ab9d-1ab411af948d", "value": 1379008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632911533, "uuid": "f6bd5fa1-861a-474e-95d6-8cb320ee21b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911533, "uuid": "6bce0521-861c-4d96-8fc5-8eaed014c37c", "value": "a86c769bf720961f383d3adb134c7365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636c5621-20f0-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1632897737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897737, "uuid": "4673d9af-8da9-4879-809f-58e6f5b57e68", "comment": "Malware payload (Vjw0rm)", "value": "920ad067eeb1b674efbddb5f576a3926", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897737, "uuid": "69e8da12-775b-4fbb-a4af-95531f9497db", "comment": "Malware payload (Vjw0rm)", "value": "080069323805f67a898f62517b17786d46cc51e9894cd490ee0ba789271e1d9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897737, "uuid": "b4ac5fb5-132c-4671-92cd-a253855237e6", "comment": "Malware payload (Vjw0rm)", "value": "3339cfccc26898a8e64130d5f784bae479804726", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897737, "uuid": "b6df1393-3f7c-4ea1-83e3-3a090bb4497e", "comment": "Malware payload (Vjw0rm)", "value": "30c4d567384122c1b600001d9cae931fc3610d596c66690f8b1a2cdb58ea67a2668541a779095eee45eee8aec1c0ee64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897737, "uuid": "2ca494f7-9564-44a4-8992-153d5f39bb0a", "value": "T1C912AF4579007EFE18B29BEE413C0D1CABD06F64214267DCC721F7915A32EBAA642D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897737, "uuid": "1b45f070-2315-4c76-b1d2-07ade0f80c57", "value": "192:QmMFFRmQ9fG2C/aaVzCBhlds0f8FoFdQauPuHHdcrE9hiN/6RGap3Ff3yq:QmMNPuaaVys0medQ3PunvnK6k23yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897737, "uuid": "fdcaaf64-a9de-45fe-8329-2bd1e3ff76a7", "value": 9797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897737, "uuid": "08cf81e4-79b8-4b30-8385-757c1c75c125", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897737, "uuid": "d122d712-40a6-4ae5-855f-faadb55dd2e6", "value": "#T01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd9fe2f-20db-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632888893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888893, "uuid": "4ae86941-e1a7-4eec-8124-623b11540ddd", "comment": "Malware payload (Mirai)", "value": "1b9bbf39e88557df4775e649e5057816", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888893, "uuid": "f5384578-3157-45df-b4c0-e37f8f599965", "comment": "Malware payload (Mirai)", "value": "08431aeee9e48fb6477b1fa273a0d422ea057a2a1fd0bb3973510e4b0f87421a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888893, "uuid": "017635d0-3eb1-4ed5-8ade-adafab6555ff", "comment": "Malware payload (Mirai)", "value": "dc4b1878da95443c206cf09d68c0578dc11bf8e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888893, "uuid": "ca7939e9-e80f-4dd7-9d12-0bbe4db27c03", "comment": "Malware payload (Mirai)", "value": "cefc4b5186c7e5d12931148dd17f75d2323806c61129fb11c0935f121053e9061d4ccab592ab32c85ccdae89dac91573", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888893, "uuid": "47422f78-8beb-4334-901d-10694dacc85c", "value": "T163634B11A97D1E13C0E4E47A12F7971AB2E5264E25B48B0E7D620F8FFF225805E435F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888893, "uuid": "add95e4d-393a-46a1-91d2-af5eed13b3ea", "value": "768:87p8321M7mo9q9sdGN9tviYzCwhXERMKl8Xeg7Vi1DZ3aljO+zk6VzwqHAlZ:kp83aMSsSsdGN9tviYzV5OMZ7Vi1ZyX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632888893, "uuid": "d4920f0b-db19-4003-833a-1fe345a96988", "value": 67872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632888893, "uuid": "77817d3b-19de-4ef0-9b52-735aea32d5c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888893, "uuid": "ac018cfa-2185-460b-84a7-8a9a0b332322", "value": "1b9bbf39e88557df4775e649e5057816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20db5c97-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632901491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901491, "uuid": "7d43e46e-cdd2-4866-9fe5-da1ef15b59c1", "comment": "Malware payload (Tinba)", "value": "5c1a9ccd7a79e77635b6b67ebdb8a461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901491, "uuid": "a0c25c88-4456-44d4-a476-c4d628c1843f", "comment": "Malware payload (Tinba)", "value": "08e5c6f4a6ddeaf4d9633bb2af613c804ebc48c6995db265c9f2221d93e49120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901491, "uuid": "abda7da4-a81c-4789-90fd-bed528d34516", "comment": "Malware payload (Tinba)", "value": "b097c538fb1d23dd62277ecd81e6e9f414dc257e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901491, "uuid": "ad0daccf-f1a4-4426-872c-f9172f2e622b", "comment": "Malware payload (Tinba)", "value": "dcb353edce7275fcf68f4754db94d5f8c40d7cbf092afcb37cac2fa8925398d136be620b3f036c7ac0266a9b8b36dd78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901491, "uuid": "4dfbf3e5-aed5-4059-9c03-eba2da4b2714", "value": "T14B252972E205E48BE917D4F6991ADC3124A33DBC98A0495E32E97F9D58B3AD30449F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901491, "uuid": "610acd86-696c-49b9-bf42-4d773a63dbcc", "value": "d8e139e0f88ebfd29de489053d171e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901491, "uuid": "ba081741-b228-4f4b-ad5a-553d31d4d02d", "value": "1536:pKMxrpM6t6n4+DLGgh3aOe5idSQmwzqnwqjhurmKFct:Ye64+XGEKFRxwGjAqGct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901491, "uuid": "42ec4413-e412-4c8c-82f8-0dc76b3c8a52", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901491, "uuid": "be6112c5-1434-4454-bbee-efcc40ec63d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901491, "uuid": "3ba0ebf6-b728-404d-87c9-8a5ff566fc34", "value": "08e5c6f4a6ddeaf4d9633bb2af613c804ebc48c6995db265c9f2221d93e49120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8defa85-20c2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632878204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632878204, "uuid": "8ebfc951-61b9-4d62-8df9-ff3399a019e7", "comment": "Malware payload (AgentTesla)", "value": "23d929c34af186ed37ab611cbdb4eaa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632878204, "uuid": "388b80ac-7503-4a53-9579-4ecf6f2ef417", "comment": "Malware payload (AgentTesla)", "value": "091c4d948bcafcdc8e959cfb6e0dea2f04ef4d6aef245aaab0da977090abd3c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632878204, "uuid": "46bc3c95-4cf7-403f-905b-ddc85ad4dadf", "comment": "Malware payload (AgentTesla)", "value": "055fef79b6371c93f44766f252ebbd5a44903f65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632878204, "uuid": "4a02864c-a058-4c90-8cff-e793ac56bf96", "comment": "Malware payload (AgentTesla)", "value": "e2b5412164ed6afc8943d383c66d5ecbca1cabf5792e046b864ae075a409f78a76fd55c8a94f3d119a7ea754d0b7bf7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632878204, "uuid": "6d7b1fe5-a9cd-411a-990d-5f776b52af95", "value": "T1C1A39E4877889715C0781AF9D0E3977407F2DBCB6272D74A3E8C19B60E123E88A95BCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632878204, "uuid": "3752d0c1-ef68-4e1f-8bb3-4a62f93d1dfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632878204, "uuid": "01be7702-0d4e-4a60-a189-563be43a66cb", "value": "3072:VcRdB/aG4sB279lS0h0CTXYmvFMQ4b1LfN:eRZ8lS0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632878204, "uuid": "70247f62-4e2f-46d6-9c68-882b1223c1f7", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632878204, "uuid": "9be51cc0-c5ab-42c7-aa08-611f8dd7cb88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632878204, "uuid": "5944afbf-dbef-44ef-86f1-b9ebb7d34d1b", "value": "Document_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4286d2e3-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632898541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898541, "uuid": "4fd58343-9550-4fdc-b28d-d5164fabdf44", "comment": "Malware payload", "value": "cd237b7cb9756fdf11a80a8445d5e046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898541, "uuid": "1c3519d9-b054-4e57-ac44-dab668820a59", "comment": "Malware payload", "value": "095ffe3af247ec9a7645cad8b3087fb41291f0a1bf0f313786dcfd066009fa55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898541, "uuid": "8d64d587-fda4-4aa4-9aa3-f53ced58f117", "comment": "Malware payload", "value": "e0a4f59c56849a0698de5c2d015a90eca59c190d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898541, "uuid": "0d4cf561-b52b-4189-a868-3ec18a8ea932", "comment": "Malware payload", "value": "fe8af3a735047c8942facaad957a2a22d0c0384ae71aa472e74b30f1b80da90d6b0d1bc668b2ff0cb66410d4f5ba60ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898541, "uuid": "7cc61297-2bc0-49c7-a15c-b49057b60d97", "value": "T1BDB4A8394D2782F787EEC66CD08C1BCEEE66A4837B915F1AC496D7D2025B70BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898541, "uuid": "8698f131-d76a-451f-b354-60f6b34fdc63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898541, "uuid": "4a112499-d548-4df3-a11f-9215d62229bc", "value": "3072:V3ykXaBwMiBheUqOUv5Qec8j/aknaLpzNG9n8PNa:baOUVsemcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898541, "uuid": "51d4bda1-ecff-4767-9a94-31ad05562448", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898541, "uuid": "025ed608-a510-4e40-ac5f-2a10ef4f164d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898541, "uuid": "e3c58372-59aa-4c3e-be7c-2960cc1e017a", "value": "cd237b7cb9756fdf11a80a8445d5e046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66eddc2c-2121-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632918788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918788, "uuid": "086a0ac2-f09d-4c35-880d-376792c2fbef", "comment": "Malware payload (SnakeKeylogger)", "value": "446049732d7dcec9ae02e1e79905528e", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918788, "uuid": "fe2934f6-e003-4a31-af30-eb3a61316cb7", "comment": "Malware payload (SnakeKeylogger)", "value": "0a34fbdb0f6d6292c260946e59bae1a0de0479c10fb27d98ead9bbb4e1aa9250", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918788, "uuid": "b06bd229-7680-41cd-9f73-637483e40192", "comment": "Malware payload (SnakeKeylogger)", "value": "3b563069cb5e3e56739832acecc49414aee5ce0d", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918788, "uuid": "54a6f633-a873-4561-9d04-7c457c726bcf", "comment": "Malware payload (SnakeKeylogger)", "value": "a6dd1ed974bc54fd8171ba892caddf951aa1205c56021e25ff5def6772820dc327dda37a6392fc8f25a81166104c5755", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918788, "uuid": "1ab3c170-568d-42d8-8107-53981beb3950", "value": "T16794238E8D298AD7A744F99B85CF5CC79207278D33D3F01142DB9B81D1AC225B93FA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918788, "uuid": "6fc69a12-e868-43ce-a7ca-75b7f05dcfe8", "value": "6144:u1qQRMCztAwq62MRzUAGHy2b+D7W1yqXNF9CYsqo3oAVG/JgzBnZk:Cq2j5dq6jdR/26HW1tXNJQYAU/JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918788, "uuid": "60ee76ae-eed0-4722-9fb6-6f89fa503cf0", "value": 412929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918788, "uuid": "4c02da1a-feea-46dc-9caf-43d6a05d7d8b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918788, "uuid": "ff236ee6-8728-46f8-afa5-33a1a308f90f", "value": "PURCHASE ORDER QRIA.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc0f582-2177-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632955975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955975, "uuid": "98e7fe32-2257-441c-8b03-608bb1035d0b", "comment": "Malware payload (Mirai)", "value": "1459245b86db6e4e8472b86551530e96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955975, "uuid": "81210fdb-a06f-4307-a825-9598b3448c0d", "comment": "Malware payload (Mirai)", "value": "0a74d404dc138579d7c9739bf8eff94052e02cd9bc9552eb7b7d62afd0280cdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955975, "uuid": "c615e39d-58c5-4ecc-a9e7-7fbbc7366db1", "comment": "Malware payload (Mirai)", "value": "9dbbc9900f044fd771c251ab630cc67e40a157d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955975, "uuid": "b7dd5cdd-99cf-4ed0-9b38-b2d5ed92c89f", "comment": "Malware payload (Mirai)", "value": "b0b86b675a2d2319ad569b0e8f01a8409c07eebfd4d7278acad2b4c6d612d975e7c79301873f4aa09470b17bd90eaec2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955975, "uuid": "3ee3fd7f-7e67-4cc9-be87-e48e518a67da", "value": "T1FA030856BCC28A2AC6D0537ABA6E409E332073E8D1DF3717CD151B147AC652F1EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955975, "uuid": "ba290775-d508-459d-916c-c4a31cb16e51", "value": "768:1cc4siKFA+c8dpncagsLum4giGDWIOrL4vbv58LShHKK65eKl6DhdP1Di3gWcN:+cGKS+cApnDgsLujcWLAv58WhKeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632955975, "uuid": "54e21f55-d87d-4f35-8806-70c3cec2f668", "value": 38844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632955975, "uuid": "2d5c0e73-3fe9-495a-9096-fd5f0f84df12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955975, "uuid": "f516eb9f-b38b-4c0b-830b-1d17a392f7be", "value": "1459245b86db6e4e8472b86551530e96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f991f41-2128-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632921648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921648, "uuid": "1b954306-e22d-499d-8cc6-74889b6d46df", "comment": "Malware payload (Loki)", "value": "4d6c2a5e32807e91954df38de48281ea", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921648, "uuid": "c8648a28-3d4e-4848-acb9-b8856bd71151", "comment": "Malware payload (Loki)", "value": "0b7600218f425448d4aff11464ce7ff407e6c5815006000fee505c4cda3adf2f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921648, "uuid": "72456d6d-4806-48a1-8ab4-7a7ad1c599aa", "comment": "Malware payload (Loki)", "value": "60ab7da0c62bca73b27b90263bb0427d0ad5a426", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921648, "uuid": "cd239943-7b1e-4965-ac8b-ea61f23e53fa", "comment": "Malware payload (Loki)", "value": "21f7b9de0f127f36e3e8dc36928cc7f1a7e7a7960a303f3c88d231c712fbc558f3b6d6127edc4d689d8d7355a4fbb2c0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921648, "uuid": "7da1e99c-9e89-4745-aecc-1c51f78a61e9", "value": "T1514422526B90C4BFD0E740354EB1FBE9F77BA2064028668397F45F393BA81E7080A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921648, "uuid": "4c4fe296-7733-4892-b346-9fe61bf9cbb5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921648, "uuid": "69961f24-f6a2-4962-abce-78893e4b0600", "value": "6144:F8LxBsRI1eLLTiUSGM7NH7hHSSuq2B1s2bVD1S:/PWUSGM7fHS0e1sO1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632921648, "uuid": "3e1198bb-65bb-4e8a-96a0-c95b0022f612", "value": 258113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632921648, "uuid": "9ae9bb51-6ed9-421a-88d5-4a1f13bb3099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921648, "uuid": "e0b089d7-27fc-4b13-97ff-965df5f92e23", "value": "lista de precios y nueva cotizaci\u00f3n.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a05cfac-20ff-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632904244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904244, "uuid": "2f33d155-8b32-4856-907e-5d98f0155618", "comment": "Malware payload (ArkeiStealer)", "value": "ebdab561089965de92abfe5c3d2ac72c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904244, "uuid": "17f0f056-0a12-4d0b-9e95-752893fdd87a", "comment": "Malware payload (ArkeiStealer)", "value": "0bb8d53e8e71c103995d4f931cbe7b3dc692ca28b8f674c151582b32e363528c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904244, "uuid": "9e81f786-ba25-4d65-8255-5d4dc5c1f593", "comment": "Malware payload (ArkeiStealer)", "value": "f77c871f72f9329c0d2a2d1459198b66f1fb1f44", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904244, "uuid": "39a086a4-4124-4a8c-8903-374a2fecbdd1", "comment": "Malware payload (ArkeiStealer)", "value": "5cf8f94f82c1abc37fad7b03f2b363bfb29ca8595cf12180e6ead78e4759f9192a38444b6147ba58cbc1888507c3c359", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904244, "uuid": "e09517f5-9938-4627-9041-cfaff0de359c", "value": "T147D41211B582C3F7C713007EA5288A9CE92D799CEFE977753B5922CF5B381A3B522205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904244, "uuid": "05fbba05-f2e1-4995-b4a4-b08be0e81fef", "value": "1b0c9928ebc845bd66569c85cdb994cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904244, "uuid": "7fb0b110-3e7f-4d21-8843-b66ef32a64fd", "value": "12288:Ntc67K/KCqXh7rPglTPB3w1tWMQIdAcPvdvp+NrJY7fsxCWI1g+:Ntc67KLK7rPglTJ3wFF+cPv+N7x9I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904244, "uuid": "ae3a70e4-37ea-475e-b299-217c3378028a", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904244, "uuid": "40971315-641b-4194-b945-cbab34a9e302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904244, "uuid": "3ab5ed2d-5fa8-4a47-bae2-97d9af2c7fb0", "value": "ebdab561089965de92abfe5c3d2ac72c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bf8442-20ee-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632896722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896722, "uuid": "fd04db1f-b855-4ec0-9c58-1f367b804ac0", "comment": "Malware payload (AgentTesla)", "value": "ad368be19f2ecc82a690ca1e6ae5d8b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896722, "uuid": "3c0f865d-243c-418c-b783-25da7f5d3da0", "comment": "Malware payload (AgentTesla)", "value": "0bbd1be1e7698d114b1cc952addf3c8e2c31b159cbeb6a0a3622ac24dc65bfa3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896722, "uuid": "6e34483c-2590-4247-8abd-bad79e330b56", "comment": "Malware payload (AgentTesla)", "value": "b7bd2853406e6d1eb7597413fe3a2d54627ec95b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896722, "uuid": "0d3ec38e-565e-4fff-9b6a-aba3310f9fbe", "comment": "Malware payload (AgentTesla)", "value": "6ae34332dd2e79e324d472e5f4ed1027298331d576eac5c53917f0cc3c8534aff3b37ceff1517c17ed331ba096ff2d06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896722, "uuid": "7115bc1c-f909-4dad-a580-618bcdf5663f", "value": "T13BA4238073399612AFD4953CA51DB8D8E1F369E3EC522AD494DBC07D3E4B3A1A2CD583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896722, "uuid": "2f11f21c-e911-4580-a95e-03dcdfa3ead9", "value": "12288:8XxhcpKFSFs8CKyaJXlPAUbSCC3//FNuDF/JdG:8BCpKFSlCJavlbS7uDnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896722, "uuid": "75297ac9-0a45-4016-8711-a02ee85fcc3e", "value": 488067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896722, "uuid": "c6b02b84-6a7d-480f-8b2b-ade7a54bb8c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896722, "uuid": "d2d98a84-a7d6-4759-aff7-d6e1940c3288", "value": "UKLSiP 40-4_RP_Z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255598ce-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1632909229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909229, "uuid": "1848fe2f-71f1-462b-bd3a-c014a2e2016c", "comment": "Malware payload (DanaBot)", "value": "baabe38154bc2271d603513346457154", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909229, "uuid": "216dcf21-bc1d-4475-a91f-656cf78a0509", "comment": "Malware payload (DanaBot)", "value": "0c1978c1bc51c425f13e670074ddfd36d3e6e458dab5bcb1527c2b37953e13d6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909229, "uuid": "623929a8-f0c1-47bb-85ac-4792de14f174", "comment": "Malware payload (DanaBot)", "value": "86ebdcd4ba7e7985c80f3897d5adba2d2c923d52", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909229, "uuid": "764e5c61-d3ff-4500-a2d2-53b9b20069cb", "comment": "Malware payload (DanaBot)", "value": "81dc02a061ffc328c4be4dbc20c39597a0ce0a92cab1f159e490ada5101095901689ed5bd86db88ff9c379bc397d66e7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909229, "uuid": "598270dd-d2c4-4e9b-a7b6-966bb6ae75ae", "value": "T15E352311A690D1B0F34701FFAC7288DDE81DB8ADEFDA91B637151DDE96382A3E064213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909229, "uuid": "9e5c7ea7-773a-4109-96aa-33c44cf19381", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909229, "uuid": "b28d043b-245b-4fef-a690-e741f064ba31", "value": "24576:fIzU20wdqW5MSQFzmCKeiXSyTR6xj7wLEoq3kdWerj8OayAxI1:fcUkqVFiXrij7wT3Pay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909229, "uuid": "01d5d97b-17cb-44d5-b10c-94f2a892a62c", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909229, "uuid": "67343cbf-fd77-4035-8c26-9f84447f3169", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909229, "uuid": "965e0420-71ea-4a28-b1c3-a69ab5e5e405", "value": "baabe38154bc2271d603513346457154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5328868-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898411, "uuid": "667833c3-55a0-4e42-adb9-bad7c04bb093", "comment": "Malware payload (Dridex)", "value": "27baecd1784c973e9a8b19786fe8180b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898411, "uuid": "4eb4e126-0d20-4631-afec-f18ba4eb9e2b", "comment": "Malware payload (Dridex)", "value": "0c20ab4e8d546b83d42d0b19994d5cba13d3ef9f0a05ac4f1f9a29171485f13d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898411, "uuid": "6da51403-aa47-4055-9609-52826b9074a5", "comment": "Malware payload (Dridex)", "value": "0dbaaa65f2d00e3be1a2d77ee3bc130ce49f1dd3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898411, "uuid": "38ada1c3-3fb6-4786-9dab-7d91e9c1abeb", "comment": "Malware payload (Dridex)", "value": "0e790fd5417e47762809d42f9d71d361baa07e077daff8458e167ae69d8a01253be603a02b220c96ac3e88d618f274a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898411, "uuid": "99ed80b1-ef61-4552-a3ff-59c0358b514f", "value": "T11B06D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898411, "uuid": "3c5ffead-4e83-4bd6-9049-40c94b41024b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898411, "uuid": "78db20fe-192e-4ac7-896b-9bd947a4b549", "value": "12288:gVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:FfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898411, "uuid": "8bf82d85-cc7d-4968-b45a-7e379f305df9", "value": 4001792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898411, "uuid": "a63a7ec1-4248-44f8-aca3-5ce33ad6907c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898411, "uuid": "a198a6da-d4b3-4da1-8ff2-430f78489cf9", "value": "0c20ab4e8d546b83d42d0b19994d5cba13d3ef9f0a05ac4f1f9a29171485f13d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46437170-215b-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1632943644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632943644, "uuid": "f90d4f7f-e0f8-4bd4-8f2e-e8d95969d66d", "comment": "Malware payload (QuasarRAT)", "value": "5bab799012d71881094f838df21f4255", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632943644, "uuid": "af5d31fc-ab54-41fa-bfad-1f70ca62b0ed", "comment": "Malware payload (QuasarRAT)", "value": "0d361b8af79631a7b747ddd3e58d939aa32ab23a8d3dcbfa3b1799368179fc13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632943644, "uuid": "6fd675a3-3f82-4ca0-8c74-f27f813d8121", "comment": "Malware payload (QuasarRAT)", "value": "fbea315566668bf42157684c6aaf87b3a643cf7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632943644, "uuid": "c235b957-6b90-48c5-8d50-39fb669dda4b", "comment": "Malware payload (QuasarRAT)", "value": "79f5a0562f1927d70bf0b5e44c7484bdff561e691e1a331c9c356f77d7adb8969dc5596645de484c8516dd2fa7b699bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632943644, "uuid": "0a708bc1-2fff-45c6-94c1-7399f4e14d5f", "value": "T137B46C4063F8862BE1AF577AE871042597F4F407B6ABEF4F4A40A1F92C66706AD40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632943644, "uuid": "d339b559-9684-42ff-9487-14d61c6af981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632943644, "uuid": "935a4298-5139-4728-9c12-4bdeff0e3942", "value": "6144:RTEgdc0Y5X7IxUpGREW6dj1bRKlh/A+J55QBcE0Qb8F9hRv39TAcTR3S:RTEgdfYqxU9dZ6h5QETHRVTAcdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632943644, "uuid": "8926faf3-723d-4199-b837-cc565af36df0", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632943644, "uuid": "7101d6eb-b27b-4ecb-a2f9-f5f2570ebeae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632943644, "uuid": "814d69a8-58a6-4c42-8e5d-438074380864", "value": "5bab799012d71881094f838df21f4255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41e77c7-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632901818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901818, "uuid": "be419806-857a-42c9-8839-9f638db514af", "comment": "Malware payload", "value": "a3faa6b6579452075d64ea7481609326", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901818, "uuid": "c9b5e267-c11a-473e-8aca-c4255dc9121d", "comment": "Malware payload", "value": "0e24295a6109df43faefbf365cc71506d0c730ad2cd8ec5d93c28ba619a3fdaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901818, "uuid": "269dfe51-3de5-4b5b-8168-67bc10cad3fc", "comment": "Malware payload", "value": "0671806aed0e0acd5012de5507b4e8d88198eba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901818, "uuid": "72d4e40d-f34c-4184-bb05-c8d645dc191f", "comment": "Malware payload", "value": "007bac1875f40f3a37b02b1adb073f5c544a1155ba0276f804147591552524f34ad6f4f00d4da042e6e728f353b7875e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901818, "uuid": "fe7640e3-da77-4cb1-9061-d37d8df30c9d", "value": "T179E47C1177E88632E9FF1735A8758220867DBC655B71CBDF67809AAD4C323C09A32727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901818, "uuid": "f5ef4756-5348-47b5-bb66-28b36563b7e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901818, "uuid": "f54ee859-2a46-4c20-85bd-d8616e43701d", "value": "12288:R7jSwhUVZwLZr861KKU1zkOY/QX1vcJ6NjMYQjPc:HhUZ+m66zqJm2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901818, "uuid": "dc918e39-613b-4d51-bec2-530e665e71d9", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901818, "uuid": "1bc65086-e7d7-475b-af7e-042ddb107e41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901818, "uuid": "1bd8e635-8e98-46b2-ba25-27a80e0a7f60", "value": "0e24295a6109df43faefbf365cc71506d0c730ad2cd8ec5d93c28ba619a3fdaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4bad18-211f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632918042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918042, "uuid": "9741039c-1425-4107-844c-b975cd634f5f", "comment": "Malware payload (AgentTesla)", "value": "09387b1ecf36ba2ab7d059b0ad7c63fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918042, "uuid": "72d9868b-6588-4759-9989-13fea8cabc02", "comment": "Malware payload (AgentTesla)", "value": "0e7c886916a2197e1f4ff69cffe8cc0f3bed02955dbbaccf2d01b4eb5ad1eca0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918042, "uuid": "b8096a0c-78a9-452e-abc2-bc4249634332", "comment": "Malware payload (AgentTesla)", "value": "88e71a36d76b35f2ffb156d5393e72f6f15648fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918042, "uuid": "485bae2c-d2cb-4d52-b1e5-7c2b1b6b3e76", "comment": "Malware payload (AgentTesla)", "value": "75005799d3f61c6c5a1f30fc5bcefeef8427243abc184243d6d2505019ea130e764bf174530ed2a0851dded6453829a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918042, "uuid": "3ef63838-0c72-4b92-b6ec-71b3235f68b6", "value": "T1EC158D2AB60CE65AFD1433F02524BCC415F81C581C6CBA13BA7672E6B4B9E27DDB405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918042, "uuid": "e0ca02c6-b515-428c-b8ff-f2d2b97728f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918042, "uuid": "624129a9-68a0-4170-8aea-cc0d493541ba", "value": "24576:RD4VHfQe6ZyWshg+qbZxTZZWunAWv23M3Px8FvDEz6qH1hiP:r24p0bEOqVhiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918042, "uuid": "90846355-351d-4432-9035-026e9eb7ac86", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918042, "uuid": "a6adaa02-7a48-451e-8c9d-ece9ad294ddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918042, "uuid": "d9759459-a59e-4d36-8793-0e60f292e7e0", "value": "Scan copy. pdf...............................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ab88d3-2143-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1632933258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933258, "uuid": "5e24b33c-3571-4f50-aedd-9fb54d989f73", "comment": "Malware payload (Quakbot)", "value": "bacea46a71135fa781914c7778029ee7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933258, "uuid": "f152f31b-7de2-46d9-b93f-1bc254d4ca35", "comment": "Malware payload (Quakbot)", "value": "0f64719ae1aeb82cb3bacd7846fb0980f0fa058db16aa0c604ab655478d34078", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933258, "uuid": "ff96d43d-620f-4738-920b-768aebc0f0b7", "comment": "Malware payload (Quakbot)", "value": "251efd0ade7526d59404e446971d9e4b617bce0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933258, "uuid": "d956dcef-4cef-41e5-8362-cd62b9033cc3", "comment": "Malware payload (Quakbot)", "value": "204926f8ed31671a28415cae3ffd53d4b559b772e58148af0d380cc254c2b65b6117782b87e63d893e5d41272fc7fa11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933258, "uuid": "73f6db05-5736-4406-a634-52dc801e8892", "value": "T1C8C3AF5BA02140F2D5B6043CD1D99F39AEFE75201F66A8D7B7B8A6404D205D2E63F2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933258, "uuid": "cfc1e469-74da-46dd-a012-685a1f2ea584", "value": "7b3bf330d8b8bdc633b50cd4fbfebe95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933258, "uuid": "78217a3d-84c5-488f-9cbd-b4b6d1225dd3", "value": "1536:gUPcYXcs+0RYFkfnnUWy2JSC1/8+4Tm88JlNhmwPlDIOEnToIfwYToqMgl:C4UkcWbJDN74TGJnhfPToTBfwXgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632933258, "uuid": "f3bba222-26e5-4f81-9bac-256d2094e36f", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632933258, "uuid": "35a16794-82f0-47cf-88a4-c451d4fe3409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933258, "uuid": "064091e7-ee66-4eb3-ac5b-d423bfd64779", "value": "unpacked_qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e54fff-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884695, "uuid": "e203aa8f-a21f-4304-a9ba-0ebfe6fd6489", "comment": "Malware payload (Gafgyt)", "value": "8b309f4e7f34d84eb64d66b4a1eadc18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884695, "uuid": "9864f062-ab33-4c64-8c4d-af0b4eb00966", "comment": "Malware payload (Gafgyt)", "value": "0fcf07e3d22de372ed433f8afb48b9238b955c49c1b9bacd41da8d13aa1f84f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884695, "uuid": "ed3293b3-b9d2-4e8c-bbae-b62fa32b596e", "comment": "Malware payload (Gafgyt)", "value": "cb1ff08b79b37d51c73e4a8bf07c1db9cfea1603", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884695, "uuid": "3a2940d8-963f-45e8-886e-a36d0c43d763", "comment": "Malware payload (Gafgyt)", "value": "4d42759f15efdd4a6ab7243aabcf8ce35f7552bb771094c3bc5f5013eb6b25b78896582dc3ef16a2ac0f5de59b397010", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884695, "uuid": "658c60a9-1bbb-486f-9b71-c5c02db5f50b", "value": "T1A1B3194FD303C6F3C8470AB11297A66F5521F53B4D2F9A4AF3196CB0AB269C8722D761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884695, "uuid": "2d556b55-ddb5-43da-b707-7023f79ec316", "value": "3072:Et/u13qLPDChiCcHA95DImyoICmmqkc/EJEc8hG:ENlC5DImyoICmmqkc/EJEc8hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884695, "uuid": "6bdc1b1b-fa12-42d8-8087-02ba72f967b9", "value": 108811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884695, "uuid": "939bd963-2019-456f-815d-b80102321410", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884695, "uuid": "a1f1c34e-e0c7-429f-8294-642df42ad69f", "value": "8b309f4e7f34d84eb64d66b4a1eadc18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a295a88-2136-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632927840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927840, "uuid": "d6a783fa-ac6e-46f7-8156-14a5e7318b7d", "comment": "Malware payload (Gafgyt)", "value": "46a7acfcc28cbc70eb451f6a9618d668", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927840, "uuid": "d552f455-727e-4ce1-b6ad-636660dee124", "comment": "Malware payload (Gafgyt)", "value": "104632f1b3bf1147edb568eb693257205edf6fdd5ebd28f290f09e71b354c29b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927840, "uuid": "02b4f3ec-1249-4e32-bf76-67b105b04e7e", "comment": "Malware payload (Gafgyt)", "value": "f43c1424286711cb5e2f46e0d5f1c9cd27386cd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927840, "uuid": "5ca41602-103e-41fd-a7be-d1102ca77bed", "comment": "Malware payload (Gafgyt)", "value": "6cbe9f8e4c2f7b4bc1eb56d8e3a80169c91e2d9af021f4a439bd03cb8c01e03ec1b6e0c02c2a6da7131301dcd1ade654", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927840, "uuid": "10cac738-0965-495f-81df-1a4586f956ac", "value": "T1F214837E7E21AB7EE268873207F76FB0C39521D326A19352E16CD7185E7524C184FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927840, "uuid": "d4255b23-70cb-4d19-b3ed-58d01ccd825b", "value": "6144:GKv3mNVR3Xz/9tmzn3DT3y+aZWlWcWyWOW5WeTg8jF5hUPOzDWmKz6FhdzHWlwq:2gAF5hUP4DWmKz6FhdzHWlwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927840, "uuid": "6f35ba01-46cf-4eb9-9590-a3b4f2ffd92c", "value": 201424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927840, "uuid": "2ab179ae-082d-4ced-aa15-b43515438b2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927840, "uuid": "dc40df41-cf75-4eda-9bc6-dfe53765b24a", "value": "46a7acfcc28cbc70eb451f6a9618d668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3c4dca-2124-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919923, "uuid": "862ca6cd-83d0-45de-8736-c167308124df", "comment": "Malware payload (AgentTesla)", "value": "292ff8ea142a4d4237b8c7273cf137c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919923, "uuid": "f05035a9-8d95-4da2-b1ee-a297e60e7391", "comment": "Malware payload (AgentTesla)", "value": "10e447adbf20e0b70366c366951d3381930d68ca0e07d9aeecc2b53560dec58b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919923, "uuid": "e6a21b6c-3b9c-495f-9ff8-84196ba4cd82", "comment": "Malware payload (AgentTesla)", "value": "49a983c0502ca139156858c883caf6703bc4e6ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919923, "uuid": "ea96bf0f-f6cc-4240-a912-8b95f7d97ba0", "comment": "Malware payload (AgentTesla)", "value": "2ec4d94613b84467a1faacffdf1dcb135fad915565a9df0395fb9bd629f82125fe94bfcab77601f8f43ecda1473ea7d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919923, "uuid": "afed4a6b-92cf-4bee-bebc-29ca5860699e", "value": "T115158D2AB60CE65AFD1433F02124BCC411E81C981C6CAA17B97675EAB4F9E27DCF505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919923, "uuid": "40b58aab-6f48-4f98-8096-fe98ca1b7284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919923, "uuid": "51d2833d-7d4b-4508-a2a1-2545e425bad8", "value": "24576:+3M3xDNWEl7fhKFHXoD4VHfQe6ZyWshg+qbZxTZZWunAWv:u4xtiHXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919923, "uuid": "9e39b430-e738-4d29-a966-882c07061c65", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919923, "uuid": "fbbffa60-ffd1-4232-b5f6-66bcaffc937a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919923, "uuid": "e4188385-1a9f-4267-b692-b6386cf59ac9", "value": "Order_0177PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecb5364-20ff-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632904413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904413, "uuid": "81f3d5b8-8e65-4bf1-8e8d-27a37fa8da41", "comment": "Malware payload (AveMariaRAT)", "value": "2fdf8baa775386e3902a913171081ae6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904413, "uuid": "73d82fc7-5ea9-446c-b8fe-af89e2c46903", "comment": "Malware payload (AveMariaRAT)", "value": "111e4cad9280cf2f021de877420955659f820d6bde18775540adc2fba866c0e2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904413, "uuid": "f20f0e94-d8cd-4db6-ab71-1489becf54d4", "comment": "Malware payload (AveMariaRAT)", "value": "eba5e07128816c200af0943e3f780c5250ca480d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904413, "uuid": "4f3c761e-5560-4112-9732-69e94e8a87cf", "comment": "Malware payload (AveMariaRAT)", "value": "bb9db0c3935a533b97d0cdd9b2d24f6fd5c9ecb3d04e968ba5698a42646bd241435a25f3a3722c5d342cc3d2e0dd5cb9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904413, "uuid": "fd523598-d726-4de0-9fe5-980c112bee04", "value": "T1FEA423C135A30D85FF76C5F3AE6E000A1BAA4656133D48A0EC69CFE38D3317E589D6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904413, "uuid": "ccc3f91d-1b1f-4bdb-a93d-9dd8e12b2b1e", "value": "12288:2CPepIP62nBauXRbnQzxu3LWAdk03xN9e9DA6AQh22h:LukPn0AbnQzxupkkl6NJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904413, "uuid": "7aaf179b-aa56-4fe2-9366-c390565cb265", "value": 461293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904413, "uuid": "f2e448c3-a923-495a-b58a-959d7239996f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904413, "uuid": "d220de6e-bd64-484a-a2a6-89ccf6a9e8a9", "value": "Revised Invoice - UY445601 (Cancelled UY445601) Re New Sales Contract - PBM261120.pdf.exe.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9605e0-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632898291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898291, "uuid": "88151ab7-ef59-4942-bef7-659102975fc5", "comment": "Malware payload (Loki)", "value": "4fb6ade5b4ff1b9f62f8e5e1804354eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898291, "uuid": "29b60e5e-bc77-46f8-9140-adba6c66be51", "comment": "Malware payload (Loki)", "value": "11306262bd1f1063b69b91dc2bce27093c38de0548d23fcb464414ad0a6c5400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898291, "uuid": "0ef1ac64-038d-4b61-8555-9a4cb04c27c4", "comment": "Malware payload (Loki)", "value": "4e0ded0ac0564fc975820b8e87baeec2ef788472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898291, "uuid": "b4c50773-6ebf-42be-86f2-d4d19772c7d2", "comment": "Malware payload (Loki)", "value": "ae5a7a63dea847d80bef1eb95afd4bb0b28cdcd636a99fbf9a43e3f6fbbb2dda4a51c569b46352795639b4708995b7ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898291, "uuid": "e4ba9f77-73bc-497d-884c-36b880538ae1", "value": "T13D056C1AB60CEA5AFD1433F02524BCC410B81C981C6CAA17B97676EAB4F9D27DCF505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898291, "uuid": "7c4b82e2-1042-4bd8-86dc-5e664c6df2c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898291, "uuid": "dddaea54-d1e3-4283-aeec-07fbb4c7b472", "value": "24576:BD4VHfQe6ZyWshg+qbZxTZZWunAWvi3M3N4skRvObG5nhI9iZD8PBAE:7S4N4skRvO65nhDcBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898291, "uuid": "4467c045-669c-490e-b516-ada439f22326", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898291, "uuid": "1b4f9a49-7f84-49c2-88c7-95bbdfb2a88d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898291, "uuid": "412f0623-373e-4fc7-9712-f05535f70874", "value": "Order Inquiry_29\u00b709\u00b72021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b3b221-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632901640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901640, "uuid": "c56cc90a-380e-4820-ad95-45e9157d4199", "comment": "Malware payload (AgentTesla)", "value": "eadbdfad94dd9f47b50013a6c29eab2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901640, "uuid": "d61d518d-06aa-4e8b-8f0d-796243fb5dc8", "comment": "Malware payload (AgentTesla)", "value": "116d3acdcd11c7f527ba7f78f00eecdc470ccde2f0e2dfac43494ba3f04e6dc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901640, "uuid": "6809361c-bb61-48d6-9115-4c627a58ea81", "comment": "Malware payload (AgentTesla)", "value": "eb961a27a073f3249a68ebec739198a2225f5e89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901640, "uuid": "3ee5d327-f49e-49d2-8fe1-94879f55e58e", "comment": "Malware payload (AgentTesla)", "value": "53612a501b8116fe6a14e0eff5b0889fb49eb846b6197e993b941f107e3ca2b49089af5769bbc1a7a7e97abf3804b69c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901640, "uuid": "ee76d267-3c44-448a-90c5-99f05ea28269", "value": "T18D450F394D2682F7C3EEC67CD09C0BCEDA66A8937A918F1ED495D7D6026770BE49804C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901640, "uuid": "67644d3a-a454-4aef-9583-2680d61603dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901640, "uuid": "a05399b6-e711-45d5-8ec5-a0e2ee7c855b", "value": "12288:HAscTBkWKcVuXHgPDvh4D1Fj0UN89HNPJWceBpB6AoR7e8yjOG7QD7jrpd:gjSW5VeAPV0VT2NPJvLpyyG7QDDpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901640, "uuid": "b97e236a-5906-411e-a140-61fa8108185a", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901640, "uuid": "218df5e1-e3ba-4d95-9673-74377b6f2557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901640, "uuid": "1445c6fb-de9c-4021-9ea8-b3d9f6356c59", "value": "Foreign_Bank Account Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720da8d0-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898191, "uuid": "2ac934fe-47c4-42e3-b9a4-babbcfbde476", "comment": "Malware payload (AgentTesla)", "value": "8d41d06a133a4a13b0fb479805241c9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898191, "uuid": "a2421e4c-44f1-44fc-9eb2-97079b25e47f", "comment": "Malware payload (AgentTesla)", "value": "117d4d16d42e7644e20c3587ae7f2c380bca658496f8f5d9ae40707e20ff9650", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898191, "uuid": "1224ac5e-83db-492d-9fde-e28c69cb3e31", "comment": "Malware payload (AgentTesla)", "value": "d3098b9fe4f50b3780a948cfc2453871005ad03a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898191, "uuid": "16033b4c-d556-403d-a543-d093c6293cc6", "comment": "Malware payload (AgentTesla)", "value": "f36186eb66a8fa47ddfd0da8dad8850bbf4140793ed421ce093d4db2dbde146fed05fef9a13b5191bfdceb0d0f90aab1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898191, "uuid": "872ca8c8-49d8-4974-9c9e-ca3f1a3e7f72", "value": "T1B5C4BFDE0C64A3DFFB0E05F8FA78378810ABD028D9EBB5D3D606B0335166A695924CD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898191, "uuid": "255082ce-6757-4dc0-9fc0-a3c49b0490e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898191, "uuid": "83921872-3192-4108-974f-b9c87a136d1a", "value": "12288:pLBNi+hBr7IUAK9iaEHK51VuiZLLnrthTDIzLUgj:dBNi+hBr8UAMiUVuMfRJuLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898191, "uuid": "ec67e832-4f3d-4769-9547-7a7b8422e6a4", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898191, "uuid": "2593a318-c3a5-4b19-96f4-f3438d5928b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898191, "uuid": "1a7efcaf-b6f7-410a-87b1-e8764464d10e", "value": "Aviso de llegada-DI, Constancia de flete-BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48df85b3-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632899410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899410, "uuid": "66f0922a-543c-4011-a0f2-7cb092299eb4", "comment": "Malware payload (AgentTesla)", "value": "d6581032fac8f12bf9ce46c829f27a68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899410, "uuid": "4e226533-08b5-4b10-9d07-1b417f0fc2a8", "comment": "Malware payload (AgentTesla)", "value": "11f1e36401475f230b84126a388f3b41c54107b43b6d848ee2e6e7555c382818", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899410, "uuid": "b59e5165-ba09-4576-9dab-1cee12b19f36", "comment": "Malware payload (AgentTesla)", "value": "ac27d8e060d2d3cd819c6f3a84002eb1ef526283", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899410, "uuid": "15a906b2-2a2e-4311-bef0-9df91bac64dd", "comment": "Malware payload (AgentTesla)", "value": "e61d253cbaa78a13038b2df161649c292b13a8c0346b90796a78d6c672f07c4ca2afe64a3db9b4b2a59ce6f161cad881", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899410, "uuid": "7842b562-d28b-4a5c-b066-2a889ac00a62", "value": "T184C4BFDE1C64A3DFFB4E01F8F679279C10ABD028D9ABB1D3D646B033503A9699924CC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899410, "uuid": "fa8ffce1-f27f-4e4e-bf8f-7d1123947699", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899410, "uuid": "c91dd377-36c1-49d2-adc5-9d3484cebf49", "value": "12288:JdwjNi+hBr7IUACEo+tKsJSaHh/qS+TNzppJqAUv0Nv8:fwjNi+hBr8UAC/QKsru7Av0Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899410, "uuid": "7838322c-f5fc-4696-b412-87b50d57361e", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899410, "uuid": "cdb8b2d1-fefd-44cb-b920-bf8ace0ae45b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899410, "uuid": "e8845dd2-85c5-49a9-9ecf-306226694944", "value": "d6581032fac8f12bf9ce46c829f27a68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e1a372-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927571, "uuid": "9ac901ac-7f79-47f8-9b68-7c93e0252434", "comment": "Malware payload", "value": "715fd31d8672021f371ad6a366e006b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927571, "uuid": "8320efb9-1c02-4c64-abf0-8192cb92aa66", "comment": "Malware payload", "value": "123c0dd4477c3875e91a042970c226467d8218671c1484e48ebe3797d3f8011d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927571, "uuid": "bcaf5826-448c-4a2d-ab3a-164f2c9f4a57", "comment": "Malware payload", "value": "62e8a4338988093e03d6366a05b9e977559f9db3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927571, "uuid": "3ff28421-b030-4df4-ae79-b4d914124648", "comment": "Malware payload", "value": "48af07d21ea635c8ceaf36bcf7d5f9750d6d021c35152a0768445cb6500b6dd386f6d657197ce1fa0f50d9d0fe1508dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927571, "uuid": "0675a736-1f26-456f-96a3-652ab9670978", "value": "T1AE725B96EB62C4F5E6BB02F9533165BDB80E8E42034900F748C4196C9F8DAE73D729E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927571, "uuid": "b0c0cdae-860b-4a34-82da-6297f982c7df", "value": "ad122bfbb11a818fff7a8ddcd8135be7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927571, "uuid": "07036856-11c2-445f-ad3f-a6f44cfb330a", "value": "192:Yry8+ovUkfExTRha4+fesWaxvicY01+GVPIwIRM07f/do97deCJuX316UIq4:Yry2JfWa4yC0UsIwIpL/K9g3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927571, "uuid": "e9746609-8188-4ac9-9d5d-9e0525fb9440", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927571, "uuid": "8cd325f0-b3e2-4e88-9c5c-05f5fe710716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927571, "uuid": "5e5f36f2-74d8-4295-9084-2bdfb817c345", "value": "SecuriteInfo.com.Trojan.Inject4.16715.22658.30240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ab66bf-2158-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632942279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942279, "uuid": "882d088e-b23f-48e3-ac9e-8b6748ebd365", "comment": "Malware payload (Mirai)", "value": "035eac2bf99d5547efb9288b726befbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942279, "uuid": "1851b8fb-152f-4939-bb58-808f15cb3ffc", "comment": "Malware payload (Mirai)", "value": "1306ae8ec75f079518c94a0fd14b911a207dd6b9a9c95da126f6e8f09c260fb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942279, "uuid": "8a9c5751-1daa-480e-92b9-00c54a1c5433", "comment": "Malware payload (Mirai)", "value": "d1da5455944d3ac22fbadc90359ea9404b6b6b20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942279, "uuid": "dab634dc-8d53-42f4-b26b-2b179e6b6036", "comment": "Malware payload (Mirai)", "value": "5ec38878f541ef7d845cf8d7eb56a14a5210f4185a9bebe7a94425d45e7407dc8995e6a7a789ca5a313536d325d91f61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942279, "uuid": "4539ca03-d4c2-486d-a641-954707c25680", "value": "T1E8B2D0350A65B674C2F4893DF6BD83C97B8A0BEC62F535639B388734A5C4847A3395C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942279, "uuid": "3ec4ba92-e1a6-4637-ae81-8541031ce31c", "value": "384:X8iENsUjQDTsg/LEChdZz6lu1rJi/mq2XggC0onyM4bzCaFRytDRHPfR7hhymdGd:X8lQDYgYubza6YuXCvpsShf3s3UozRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632942279, "uuid": "991dbc74-5f3d-4ad5-bfd9-a0004c756c66", "value": 24220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632942279, "uuid": "5dfa022b-bae2-4a34-96d9-3b9d2d7e6f8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942279, "uuid": "6d232679-673b-419f-849d-990579a05343", "value": "035eac2bf99d5547efb9288b726befbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f66e5d-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903049, "uuid": "3a88085b-59ae-4bc5-a9db-0745294cf1f1", "comment": "Malware payload (njrat)", "value": "0a9af90d289135ef065a62a0dda8602f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903049, "uuid": "88bebe3a-73d2-4131-8e04-cdd8a38e414b", "comment": "Malware payload (njrat)", "value": "15613d4d6864d22409277e56eff01c2b04e83562dd70f3fee12c675621a5971c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903049, "uuid": "80a50822-f3b6-41bd-9dbf-75221d418fc0", "comment": "Malware payload (njrat)", "value": "12d4ecffca285a1aeb9eca710cca16c71f4231d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903049, "uuid": "8b6f453d-d608-4ec6-995b-2a1d03cc8fb7", "comment": "Malware payload (njrat)", "value": "651c99c367e9fdea029afe2819ee7a4965f11880f0e72b3e5f46925d3c892118c8639cb472ffe6a4e52c4983d9be7b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903049, "uuid": "2b0e5d2c-c4e6-4844-90e4-2f946442d874", "value": "T111339D409B5453F5CE47C7F00FFE314C26645B928D2EBA5EA3C5B70DA802DBB86025E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903049, "uuid": "9a1ada6d-a618-45e2-8180-719a484a761e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903049, "uuid": "fe5c445d-91f9-4020-8efc-7a3236605851", "value": "768:C0Nqv45uD65R4UDiFHUBdxcyy3F837x//RtlgGEuneL/WKdkzBXKMbjTq3jCVu:FItYxcX1IxPlWueIXY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903049, "uuid": "b232d325-18f1-490d-bcc0-12753d7c38ce", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903049, "uuid": "394cdf2c-9032-454d-bf41-b8837d25b035", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903049, "uuid": "22bdc610-12f9-4041-9328-76fe6d63dc29", "value": "15613d4d6864d22409277e56eff01c2b04e83562dd70f3fee12c675621a5971c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803288e8-2116-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632914106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914106, "uuid": "26875f6b-0ae1-4d3a-abad-503a339c123d", "comment": "Malware payload (SilentBuilder)", "value": "f9483ef292a093afcf414b7bc7ebb098", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914106, "uuid": "8dc914c3-c804-45bd-82e0-1895fec7123d", "comment": "Malware payload (SilentBuilder)", "value": "15f80924428294550137efe87828bdf5d40c847ed91cabb3d90ff0e414351f15", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914106, "uuid": "7256c5dc-ab7b-4d7b-a826-95a73e74d04f", "comment": "Malware payload (SilentBuilder)", "value": "7cd3928a37c1edc48f1ebcb5d2d8e6c850d47329", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914106, "uuid": "33e5d72b-4a22-45a0-8276-9d05f7082651", "comment": "Malware payload (SilentBuilder)", "value": "bb04af44b10bcb796fc1e3cdb03899d36a0cbbfe3e67e1eb44b4ce89ffbde0f04f8fe209350aeabd0423b8bfc908029a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914106, "uuid": "8ce61e41-d50a-4de8-9b54-d055b79b4263", "value": "T10B34E14AF175C809EE5A473B4CCB0F9B1276DC238FAF0657B287B511ADB4DB8160A14B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914106, "uuid": "b5390c86-44d1-49cd-9ee4-fce0ea7d3ddc", "value": "6144:CKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgI9jWXcZZRBTq1BOzTwvOsPDslAvS32vI7+:M9jVzTmszTwvTDy33LvfP1OWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632914106, "uuid": "193f8338-fe3b-4a75-ac22-c67f8f15f0a8", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632914106, "uuid": "17b32c6c-08a0-467d-9225-97402751f3eb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914106, "uuid": "cba10551-d0f1-462a-961f-53035373360b", "value": "waffu2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0470d593-212f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632924636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924636, "uuid": "61899685-51d1-46bc-9592-39cfd80eaffc", "comment": "Malware payload (AgentTesla)", "value": "fc695c6aef404d7c5fe953711149b35e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924636, "uuid": "217a0466-82c2-4849-9e00-91f60b5cecf4", "comment": "Malware payload (AgentTesla)", "value": "16a3d787612d733a7a93adf135722e3e1164eeb8f8a9c5f800e872540331fe5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924636, "uuid": "e832d656-f78a-4b44-8654-06cfeeeb721f", "comment": "Malware payload (AgentTesla)", "value": "778961be82559d60d2e76aa51b45f2f0f9226d63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924636, "uuid": "a8c61598-9467-4d99-b0d4-0b111a37f210", "comment": "Malware payload (AgentTesla)", "value": "6205265e9302d1d4d8628f9601065cd1062b4446b26069185535edb7af1187a7081961f412a1cd12aaa6bdd8ad11e484", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924636, "uuid": "216034dd-48ac-4726-bfcc-a1fec11d1ce0", "value": "T1A3158D2AB60CD65AFD1433F02524BCC411B81C981C6CBA17B97672EAB4B9E27DCF505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924636, "uuid": "3d3176f2-b9c7-4d35-b3d8-c015e3f36475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924636, "uuid": "041b70f9-124c-4e2e-baf2-fd919a7f3dfc", "value": "24576:qD4VHfQe6ZyWshg+qbZxTZZWunAWvN3M3dyhRhoYyW4rkOEcrNEzeE/aLJ:mR40LhobWahECDLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632924636, "uuid": "d26b798b-ff64-494a-b7a9-4a3c0618d8e6", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632924636, "uuid": "1f2ee283-8aad-4772-bf8b-b873f4ab48c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924636, "uuid": "0632a65e-308b-4cee-bae1-578704cf6c80", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc8bfcc-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901135, "uuid": "95549f56-9da0-4eff-ba45-e4b9053b4f66", "comment": "Malware payload (Dridex)", "value": "e8eb80fa613f575828c5deea5ac5ea0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901135, "uuid": "55acda95-9d4a-464d-b64b-eb53c2771f16", "comment": "Malware payload (Dridex)", "value": "17611bb8fe864472b2d2ee583171e62152b204d609f4541ce2062f8808abd59e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901135, "uuid": "00b26e95-a877-4be4-a580-7cddeb516746", "comment": "Malware payload (Dridex)", "value": "9c508f311940459c4b2f90585bc984468594e461", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901135, "uuid": "5d2b751c-f008-431e-ab84-b1266537cdf2", "comment": "Malware payload (Dridex)", "value": "ebf75254c32c52e3d8d0009f4f7020c9bc1818e3d4b8f8dc4555d0f994d1bf0543019eda30f3ae657754e3dea759af45", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901135, "uuid": "cca3d14f-dab4-4b08-bf57-61d9d3337e1a", "value": "T15B85D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901135, "uuid": "e4e11641-23bf-40ac-8d38-838808a9703c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901135, "uuid": "488f68a4-af87-4179-9fbc-a4982e040af2", "value": "12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901135, "uuid": "a83e52ac-78a3-41c7-bb14-54cafcd6b561", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901135, "uuid": "878a5cd3-9c85-42af-bb12-131d2bee7574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901135, "uuid": "f091079d-7747-4607-ad18-9debee44f95e", "value": "17611bb8fe864472b2d2ee583171e62152b204d609f4541ce2062f8808abd59e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba12b455-2158-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632942550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942550, "uuid": "cea9145b-ee7e-44d7-9a13-556e60234870", "comment": "Malware payload (Mirai)", "value": "2894c2910a25707e1e15db15bcbb4e16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942550, "uuid": "5742bdc1-1764-447d-8f7a-ce107f6d7fef", "comment": "Malware payload (Mirai)", "value": "17b5c8d9d270bdce0a7a28bd016da2cff6c36ced431ac7e25e9731d463b68900", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942550, "uuid": "685c6b44-b074-46d2-8669-8b281e13fb17", "comment": "Malware payload (Mirai)", "value": "d3e367f79a45a36dfaa313fa6445a80dbd5ee059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942550, "uuid": "bd77b563-668b-40ae-81ae-be077241fb8e", "comment": "Malware payload (Mirai)", "value": "56ab63408f9bd0a43b14c6366b9a48d10cd1d4789da461bcc7d289e8d840110cbdd910e9107b45e98837c24b9a11c6cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942550, "uuid": "e2ac3395-a50e-4faf-a642-eede90611b50", "value": "T1BEE2D0E197676CB2CAF18C33CD6848C6716D62BCE27D72621944072C7AD754325EE2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942550, "uuid": "36b9f433-f82b-4fe0-9368-952234479aa6", "value": "768:jzmPOPTv9qq2iuW6eA/ydTc8RRC3hI3Dd2/f9zZ6f/FNMCU9q3UELj4:jzm6tnuD/CQ9R99W/FJLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632942550, "uuid": "cbbf095b-07e0-4d79-82ce-5296355bfcbb", "value": 32476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632942550, "uuid": "6ee92155-1050-4a0b-b816-73f59dc43fcd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942550, "uuid": "3258faef-1a77-4a62-9bb0-5b89be4091e6", "value": "2894c2910a25707e1e15db15bcbb4e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0a9367-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632896486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896486, "uuid": "06f56f0b-543d-4ab4-8599-98aeac96d238", "comment": "Malware payload", "value": "0db2303ef0a9ab47904af9452ba94b97", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896486, "uuid": "67fa63d3-1a8d-4010-8ea1-94a0600b04f0", "comment": "Malware payload", "value": "17c7f1d237428a731bc019331c1144b97ee2cb3f6e9300787e18f3c47c5f58b8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896486, "uuid": "26fd340d-67c4-4c91-852d-e181a0635e12", "comment": "Malware payload", "value": "58a503db15a1148abfe3fa89b826a61e653a62d3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896486, "uuid": "f8d9f794-956e-4b30-9c01-863a84565c0c", "comment": "Malware payload", "value": "5b71b7be7e986772baa13119c4c12e1db31be9e218e0968ac0f380da8544fcf79dd1b0c049cc5e6f28de25e6d3944258", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896486, "uuid": "42f4d2a4-04ab-4c70-8914-94d643038616", "value": "T197C57C22B2C18837C0776E3CDD5B6359A92A7E502E38884B7BE45D4C5F397813A2D397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896486, "uuid": "f0902af8-2fdb-4ba6-932e-aabd4078ecd3", "value": "49152:JnMg1BGuWF238ididxSlkknlRTP/6SOYLOA:yg1BG1FkniLSlkAlNSSOYaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896486, "uuid": "70dc4bfe-7f6a-4242-a9fa-f007c371acb8", "value": 2622976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896486, "uuid": "07e7b9e1-5248-4482-ab22-d31de28f72ea", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896486, "uuid": "c61785e2-7be9-4f97-babb-ff9f68f9968f", "value": "olswrmgmbpbvqkifnlblmbyrlvrccbsqxbvbln.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03315c95-214e-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1632937948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937948, "uuid": "27cec627-b643-4b54-aca6-8f34201f920c", "comment": "Malware payload (Quakbot)", "value": "476c4017f41ae509ce1014c1c901bdbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937948, "uuid": "c46aece1-f39b-40c9-9a9a-db5b9ae17dd5", "comment": "Malware payload (Quakbot)", "value": "18031a450fceb7fc4d66d734460db85af52b5a195c2338cf5aebe3aa4f11e9c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937948, "uuid": "3c98d29e-3703-4b21-ae68-247386590378", "comment": "Malware payload (Quakbot)", "value": "d4fdb5d39624de63c7918cb85fd95d303b24254c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937948, "uuid": "b0bb79b5-ff73-4e68-9568-a8aa630bc219", "comment": "Malware payload (Quakbot)", "value": "20af2794dec8cdc109b95e2febba41e238999667520bf1906a132d3c019f175f68cc5856e1baea351066e69bc560f34e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937948, "uuid": "96860a79-2868-4bb5-b51b-71b4bdc3a9b5", "value": "T1C2F47C403A55E521E6BC1A328F2AD5E807187D089FB5B4DF79E03F1F2AB98D3C621316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937948, "uuid": "64129e9f-142e-48db-a674-e70d99786a58", "value": "50abbd9e7be34717c881202779a30647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937948, "uuid": "6a005b0d-f371-4c02-a4bc-5304d2707c1a", "value": "12288:tebAcis08s7gQFMWC24/MFS+AWmdnWJIjJ5F3+DpEFs3H6v/+ZoTN:tMDis0dFA24/MFSptIJKnx+NE23a3+ZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632937948, "uuid": "6bd6f73b-b3f7-4a94-83cf-67f148095232", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632937948, "uuid": "0741e37c-96ba-485f-81a1-8aea9d153255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937948, "uuid": "f89b41cf-329c-46f0-accd-7ffb0b0b9cb4", "value": "476c4017f41ae509ce1014c1c901bdbf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74615ae-20ef-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1632897421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897421, "uuid": "cae80236-6e4c-4395-a147-10aff79231c4", "comment": "Malware payload (NanoCore)", "value": "1479371ef0752f027661fc1b7748b318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897421, "uuid": "b3f0a9e6-e326-4c1a-b2e0-faddc11a1d76", "comment": "Malware payload (NanoCore)", "value": "183923330057af95cedb73d0aa2e7f844dba89df8866995f483be4c5780298b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897421, "uuid": "ac53d731-218e-4e83-95e9-2ab1423ed873", "comment": "Malware payload (NanoCore)", "value": "3bf6809d0987cd82ec328b7bbdbcc5618743cf38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897421, "uuid": "72c7cae2-8177-40cb-9a86-3486431029c4", "comment": "Malware payload (NanoCore)", "value": "7f411ac7f36daf3a4a094bfd41d498b7087499f182489618d76bc457b6d0459874cdfefa10bc1e34f99d033e0aa687ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897421, "uuid": "2120ef5c-2c08-42b9-8291-6294f8c018a3", "value": "T1D414D0267BA84A2FE2DE85BD612202078378C2E3D8C3F3DE18D455B65F667E546071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897421, "uuid": "2a8317ac-e38c-4a23-b71f-1a3c503741f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897421, "uuid": "627d5b9b-0e96-443e-8852-cec9d0dbefae", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIi1fO32vT/T6BQ1bxjOhdiinvX:gLV6Bta6dtJmakIM5xfO32vTj19B+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897421, "uuid": "fcf225d9-9721-41b8-b241-444698df4d36", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897421, "uuid": "5472fae0-cee9-4539-b4fc-23aa3bf5685a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897421, "uuid": "5b0780c4-9d27-4dbb-8e25-fd4f6be0255c", "value": "manager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f0d329-2180-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632959589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632959589, "uuid": "7b09be4c-26b8-4927-b253-527a4889eb60", "comment": "Malware payload", "value": "5d2299e7987f32888d1cd0a55960c742", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632959589, "uuid": "02abfaff-37d2-49d7-aff5-85c2925e1fc6", "comment": "Malware payload", "value": "18aba28b62032cc4091fe703573436b3043245bb5659f4f1a69927fcb2a1dc0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632959589, "uuid": "cfe4a743-9964-406b-a9a6-580da2408885", "comment": "Malware payload", "value": "72dd20a87098f717e53c019cd1acd90a569f4350", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632959589, "uuid": "09e54137-cbdb-4090-8496-4709145cd6e2", "comment": "Malware payload", "value": "00751b7dcb30971007a3c23ee35ece76d6445711caed78a54eef9cec911515528362ff011d668e642cd485d2634ea5b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632959589, "uuid": "7081525c-c704-4aa5-ad82-58ec23086f23", "value": "T15D64234A3401F8ABD460A4758A7AA27EF37FC7CD148255438BD36B7DAC2309A490B7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632959589, "uuid": "3f7bef76-b0d1-42bf-abd4-8037be4b69b7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632959589, "uuid": "d8cc03cc-9e64-4180-8444-d1b47f850383", "value": "6144:F8LxBsWFbSa1ZB1yrjs1SJpU+CImxoWZDVPFoLV6rHen/VuJXav:/WlzD6I12pQImhqLV2qVuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632959589, "uuid": "fbd46d3a-127d-4452-82b2-9ba8b0640b8f", "value": 311105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632959589, "uuid": "be840ae9-3bcb-4771-9914-8cda5b944011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632959589, "uuid": "35be5f26-e0ff-4a3a-b544-b65b3b741f28", "value": "CMR-216489_PDF.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41a21cd-213c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632930568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930568, "uuid": "0a4fbf6a-efbb-4397-8862-aeff9efcbae6", "comment": "Malware payload (Dridex)", "value": "b3941573c6d1965c44e94f5f7feba29f", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930568, "uuid": "a15c59cf-296e-461a-95da-97b06f792741", "comment": "Malware payload (Dridex)", "value": "19cbabae648cfba0c00da360fbbd3bd9e5e94833cfe96d9eae8ba8f664097da1", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930568, "uuid": "8e8c6def-c24b-498c-9a8e-0fdfe56895f9", "comment": "Malware payload (Dridex)", "value": "0563f6719fb3d2707a7592d1705e06fc9085a2d2", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930568, "uuid": "2be1b837-acb3-4918-861a-83c1cfeaa0a6", "comment": "Malware payload (Dridex)", "value": "e959213aa1389c439819009fb1c3a19abf578def9a9fc523681a78e740acb04b9ddd8c0ecc04b4dc685ed9fd61667a84", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930568, "uuid": "c9e3e7d5-1862-4464-871d-511c904db92a", "value": "T14F2401638864F269E41809FF4FF81F711F8B45B6A441CFE306BBD46A5E9C4922E824DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930568, "uuid": "d1c3710c-7aaf-4604-b17e-937e2bf3baec", "value": "6144:oT6tfQlULkwcT9EBH0+mqjkSX5dhl3nOO:Ntol9L9eUiXxNOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632930568, "uuid": "fd4e21f5-bbcc-4bcd-bf2c-9b0297f8c3a6", "value": 214966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632930568, "uuid": "7e1d6c11-534f-4a51-ac88-f73b779f0610", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930568, "uuid": "e59018d9-e426-4c1e-81b9-da2a75d4da3a", "value": "Invoice.-Baileysbizbuilder11137_20210929.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b708a13-214b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632936781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936781, "uuid": "1ced1632-1317-4a5f-9ad6-f055bcf04f1a", "comment": "Malware payload (Gafgyt)", "value": "668252f1a28edabce91e7141ad41aa84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936781, "uuid": "5de458fa-262e-4cde-bc6a-beec6ee7e348", "comment": "Malware payload (Gafgyt)", "value": "19cd3436e988837dc102e1b70597a00fad7f07f149f3e3f32f6bd88eb7df9e42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936781, "uuid": "34bcf214-ccd8-48e0-a7a2-d54911dd95a3", "comment": "Malware payload (Gafgyt)", "value": "c329f0965188abc3fc8e92000fa8ea008f0f3d22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936781, "uuid": "2289f4a5-7307-46c3-b79c-3619c1dbeb8f", "comment": "Malware payload (Gafgyt)", "value": "e9e927cbe7d9de9ae58d2b5d5176a6ba825396c3d9b265d172a034e901f266188b64e92a9d6831423753eca3b79df3e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936781, "uuid": "8d187711-143d-4deb-9ddb-9b693c1c9271", "value": "T16EE3195BAA1C0783C49B56F13E6B27F08B5CFAF111D252C5A90AFEC01733AB52126F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936781, "uuid": "f38a513a-9b38-4bcd-a5da-449e39c0c34c", "value": "3072:wIiNB8Z6zklwlfKT5hUzpeL7IqsaLohmnrVybfdZrriq:wIiNBE6zdlfg5hUUfH8hmnrVybfdZrrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632936781, "uuid": "e2338667-473b-4130-a2d4-ccbfc7b5640a", "value": 148596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632936781, "uuid": "7d6f6a3c-f213-43c1-8339-a5403e9cf076", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936781, "uuid": "8ea26109-4b1c-460e-96ca-06340b89dbbc", "value": "668252f1a28edabce91e7141ad41aa84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c621039-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901107, "uuid": "d7e44c7b-494d-468b-b4b4-33f3fe6dd1c4", "comment": "Malware payload (Dridex)", "value": "ea2b15bb2830c4d76a0b9105d6881406", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901107, "uuid": "25ae48c7-25db-490b-b5db-f87b97bf2932", "comment": "Malware payload (Dridex)", "value": "1a18d1e1ba40b4a3508ab6f25500739e72a718ffcec1fdf7ad536e55c45d151c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901107, "uuid": "1dc51ad0-685c-4c25-be29-f1ce72b9823b", "comment": "Malware payload (Dridex)", "value": "b16ae6be484331b8bf095e46bb88a7314c6b5a8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901107, "uuid": "bdd1e091-5b69-42bb-be34-b36a679863f6", "comment": "Malware payload (Dridex)", "value": "e3cdf272616e4ef46951574679978b523ef55467c97bcaa07697201e725d175f5e660df802252ee39b6713086da6fadb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901107, "uuid": "8e8dcc43-8986-445a-b0f5-30b89ef0a3a9", "value": "T12795E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901107, "uuid": "910e9951-a6c0-4b12-90b3-5a21831912c5", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901107, "uuid": "72abe936-5c35-4275-8934-86de90d4e400", "value": "12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901107, "uuid": "da50b56a-1637-4c16-b507-48682a532d1d", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901107, "uuid": "24e44774-6989-47f6-8c9c-9a9a793bdfc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901107, "uuid": "534026c7-5aef-4123-bc1d-39889f2a4e6a", "value": "1a18d1e1ba40b4a3508ab6f25500739e72a718ffcec1fdf7ad536e55c45d151c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19770cda-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901049, "uuid": "2903cb49-4660-45d0-aaa2-1fd4cf6d18cf", "comment": "Malware payload (Dridex)", "value": "3147b5cae0cf587d544c6a1f85ac3b9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901049, "uuid": "6949bce4-5982-4737-b260-cf20a7217e72", "comment": "Malware payload (Dridex)", "value": "1b1b7330659853bc3b6b70d6360ff87861b27bf456ae8f1960797abc32392e08", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901049, "uuid": "6c441f5e-2ecd-4b40-99fb-dc23de4f34ab", "comment": "Malware payload (Dridex)", "value": "97fb2d797871ff7bb01e2c89d56a7b57f081cc4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901049, "uuid": "d7948245-c447-44e6-8fbf-ea19fce36b69", "comment": "Malware payload (Dridex)", "value": "36828abb2c8b3d650bcffce7a652e49f36f48012b79a3d3e74846029d92a9da6466d1861bc964ca88f885bfe0d03bf14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901049, "uuid": "065efcd5-da12-41bd-8f6e-98dcc4b281b9", "value": "T18995E020EF69E1E6C6B89F3E9408352727B93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901049, "uuid": "50a113ef-1af3-429f-9df5-d82011dbc9cc", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901049, "uuid": "ab4cc1e6-8748-4a6b-8051-314309e93baa", "value": "12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901049, "uuid": "83f8d9d8-ce73-4d56-8f20-62b4c31d3b9f", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901049, "uuid": "e6e43d12-e5e3-4e60-8c8f-4d751b51b0d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901049, "uuid": "342c35fa-c7d8-4a1e-82e8-78c227569cf7", "value": "1b1b7330659853bc3b6b70d6360ff87861b27bf456ae8f1960797abc32392e08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed1460c-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632908816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908816, "uuid": "0ea4d9c5-1f07-4500-9e25-3d3bad11df00", "comment": "Malware payload (AgentTesla)", "value": "e6fc2e55bbc8bc295bbe4a6f2d4ae919", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908816, "uuid": "72550ea6-ff9d-4eaf-9e6e-00f018a52ec2", "comment": "Malware payload (AgentTesla)", "value": "1b495eccb1dd110b035b72e2d4445820c9a5f445620394f606ae72e621a9b547", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908816, "uuid": "3fdcb4fe-4144-47d8-9ae6-238211a64b7f", "comment": "Malware payload (AgentTesla)", "value": "96b9914494ec7a1894aa9803e1793e5f4537e52c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908816, "uuid": "dc380496-f7f9-4132-8a28-0964a2aefc96", "comment": "Malware payload (AgentTesla)", "value": "5c5d54019a2699c182592db92a05641e4c5e5b0d16a18cc2ce6139a5f5cd0995e71d0947e7f912fc42666f089b6542cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908816, "uuid": "e16c43de-f2ee-4ad9-a3ec-883f084cef07", "value": "T108D3280277846B41C42419B0C5E7673403F3EBCB76B2D2893E4546DA1E42BEA9D9AFCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908816, "uuid": "206081c1-fada-4f42-8f4a-f15a949bc543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908816, "uuid": "de039335-7c4d-4361-9632-269dbacac29e", "value": "3072:R6ehvcaRRqWidIdRVMsw9h7S0h0CTXYmvFMQ4b1LfB:RfJQ9dIdFwb7S0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908816, "uuid": "8dcce8fa-d1aa-43ee-88f2-66870e075ea0", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908816, "uuid": "4a75062f-9b61-4337-9090-ec38357a3135", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908816, "uuid": "8aa1365a-5d04-469e-bbf7-c3be61e8b7ea", "value": "TNT Original Invoice_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df843a38-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898375, "uuid": "a0e40cf1-8c14-4070-a4bc-6392361300fa", "comment": "Malware payload (Dridex)", "value": "4949a07d43d53d50ce8dd528b74e9034", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898375, "uuid": "0b9cda9d-0cb7-43fb-aa25-df19c676feeb", "comment": "Malware payload (Dridex)", "value": "1c3d687eb0edfcf65dfd645952d5c24b955ced9ba675719968f89300a94a1db8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898375, "uuid": "66086511-e6d2-4467-9920-3f2a7cb0bc35", "comment": "Malware payload (Dridex)", "value": "d7a7770ad2985bcaccfdaee825eb53f3b6c3e8c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898375, "uuid": "4b13e8c3-07c4-410c-8cca-692a9621a276", "comment": "Malware payload (Dridex)", "value": "812b6adb75f200aef5989ac2d93d250679495b152b4096220a7b08ae0a86fc9c13d786d75ce534cec63e24257998ef98", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898375, "uuid": "069bd9e3-e1fa-4e8e-8018-b40f2fa0b951", "value": "T11616D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898375, "uuid": "6043cd10-48a9-4865-82d5-901e361507ab", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898375, "uuid": "6159295b-389a-438d-b9b1-a46f5c0c9529", "value": "12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898375, "uuid": "99c26fc5-179c-4f5e-8095-0a4f8596d777", "value": 4272128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898375, "uuid": "8973889f-9a3b-4df1-b7df-07ee168c631d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898375, "uuid": "6b74030c-a1b2-48ab-aee1-1a4b385b47e7", "value": "1c3d687eb0edfcf65dfd645952d5c24b955ced9ba675719968f89300a94a1db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62141cb-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632898735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898735, "uuid": "ee8c99e5-5cae-449d-8b19-a40188528aa6", "comment": "Malware payload (RaccoonStealer)", "value": "5726c43be81adf7494d6b9e8076457e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898735, "uuid": "6b4557b3-cecc-4ad5-a107-e1846898a37f", "comment": "Malware payload (RaccoonStealer)", "value": "1c4e0cc22ba2a053f988ea652fed2b0332ad8bddd082b42e6415631edd624b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898735, "uuid": "e806588c-7fb5-47e6-be85-4285cdc6ad98", "comment": "Malware payload (RaccoonStealer)", "value": "7a3995922bae789f8f165b12d56b3e8ef79fe24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898735, "uuid": "fba13a51-2c1c-4517-a709-be117d964f13", "comment": "Malware payload (RaccoonStealer)", "value": "bb5653fcf6c9f03c2bab3aacfab9e59222b8c8063c34cee405c6ca4ede0963de164dd7d348ae8a905ac2921884df0ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898735, "uuid": "66afbe2c-1c56-4ea5-832b-d77c08b27935", "value": "T112930B10B7859B53D63C7CBA02533A0413F35AE63E26E2273F5E65E6A046EC75F0D18A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898735, "uuid": "66fdc9a8-32c3-4d03-924a-693b685ce8c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898735, "uuid": "40a943a4-3fd2-4816-a000-3ba13b742b3c", "value": "1536:0CmImbfhgB6dCvz6r5pmwqf7Yh0Fy6XuWtN+70pKXQlf+3D:Fe5pmd7NVfN+70pKXQlfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898735, "uuid": "bff07f0c-ee5f-47b7-aa95-fe8b999fa59b", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898735, "uuid": "b52932a6-70c7-4b94-974c-dd2b6a2bba40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898735, "uuid": "ef31d165-10a6-46fb-b1bd-2040ae3c0598", "value": "SKM_C258.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cbc428-20ef-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632897441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897441, "uuid": "af500e27-33c1-45eb-b9ed-d6f5913fd7fb", "comment": "Malware payload", "value": "906a3a0320713dffdb7bc82570cc3993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897441, "uuid": "e4a40b8c-8d2d-42d7-a814-977c0b1d8a3b", "comment": "Malware payload", "value": "1d1ed127b14af6314cfc946977342e0a33d704a721c052fdfed973c7dd44c198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897441, "uuid": "d553aaef-0c54-42ed-82c1-dfadb1faf7e0", "comment": "Malware payload", "value": "bd1ab288d20bde3ef345dcf0b6c62608a87dfafb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897441, "uuid": "71797c99-ad58-4b64-b578-759a6f3e259d", "comment": "Malware payload", "value": "421e00064ca8481f275f3980fd5ff30ffd021a324d0371455d1a6f9748694d0a275456250d6855005605e5b2c784f179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897441, "uuid": "ccbc5e1d-b956-4370-9c5b-6e9c5a3068b5", "value": "T12F863AC24ADAA84AFD1152B3602A6738CAC6EDB17A1DCDF330EDBF158F279055553283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897441, "uuid": "4e07574f-545f-4361-86df-4662db9a222f", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897441, "uuid": "46d3f596-039a-4fc8-a786-e5c1bdbc7930", "value": "49152:ce5e7dKjD5e7dKjD5e7dKjD5e7dKjD5e7dKjD5e7dKjD5e7dKjD5e7dKjD5e7dKh:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897441, "uuid": "41fc5cb6-ec9a-4a31-a8f9-b539e9898b28", "value": 7856488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897441, "uuid": "985bb3b0-1c6a-4f27-b8f9-61ca77f88aa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897441, "uuid": "71ccc682-c527-4023-9db2-600d1ff26898", "value": "1d1ed127b14af6314cfc946977342e0a33d704a721c052fdfed973c7dd44c198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8898eeed-20d3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632885344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885344, "uuid": "b9479591-982f-4820-b2dd-fda3aa342f52", "comment": "Malware payload (ArkeiStealer)", "value": "82de6228af53e0bcd76c186c6899933e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885344, "uuid": "e2392554-01ce-4937-862d-aaea0323e3f4", "comment": "Malware payload (ArkeiStealer)", "value": "1ded793046759d0c4848c5cd03ebc7f4200a113fd09a73453809edf19064a05c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885344, "uuid": "01ec352a-fa31-4d7c-a3f1-be926740a3e6", "comment": "Malware payload (ArkeiStealer)", "value": "b302a151e58e65ecc578563612601ccf63c1fc7d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885344, "uuid": "eef2fd35-8e81-4c9e-a2ec-6f88f21375ed", "comment": "Malware payload (ArkeiStealer)", "value": "378ef0bf40e1744085f4285ca71b2f80d86482e93359f1c9db823d5723ad92cca001e5dc33376bb39ea74f8de172b37c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885344, "uuid": "7a87e918-5f01-4f57-a2f0-53949fe20ada", "value": "T1B5D41211B640C7B1CB4605FEA920C7DCA86CBE4CEFA966772A1417DF6F683A33611364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885344, "uuid": "9570dabc-b5bb-4341-8d57-3fbce08f6bfa", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885344, "uuid": "d2916b06-ea34-4b16-a982-cba5c924c8b4", "value": "12288:CMnPDYGxf2cYbFDznGdcFqBfLVpYfIC5SVKaaAPCI1xtzC:jbRxfw1zGdcFIzYfNlajPCI1xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885344, "uuid": "df432369-383d-4f64-8c74-e74a32e690f5", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885344, "uuid": "3f2117e1-5ae5-43e6-9110-63f53a1cdbbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885344, "uuid": "708adc18-3d63-45d8-a201-5e9c1dd5c923", "value": "82de6228af53e0bcd76c186c6899933e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ceccd66-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632909242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909242, "uuid": "9cd25be0-a776-480d-ab37-4cab749bcac0", "comment": "Malware payload (RedLineStealer)", "value": "b28048c71b720d86e68c22e46ba7a0dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909242, "uuid": "83322cac-08a3-4ef9-b53d-832bf8a6c2b8", "comment": "Malware payload (RedLineStealer)", "value": "1e4d22b644db33118955f64d7dc91e61696dbdff24760fda12c33c3289e2215a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909242, "uuid": "a9097073-2870-4d37-85ed-988a928e5d63", "comment": "Malware payload (RedLineStealer)", "value": "bd1fd7532175d65b7ef4ce1692f99b9ef6143af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909242, "uuid": "f92c7d2c-16c1-4bd6-a317-d224b155da07", "comment": "Malware payload (RedLineStealer)", "value": "76da0c3e503686508b0e773cc6c372846d2f0b7762b479ab74fdba5964cce13e770283ea5052eb1f36184dc719f57840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909242, "uuid": "a717491a-4107-494d-bd14-5c72fe7e0c51", "value": "T1B5C41230F521E3B2C342007E7455C6DCE42DB99DFBE1627A67583ACEAEA91A37621305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909242, "uuid": "a6f32439-24d0-4a6e-9fa7-4feaeeeadb39", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909242, "uuid": "336fa5e1-1970-434d-9b11-71f8c265629c", "value": "12288:Q2wrl5RdT5FSCoiD5cJ9ao9PtX6c9SF3UNrnUSI1w5RE:Qpb2Coei9793vI1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909242, "uuid": "aa0b6060-40c3-4aef-a82b-c1ad3d2bf838", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909242, "uuid": "08ea4415-e05e-4a54-b9f2-a43ae976c594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909242, "uuid": "b8b042d0-271a-44ba-8644-43741e7cd091", "value": "b28048c71b720d86e68c22e46ba7a0dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a968f23a-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632898284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898284, "uuid": "9d6042bf-6500-45f3-8177-c6687a8ecfca", "comment": "Malware payload (Formbook)", "value": "a69bacf1fa776bc8bfcfe62999f5c700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898284, "uuid": "f8d07f86-0ea5-46de-9462-d11d0cebba75", "comment": "Malware payload (Formbook)", "value": "1f472784494710200607f381849c6e3ea4f09f2ded2e84a1734ab5fdbd25d1de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898284, "uuid": "b7e6f55a-3686-46f2-920a-7b0c1acbdc67", "comment": "Malware payload (Formbook)", "value": "4dc2abb022bd156d564a0221272cb3d8435b188a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898284, "uuid": "57da8fde-612e-4db4-af31-e7930195625e", "comment": "Malware payload (Formbook)", "value": "60bc7a6fb22f2543959a682b272fa04d37dc72c24871f5dd652638b96f9d80fc266d9f019d96121557825b3d360c5a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898284, "uuid": "b1de7041-7c0b-460c-8377-2f2e6af7bf8b", "value": "T10C15AE26D9C18AF1C02317BA0D2BF2DED6217D432A35BC5DAD8C74861E31BE0A67549F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898284, "uuid": "7f6fb082-4049-4f03-9c21-c3cf77b6d352", "value": "a06c5c2e0daa5e1be041ec367fa8affd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898284, "uuid": "eb83b43f-f993-44c7-ad17-e735704cd085", "value": "12288:L7SPlQKaPIvX9zqhD6yneh8RQZW540vd3z+Hx8lO2fTVqyvLRxaFZoZ:L7glyIvX9zqB6VhoMgaHxA7VhLRYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898284, "uuid": "c5d29e2c-7fc4-49eb-bab5-371795c83833", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898284, "uuid": "f5d2752c-37f5-4107-85b8-4a259d56d103", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898284, "uuid": "c97905ff-146b-41cf-a1f7-fb99f81a331e", "value": "Lista comenzilor atasate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f46936-20e3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632892054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892054, "uuid": "7ab4aa2b-bd65-4212-b390-a8b5908d0f06", "comment": "Malware payload", "value": "c9972e010fa6ea08e418437b3565cd04", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892054, "uuid": "60ee6eca-6676-4070-9c82-3499e55b53c2", "comment": "Malware payload", "value": "1f50c16a14f5e29d857b6ec6570558423ae29da7c625ef4fea08c02d92991196", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892054, "uuid": "3c10dc3c-f96d-4413-9b1d-8b9d6ae3d9b4", "comment": "Malware payload", "value": "aa1041a37fe73d11bd32e9b69c81f5c143638b87", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892054, "uuid": "dd5ce866-6935-4d0d-9709-f07aeb3f3656", "comment": "Malware payload", "value": "86305fa7ea50d1feac68d8362cdaf6efbe28ee41feb0d51f565ca344e693e97bd6b909ce1bc1c1e95d4a330c327d5ced", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892054, "uuid": "92a43576-5fcd-47a5-bd64-30b32bd0c3e8", "value": "T130266CF8AC31D6997895B59BE9D0B84540C37CFCB5AB8F440414BB3A38E74849B989CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892054, "uuid": "c311a4f6-6b1c-4a27-8ed5-039aa9169807", "value": "1536:sKQ24mDz0U2cblqP3NUUSlMTs9MpTsBFRMigqJbta5E/zu+RDlxibhjmeIazQVgF:sK16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632892054, "uuid": "56e935ee-f4c4-4080-b85e-8a02d6ad3be9", "value": 4423301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632892054, "uuid": "d341045f-a6c9-4645-a8ae-5350036721b6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892054, "uuid": "fda4b52e-69ff-4f8b-9c0a-ff4ee349857f", "value": "RFQ021836.rtf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ba0b33-2172-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632953461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953461, "uuid": "40983351-af51-4775-80ba-5ab1c8112deb", "comment": "Malware payload (RaccoonStealer)", "value": "6e93f6431b00352c8f2afe5070e5217b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953461, "uuid": "5a343ddc-14b2-4cb1-8e39-52cb523d3e54", "comment": "Malware payload (RaccoonStealer)", "value": "1f61adacae43d4fca998951524dfae94f8d7e32445095f3fb8d917697f399e7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953461, "uuid": "b60f5639-7628-4887-a723-8350193e9839", "comment": "Malware payload (RaccoonStealer)", "value": "0db355ca7d89a414f44787107693a6e9ed22cbcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953461, "uuid": "e06c1b85-0785-4fe0-86b1-712733fec519", "comment": "Malware payload (RaccoonStealer)", "value": "33781351f9cf780942e9f4a69e648ba6d949bd17a07d0c15e71c4d93b50f07acc150ffb2206dfaba2dc0577487762869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953461, "uuid": "be7fce7d-5535-4b9b-aac6-2895ad20bb29", "value": "T144650697E74F4A96C6AB8C30BEA02F10ADB7704E17829E511383927631F6BDC5E6C057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953461, "uuid": "5fba76cd-0801-4501-819b-5c1486bed680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953461, "uuid": "f86019e3-4e62-47a3-a772-8d47ea169367", "value": "24576:j9yStzEkEW2+gL9tTG4r2231883FZjyKWhuTfu:jc6ETLT7t318SF1yjhuTfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632953461, "uuid": "f3e7319b-a3f0-4b3e-bd09-55ef5001f2f4", "value": 1439744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632953461, "uuid": "6c5c6097-8406-423c-a68c-fdfe5dcf3806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953461, "uuid": "19504500-1ed6-4f2c-b2d0-d077bbaad508", "value": "6e93f6431b00352c8f2afe5070e5217b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e297bc8e-20cc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632882488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882488, "uuid": "e60106ce-bc05-4200-a645-3d1dc7fc17fc", "comment": "Malware payload (AgentTesla)", "value": "27ec1232be8eb879adf1f429c4263a65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882488, "uuid": "1b4fc779-775e-437e-babf-98580804a2eb", "comment": "Malware payload (AgentTesla)", "value": "202c6f6fd2f58d3dc61a78c578bccbfc2d33a16fbc63649f8b39d441a1514773", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882488, "uuid": "3d671292-d030-4f39-94e1-c2942484217a", "comment": "Malware payload (AgentTesla)", "value": "d6387ae7748030cc53bc4896a33912b9d23a2cd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882488, "uuid": "900a8827-8ae7-4589-a7ce-fbbebcdd0a76", "comment": "Malware payload (AgentTesla)", "value": "7e42bf95d43c424f01e85d5c15561e7c06c9a1c06f5e142c84451a71689721980eee5b19b3b3f2e6a07dc8d8889ecfae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882488, "uuid": "9a15be23-1272-4745-afcd-66e1d0d75f3e", "value": "T172159E2AB60CE65AFD1433F02524BCC411A81C981C6CF917B97676EAB4B9E27DCF405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882488, "uuid": "5f3a5fba-743a-46e2-b2dd-a87e2429e203", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882488, "uuid": "79dbcdbd-1803-4386-ab22-63fcb85079c4", "value": "24576:83M3ALopB19arDmO245D4VHfQe6ZyWshg+qbZxTZZWunAWv:I4frAX26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632882488, "uuid": "f97b972c-58da-43c5-b020-33c1f46c2db3", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632882488, "uuid": "910d2c92-2546-4e51-a56a-70ef1f01eb60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882488, "uuid": "8e329e33-e0c3-4786-87a9-07af8ea577f0", "value": "sales contract 500MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6282de-2140-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632932216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932216, "uuid": "5183e099-876c-4101-aa26-8a3839d78740", "comment": "Malware payload (AgentTesla)", "value": "31c0f074ede836c3b44611a86019ca57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932216, "uuid": "64614c1b-d90b-4fe6-91d5-c0dfd778ab33", "comment": "Malware payload (AgentTesla)", "value": "20adf7af8aa2fe58f4f14c36565fda24e3f9eb6209a214536bf20c1956e6258a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932216, "uuid": "061a1cb0-fdfe-4b40-bb8b-6f16c2bce012", "comment": "Malware payload (AgentTesla)", "value": "080e9da9c90fc2540cc0f1e7837568d7fe6c61cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932216, "uuid": "1f64b842-7071-4667-bbd7-8e7fc147c980", "comment": "Malware payload (AgentTesla)", "value": "24720b985510d28225a70554044eaaaeb604e4160cf9fba2fb286934ea8dd9f310454db1d50dc26193e82d58ed8e9aa5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932216, "uuid": "c26660c3-9cae-46e6-a7c3-60c2ca442dbb", "value": "T1D5253C95F118C49EFC1B06F17D2A7C6020E56D9C58A8910F6A9AB79731F3B5220FED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932216, "uuid": "567b6645-988a-414b-9289-52f64b1af278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932216, "uuid": "82df5842-2e79-456c-86de-8c0f76a1c5c0", "value": "24576:ID4VHfQe6ZyWshg+qbZxTZZWunAWv1gUrBsDGb12aiYlWmHQlp/hBTn:AVgUNsm12aiGW3ltH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632932216, "uuid": "36c0816e-e274-440f-98e0-38019cee0a9c", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632932216, "uuid": "ca5e81ef-d240-46cf-b7a1-a2cc0e9e4ab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932216, "uuid": "bc645efe-20ea-467e-850a-1adedf41e898", "value": "Top Urgent RFQSeptember-04994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d0a35a-20d0-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1632883920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883920, "uuid": "1f4da277-772e-4bf0-adff-0788b2d8c6f1", "comment": "Malware payload (NanoCore)", "value": "8f570ea7e00014d04a8c9adfdb398e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883920, "uuid": "ab40a259-7e08-4a90-8172-851ce53e411a", "comment": "Malware payload (NanoCore)", "value": "213f1a7ffcddc77de699e71a3f9b82d2e3acef690205910340d1f8ddaa8122c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883920, "uuid": "1c24bef4-0377-428f-a0fe-521c04ad669d", "comment": "Malware payload (NanoCore)", "value": "2aeeb67b51af531a52b6508dbbf8d85924adea49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883920, "uuid": "2756a12a-9f96-4b98-b80f-e7a7f186f549", "comment": "Malware payload (NanoCore)", "value": "65365abea6f683eb01fdb0ba19fb5e1d4289feae9f089c10f2a3b3626aff1f0758acb7b434aa61c9226a281c754d7a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883920, "uuid": "35c0f965-a9fd-41e3-b838-a5c9e29f7ab2", "value": "T125457B2D3A0D1AB2FD9E9D30CD4A2A18BB664F0323E0AAD247EB15D7874F4F55D44B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883920, "uuid": "61a4b106-a243-455e-80ba-043ebe120072", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883920, "uuid": "d274ae8a-733b-4df8-a2f1-9bacd8aa477c", "value": "24576:blwPOr6WhlFW+kh7teoZjxYW41ur+YVarE8lNenv:Jw2WWhO+khXZjxYb1ihZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632883920, "uuid": "39dd6f5f-21d2-4788-8e80-2ba754e7462a", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632883920, "uuid": "1f129789-02e1-4f3f-bf82-c0ce0612141e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883920, "uuid": "9991e71e-cafb-4c65-8e6e-acb3290ddce9", "value": "PPT-0000084510027306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bec7f9-20d0-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632883839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883839, "uuid": "99f9894a-3b0c-42f9-843c-50513b9bf93a", "comment": "Malware payload (ArkeiStealer)", "value": "937049ce9c75cb262f5924fc1f19f260", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883839, "uuid": "fcbb77fc-2ae5-451d-afc2-7c21af9bcb30", "comment": "Malware payload (ArkeiStealer)", "value": "21b462c2cde024f0a0abb408979ccefa46a8281902871aef0762c5bf90d99731", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883839, "uuid": "c3a5a715-1782-45df-a566-f5a6debfce5e", "comment": "Malware payload (ArkeiStealer)", "value": "3e790861e29c0e8eb376a1fa7f5320fda4549927", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883839, "uuid": "e83c82b0-af61-4556-ab8e-d4bc81b25863", "comment": "Malware payload (ArkeiStealer)", "value": "9909846d75d509dba1968444ca5f421d79d0949a02693063581803ecce16e97369e67f96f27f71d3a7d478a03519f870", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883839, "uuid": "6fc330d3-18bc-405f-85f6-1ae3f980627b", "value": "T198E402107BE1C034E5B712F949B987BDA82DB9B1BB24E0CF12D456E99E346E0AD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883839, "uuid": "793c6ac3-9bc0-4f6f-ab9d-9b5bc7c6b518", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883839, "uuid": "59ff7c5b-edb8-4491-bdaa-be3d038f7222", "value": "12288:72d9kaeXRio9thtmhWd3BTyIHQQI2hD7hmtE4TPAO8a0IMQUeCzlWjixFs8:7I9kTR5NmqTWaDN8Lma0IURRb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632883839, "uuid": "b1e99e59-03dc-4c9e-8e68-b6956680a207", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632883839, "uuid": "55043e4a-970c-4282-b599-a39102610389", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883839, "uuid": "a8d02bcc-f22d-447c-8edc-f36393e11d7c", "value": "937049ce9c75cb262f5924fc1f19f260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f852563-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632899046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899046, "uuid": "2de6173a-d2f7-4e13-b8c2-93cd93e33d77", "comment": "Malware payload (RedLineStealer)", "value": "cb4a141ab78d100af03ba3ab789f6622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899046, "uuid": "348a7e77-d9a8-4d80-beef-68dbec7f09a4", "comment": "Malware payload (RedLineStealer)", "value": "224e32dcd36e8af7efcea6c931be7dfb41875897fb056d60b159f60eec4bac23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899046, "uuid": "889c577e-8af8-41ab-a091-effa0eb1e792", "comment": "Malware payload (RedLineStealer)", "value": "6fb443453a805eaaa3492eb9a2033895e3eda5c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899046, "uuid": "4c41271f-dca3-4a7a-8ee1-4558e91ea9cf", "comment": "Malware payload (RedLineStealer)", "value": "54fa17b069fc263af0f86d0516f7672ee2d5c25ca210af58f4c15fbfd4ffda6f8ec31d4c989a266936acbb778a047f96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899046, "uuid": "f3050fdf-f702-4a73-8c9e-7667c0c8df26", "value": "T1FCC52358B3EC8116F1F78E3465738B805EB1BE51AC76C689B706BA0E4E31918DF36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899046, "uuid": "02965353-485e-4be8-996b-bed300b75e1d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899046, "uuid": "e82bda5a-ab47-4315-9590-0ae830ead119", "value": "49152:iYE7ppIYtDOhQ4yXnuQRDo9ts1e1C/3HkP0W+jn9Hzd75AXsPkPlwO+HnRo:iYElSSDOC4clROSSO3Hk8LR5AsMlwDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899046, "uuid": "5607ca4c-f190-4fde-89e4-c2bfe6b842d7", "value": 2578432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899046, "uuid": "29788283-f0bf-4467-a1ae-94256b644f9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899046, "uuid": "74e68cc0-661d-4ed3-9532-638a476a6bfc", "value": "cb4a141ab78d100af03ba3ab789f6622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74542def-2125-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632920529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920529, "uuid": "a4ee20bd-f556-4f2f-980e-f108a0a8bcce", "comment": "Malware payload (AsyncRAT)", "value": "c0c5b9b23c4139b789de99bad4757ea2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920529, "uuid": "99911f2b-513b-4cf3-8fc8-2d168b1c0ca5", "comment": "Malware payload (AsyncRAT)", "value": "226c6d38218880b228a389384de02245656192ceb4a3b77695efaa198a873fed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920529, "uuid": "4f2341fa-25c4-40dd-8e88-b59cc1e532c2", "comment": "Malware payload (AsyncRAT)", "value": "c39afd83d49c5eb746cc1b586c6fd80eba93ba06", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920529, "uuid": "9c1b5931-2bd8-409c-8c42-48398b6d464f", "comment": "Malware payload (AsyncRAT)", "value": "f3a2494cc61c689167d9860db59ce82dad433c9da740249ff46bd1bf2663f0bfd4074c2c43e67fb1e9469d70e9a83dfb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920529, "uuid": "5dd26c0e-0cff-42b8-89e0-e91d7237ae09", "value": "T1DF014106E26DABFB1002B37B09D93880A439164703B4979E6630D11594B9AB484FC351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920529, "uuid": "c72aa593-d228-4be6-877c-df4709e80f66", "value": "24:/SW3mXcEEA2EUMg2l75nZcyme+tHmgStOH8oeMgiM:/SnMVBEUMpZcymeQHmdmeM3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632920529, "uuid": "f6333c53-2b61-4f6c-8b89-4a6f44768ed0", "value": 813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632920529, "uuid": "b0073631-9b6b-4bf9-af72-f1532b85c3e5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920529, "uuid": "35507535-7c1f-4c69-aaa8-9ee0dfa54359", "value": "AUABIUDKXIEGZK(9-29-2021).xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2306cb7-20fd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632903560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903560, "uuid": "920fac55-59b7-495c-87b5-ac438e9064f7", "comment": "Malware payload", "value": "573fc446efa5ebfc98141352b0870e52", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903560, "uuid": "1d65dd35-dc24-4ae2-b138-79a21f92fbd8", "comment": "Malware payload", "value": "22816d398c328a70f5fa892c6d7bcf39e4682ec9df0e88fb20c38bda9f8029be", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903560, "uuid": "0c297626-bcbd-417f-9460-c82028e41a08", "comment": "Malware payload", "value": "c7904dd46fc54dc060cb7b29f2890fac7af0357e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903560, "uuid": "7ff48662-42fb-4d4e-8bb5-26c257c153d7", "comment": "Malware payload", "value": "aadca7ec83c08ba2bb7fbfd1fa6e118e4102a568958ed70d047d088a7785fba581ae569ef86cbf4a72db368ab7ef1fcd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903560, "uuid": "f2e12c1c-f616-45b3-9cd5-9e27cfbcce59", "value": "T138427EBEC702F81EE5C58D7DA01A52F4F74C6086862DFA9EB140F1186B4467307AD9CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903560, "uuid": "96dc5605-4f93-4c75-835d-1aab456ec5fa", "value": "192:ScIMmtPf7V07GyPZx45bv/0Ivk+DwMUWoNNGVbH/f9WNW:SPXRGBK7aWoNNGVrUNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903560, "uuid": "f5eb2c03-a1e9-4b66-aaef-8cea3a816ac8", "value": 12638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903560, "uuid": "e2f7753a-6d70-488d-b34c-03c1625c859b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903560, "uuid": "98f30893-84a6-4fca-8d51-9c7a78b7d814", "value": "Open the attached file.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5a48ae-2156-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632941405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941405, "uuid": "2a3c119a-8fea-4a05-8339-2b110ae7f978", "comment": "Malware payload (Mirai)", "value": "d82e603979b3b7495a123e4a5a129a0d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941405, "uuid": "8fada5c3-ef46-4e31-92a8-bdeb9d21eca6", "comment": "Malware payload (Mirai)", "value": "2285df6fece1e0be587b921e5a6a063e918a23cae0ddd2bd96711ba8ed206c19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941405, "uuid": "66035a83-6d0f-46e4-b4a7-769ae60821bd", "comment": "Malware payload (Mirai)", "value": "a981067cbae470de23bdbe3d441878a910a88c05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941405, "uuid": "05817e80-e07d-4f83-9b67-1898f1edfda6", "comment": "Malware payload (Mirai)", "value": "ca2c6ca3672433d87ecf60d86ad329293993b04c2feede60b37f6ef2376cfcee37a731b4922b65d6ed45501ec874372d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941405, "uuid": "4047b185-477c-4780-89ed-fffb103eb61f", "value": "T177C2E13257C0B862C3344A35EB3AD24326B71A6E81FDB9703114116927EA16F7F79C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941405, "uuid": "081a6852-423e-40af-8683-83d7493d063d", "value": "768:tTdPz+Cwf4V4yb3kdB2+rD0uFK1DI9dks3UozU:11z+DyE8QD5FqI9XzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632941405, "uuid": "ac9ca1d2-f414-42a1-8716-79e9129a9d91", "value": 27824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632941405, "uuid": "931e6739-b73a-4742-a570-0df6e6d9b690", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941405, "uuid": "14a9c2b1-dae2-45b7-9415-600bf31e5262", "value": "whoareyou.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125dba53-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632908768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908768, "uuid": "76bb8da6-8aa7-4c58-8ede-bae0011679ff", "comment": "Malware payload (Loki)", "value": "e3436c07890442a44598bf7a80b33b53", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908768, "uuid": "9791b9ee-57a5-40d5-9498-c8a4f09e5b01", "comment": "Malware payload (Loki)", "value": "22a036d751d852ee5cd29e054aa10166ef1cd8e19c2ebc173fb413c3e9f7f860", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908768, "uuid": "c49720b9-56a9-49c2-8327-4a4664b9cec5", "comment": "Malware payload (Loki)", "value": "e9f85eb32283e934e836b839d4cb186b3d8d1d42", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908768, "uuid": "8252c608-3344-489c-acbb-185ef124c138", "comment": "Malware payload (Loki)", "value": "24f031670fd8576b0d4edb30ebb5a7c2c8272963e6e4140df3f6c02f898cbbbbee2b5a34e844a5263279e3f38b5ab01a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908768, "uuid": "daa11ca6-6ccb-4368-810a-7e906e9db22d", "value": "T16AD3029335A1468ECA284036F4FF00DD4F454D9B693F28A6215E395C75B358E0BB87AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908768, "uuid": "dfa8aef7-f20f-4ba6-8ced-fe496dd3193e", "value": "3072:zQwIvyZ8JcbRC3nHdXSkv9hiEzY0sf+oDZz2pV:zQ/qtCXHdLv9hijfNkpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908768, "uuid": "e72297b6-17d5-4e1f-bf65-9ca61408bf94", "value": 141448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908768, "uuid": "53c123f6-5b1e-44d8-869a-1536010123ef", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908768, "uuid": "712c4583-9cda-4630-9ee3-678b9c6e5e46", "value": "New Price List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b5dd93-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898380, "uuid": "ff9d0b96-41ba-47cb-ab8a-86605145e4ad", "comment": "Malware payload (Dridex)", "value": "d19e15db2d448d2819c8c432ed7d6555", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898380, "uuid": "73fb2742-ea61-4423-9634-918a594c82cd", "comment": "Malware payload (Dridex)", "value": "22af5b66e42002226a3ebffc7a9bff5fe4984ab2cce1f97e2aebc62b75b5bc89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898380, "uuid": "ca27254f-2fab-492c-affa-46d80c7450f6", "comment": "Malware payload (Dridex)", "value": "49421a0289df02ab85cda9fd83e4d2fd2a91e4df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898380, "uuid": "a8353665-04ec-41a8-b4d3-75e547d5befd", "comment": "Malware payload (Dridex)", "value": "6186c350175a865ba0af39c91e12477dfc56c713171bb65a45181458cc0cde5b3f01453c6ee4708897f5cbc30b8a2a32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898380, "uuid": "022b3f2a-b890-4e26-a519-a09244f4591f", "value": "T10316D010EF69E1F6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898380, "uuid": "7b7e9e66-5cde-4e6a-9503-63e2d8ae1207", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898380, "uuid": "63e3203b-5389-41a4-bc4a-2cd134865a29", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898380, "uuid": "c90e4143-1079-4a52-80d7-c67cc3b295e7", "value": 4268032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898380, "uuid": "d47a8a17-4503-44aa-a778-c289047f215f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898380, "uuid": "4df18ed2-c0a7-4026-8ce5-7841bdac8f96", "value": "22af5b66e42002226a3ebffc7a9bff5fe4984ab2cce1f97e2aebc62b75b5bc89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f228530a-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898406, "uuid": "5a7e8ee7-95a4-42d1-a65a-d8a545a944f4", "comment": "Malware payload (Dridex)", "value": "5c7cf8468ee28353319e24b6409c76e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898406, "uuid": "8927a2ec-94d8-4acb-a99f-86121c037d35", "comment": "Malware payload (Dridex)", "value": "232249b1ef78d42d8a4c96e6a3aa9a5568dc1480ea3a975fa6febab0c6574050", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898406, "uuid": "34aca9b2-a423-4a96-b221-e0612c4dbe67", "comment": "Malware payload (Dridex)", "value": "cedeab9297d93419754903636f581ca936b04e01", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898406, "uuid": "16ed640f-65ee-438d-be2a-d44fb9631a78", "comment": "Malware payload (Dridex)", "value": "41d3b81f28507ec5dc20e856bd5bbeaa9bbf47eed1de36d497ba54a495fa986bee5be0fc856ae3ba7fe4232e19e23d31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898406, "uuid": "ac07db34-a898-4e52-89f0-cdfb76a2bfb6", "value": "T18806D010EF69E1E6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3F9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898406, "uuid": "943e72eb-028f-4d66-93d0-ff47567f1e67", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898406, "uuid": "5843c9da-01c8-44b7-a236-0fdc9b4882a9", "value": "12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1at:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnbat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898406, "uuid": "4dc86547-44ca-4e53-8350-e54b9e43f42d", "value": 4018176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898406, "uuid": "07113485-ce5e-4ecd-a2cf-e9efecc7c4a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898406, "uuid": "e2d8c5e0-73e3-49ce-a9ea-88a201f84fb3", "value": "232249b1ef78d42d8a4c96e6a3aa9a5568dc1480ea3a975fa6febab0c6574050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618ca3c5-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901170, "uuid": "48113d07-0cbf-4992-84a9-1b83cbd536a1", "comment": "Malware payload (Dridex)", "value": "7b5d9a2242982e6b9c02ef6431fe65f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901170, "uuid": "0a2e8047-e343-4327-82bd-7e128c8a9b53", "comment": "Malware payload (Dridex)", "value": "235e19781781d0892430717c2316fdd572133f7eabb4b2dabcdfa9bac470fc23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901170, "uuid": "21f87ca5-d520-4084-845d-5f7ae07483bd", "comment": "Malware payload (Dridex)", "value": "a21a1f4047125808daaefc0622278fdfb270f1d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901170, "uuid": "1cc9a630-0713-4a81-8644-edb71b176fc0", "comment": "Malware payload (Dridex)", "value": "72bc9de08356f8912c57c049b44f041d370342942cd5851887fd83fbcda155a854deb28861b5bddeb8dced461eb543b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901170, "uuid": "676b248c-e80d-42a1-bd7e-16f28237b910", "value": "T14285D020EE69E1E6C6B89F3ED408352717B93D75110D60CCC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901170, "uuid": "8929df77-4f68-423f-9ad2-2a1057193163", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901170, "uuid": "7af8511d-82ac-4d75-b01a-4af9ad142468", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901170, "uuid": "fadd6c1a-360e-4de5-8bbd-9fd4c99a6bb2", "value": 1781760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901170, "uuid": "686003a8-086f-4c0c-82ea-05ab37ff40f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901170, "uuid": "6bff1ed3-4b40-486d-b96e-cdaead1b7ef5", "value": "235e19781781d0892430717c2316fdd572133f7eabb4b2dabcdfa9bac470fc23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbd0557-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632908951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908951, "uuid": "01b0e4cb-2426-4853-8ccf-698620353d5e", "comment": "Malware payload (Loki)", "value": "93d20d0482c280a627aded5f423b6398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908951, "uuid": "bb89e904-9602-4b1a-97fc-29b62fa7b7d4", "comment": "Malware payload (Loki)", "value": "235edee105bd7805d4650b7120bb35600b96df1e1ac169d7b7979e3d4f976a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908951, "uuid": "d98ab1ae-7a18-4c18-bb13-7db7e5fd9073", "comment": "Malware payload (Loki)", "value": "19d314caf087b9e0f8262b24d8c47fcc0470b184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908951, "uuid": "3f40deee-d28d-4cc3-bf2c-f987cb2f7bd8", "comment": "Malware payload (Loki)", "value": "866ba20634452cb5dd41fb53e93c885f17b58e0eef4fd35da01c5830eb73efc9da49476b2d58f6951b09e17354d7d7c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908951, "uuid": "c10a5a63-af42-4cd0-b28f-56da1ec4f88a", "value": "T1D3D46D5DF61CE29EFD0803B021297CD425E80C6D19BCF927BEA6B5E230AED7651F0496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908951, "uuid": "4259e264-085e-4ca4-9719-2b1c44b8450e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908951, "uuid": "2053e2ae-41f6-4bb8-bb87-118fb5ac488a", "value": "12288:QD4VHfQe6ZyWshg+qbZxTZZWunAWvMhBlXyPKI5BLzWwwMeRkayI/8Al90c:QD4VHfQe6ZyWshg+qbZxTZZWunAWvulX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908951, "uuid": "be2f0854-d246-40b6-97e5-f7f7a183c99a", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908951, "uuid": "2cf0c8b5-a4e0-48c3-ba7c-f266900aaf42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908951, "uuid": "a668eb4e-eb23-4a8e-8d12-c424bdb42b1f", "value": "elolegfizetes\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9372a536-2122-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632919292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919292, "uuid": "d61cd1fe-a1df-4030-b9d5-79cd7eba7820", "comment": "Malware payload", "value": "aae32be99cfb884e1ccdf05abc5cafe8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919292, "uuid": "171fd0e0-a84d-4de1-97e1-e409dca9b3c8", "comment": "Malware payload", "value": "23ff5a5a21d2462cb2c9974c012b8f1d1f874104d4bf112a1d03f8cd1f9b8012", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919292, "uuid": "af00d552-4c54-4f4e-ab12-cc588a0acbef", "comment": "Malware payload", "value": "921ff78e0cc253328c05bda757f1fef3fd075b82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919292, "uuid": "cd854049-791a-420b-a967-fccf39d9595b", "comment": "Malware payload", "value": "0149008eca65646b37d81e6c2d3df977d6615cb3ae1e7e8cb00c679bd9a199d20fe1bd439451a398622da3676fc0c0e3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919292, "uuid": "84320f8c-b9c5-4178-9827-9c7e550bece7", "value": "T1C992D015DA16B42DD02B52F8B84EC1F1BB84034277B6BB5F7B41F72A4E079C603694C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919292, "uuid": "ce8aafb8-d1fe-4181-9588-fcfd336fe791", "value": "384:soPlFim5e+oy+EUrFtdVbfq1ocYBU+B0w:siimENE0Hdxq1ocm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919292, "uuid": "664cfa30-d770-4334-a846-447a3bde962f", "value": 20032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919292, "uuid": "0e707a47-f9a6-481e-badc-ee2f4d819d8c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919292, "uuid": "1ad555d0-5299-4919-9b0b-7a92c36544ff", "value": "BUONE NOTIZIE CARA.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e187470b-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900525, "uuid": "c0bfa344-9fa3-476a-b05e-ce3f504676bd", "comment": "Malware payload (Dridex)", "value": "a9547c2f4e42833a9fc5d9a156d01b0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900525, "uuid": "38ace8b8-2ffd-4d12-a32a-d8282d41366d", "comment": "Malware payload (Dridex)", "value": "242ceec6f5000a48618d138fa52d20a9350a0fb36f6a202ef098d15656376c79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900525, "uuid": "022ccd96-ba4c-4555-900a-b4a4277e204b", "comment": "Malware payload (Dridex)", "value": "6d3579289eae41cfcfc8f1be94f1cc192598a563", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900525, "uuid": "460f680a-fe2e-462f-a40a-067437fc16b1", "comment": "Malware payload (Dridex)", "value": "fa10c12d497f2ba05f81f2766f878e4b22b31e651bfc6d298c3d2e042ce5cfd1c8bf658e13c7a62a72d7952cb4f25c19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900525, "uuid": "8ec35a0a-a0dc-48ab-97ac-97aea366640c", "value": "T1D7A5E120EE69E1E6C6B99F3E940835231BB93D75110D609CC351608F9EF82546E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900525, "uuid": "ab5bda36-9f42-4e78-b87c-eb8e96246216", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900525, "uuid": "ccba5374-4586-460b-9136-5d5d43923e07", "value": "12288:tVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:0fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900525, "uuid": "822a4fd9-bfeb-4ddd-a997-6d236141841d", "value": 2093056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900525, "uuid": "74fd7d3f-1374-49d6-bc75-fa72828ee92b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900525, "uuid": "6e53edf8-ca2c-421b-80e0-540d6bc56634", "value": "242ceec6f5000a48618d138fa52d20a9350a0fb36f6a202ef098d15656376c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243ee959-2100-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632904503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904503, "uuid": "a7044aa5-8dd6-4c7b-907e-a7bbca3ca49b", "comment": "Malware payload (AgentTesla)", "value": "3299632a0cf6d1d7d4b78aeed0042561", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904503, "uuid": "8bc0a6b3-8820-4e30-be30-f96d4f7cc120", "comment": "Malware payload (AgentTesla)", "value": "24a2f78a575d63ee926077df0d0bbf159a23ecf4aa3acc61f2961168686c8b45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904503, "uuid": "a2861c3a-725a-4f20-8792-110ac6ae4f05", "comment": "Malware payload (AgentTesla)", "value": "2e2639690e8b5eccd3c8a55d2950651fdcab2e72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904503, "uuid": "b7fa7453-6319-4353-8818-f821ea633727", "comment": "Malware payload (AgentTesla)", "value": "1ad8b90900d244a87db1c0c968ad995d57840f390daa688b378796194739f8189c04aff65dd95234705575cb4086896c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904503, "uuid": "43c0ac6d-9c92-42b8-9b8b-916128e4771e", "value": "T1DAC48D39C1856BB7D6EB2FFCC0A228008CAA6ED7D3435B4C69443F863C77134A56996D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904503, "uuid": "cc932589-96ab-4039-ab45-553b364fd9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904503, "uuid": "17719b17-d9be-4bd8-bedd-32c0bcb0da57", "value": "6144:uLA7aoOCxxSr6A3QtBVAb2su+qcXdjyONyLN4azfqjorzFypqOEsTPqHOfRd:uLny+qiN1aOHSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904503, "uuid": "f93ac0e6-410d-4ae8-8888-c2149553910a", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904503, "uuid": "07f318b9-67b4-4635-a308-f1c7ba68a66a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904503, "uuid": "f6626d1a-5682-47dd-9a78-db3ad094be79", "value": "Invoice18742.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e5c415-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900531, "uuid": "1b8b06e7-314f-48ee-82ef-cc2097e6a676", "comment": "Malware payload (Dridex)", "value": "172a4cc9af57bd761989b954ef2284d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900531, "uuid": "5fb67f10-6d78-42ae-b56a-b750562c38d8", "comment": "Malware payload (Dridex)", "value": "254648431c4cb5fc2c53fdfb66fee1ba2132a239af96e3b529ae4821c70252d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900531, "uuid": "d8d9ebcd-f084-4b50-9be1-e9c5f8cb8867", "comment": "Malware payload (Dridex)", "value": "c9f6f65fbc749b19953c206d2f47b2affb59350d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900531, "uuid": "bb4f92f9-94df-4886-8871-07cf55a81281", "comment": "Malware payload (Dridex)", "value": "42b4a859befcf986e8f2c2f42281f117a7e714d0422422e4ad5ed902e169d45f4991e3d53a52bb9684dd8b85fc63d08b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900531, "uuid": "f0b35fe7-2780-4ae9-a772-5d25b3eb64b6", "value": "T1CDA5E020EE69E1E6C6B89F3E9448352317F93D75110D608CC396708F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900531, "uuid": "c775acc6-ac1b-4d46-a3b6-7b1229882afe", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900531, "uuid": "d76a92aa-a095-4e9a-8e90-2ecff86a8ee4", "value": "12288:XVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:efP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900531, "uuid": "27f4e47b-7c44-4d8b-9bc9-ac0dd328a9c5", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900531, "uuid": "021f2be2-355a-47a7-bfb6-ef8b44bfa2e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900531, "uuid": "16251a62-d0b4-48fe-90ab-f2fca29f3607", "value": "254648431c4cb5fc2c53fdfb66fee1ba2132a239af96e3b529ae4821c70252d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe45d58f-2127-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632921619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921619, "uuid": "f1249dee-b30b-44b9-9099-040526def021", "comment": "Malware payload (AgentTesla)", "value": "430ac3b517f9efbe36be8a849fccb940", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921619, "uuid": "2be3452f-4059-45cd-a911-1353795e1c2e", "comment": "Malware payload (AgentTesla)", "value": "258861524e15de729ffedb9577c48dfdd65640d2f446180c8f5e78bc9d0c9b65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921619, "uuid": "f93d4911-cf03-4b67-b55c-cd9b49a598ea", "comment": "Malware payload (AgentTesla)", "value": "e883849823dc98b538e7f2e5477dff2afc964be5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921619, "uuid": "615507bf-cb5c-4ff9-81d7-2512644bf278", "comment": "Malware payload (AgentTesla)", "value": "c7d4d35cd55e1aed612741c264db083ec0055ec903485b1c311d3de1603235f712c0805a1f1a2a48c1e4396a34f1a492", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921619, "uuid": "19661452-7662-4b73-9d4e-c5fafa5bd935", "value": "T1B2F48E6DF61CE29EFD0903B021257CD425EC0CAD1D7CFA17BEA6A1E230AAD7651F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921619, "uuid": "71c58f6a-b182-49ac-bc97-85e85cc2d54c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921619, "uuid": "25150e90-071d-4c3d-b104-78d5346d91da", "value": "12288:dD4VHfQe6ZyWshg+qbZxTZZWunAWvhXS5abEKnVkqS2idPdWMRtL4b9HaBqDrzH9:dD4VHfQe6ZyWshg+qbZxTZZWunAWvh02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632921619, "uuid": "9d2d3e2d-44d8-431f-9118-d02e98924704", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632921619, "uuid": "518baec2-8972-47c7-921c-bf87e313698c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921619, "uuid": "5707e835-86c9-455e-8a6f-51e1f19a61db", "value": "DHL Shipment Invoice NO - INV8425487-80228.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba5cc2c-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632909267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909267, "uuid": "2c748f0d-3147-4bf5-9854-4fe22bc9d373", "comment": "Malware payload (ArkeiStealer)", "value": "83e750232decd09ee057c45ff7083e0e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909267, "uuid": "2e5b0b95-b0f7-4834-b1f9-dd26398bc1ef", "comment": "Malware payload (ArkeiStealer)", "value": "25dd59d21ec0e44396176ed90db72b5a75daa18dec7ba89df0f32d8d0880aae9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909267, "uuid": "4e4752c4-8343-494c-b683-e1c99d471de0", "comment": "Malware payload (ArkeiStealer)", "value": "e9e61c574614b7893aeb060f2b58a18be91978ca", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909267, "uuid": "48a5bfd4-dbc2-4b2a-85da-090b8a6aa612", "comment": "Malware payload (ArkeiStealer)", "value": "0a753ff88de489aefc2e342a3173781f0df49646caa4dce51777a758f7f22f825b99153ca1fbe10f6d7dfed1969ddd1f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909267, "uuid": "b3021bee-d3c9-44a0-ba11-ed3477bcb895", "value": "T137D423007881A3B1E722013F6511DFECA66DBE4DEBA5B2773B0027EF59396673A24351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909267, "uuid": "67fb394f-068d-4b32-beaa-b028dd1dc382", "value": "f249badb491e7862c803d80af2d74342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909267, "uuid": "7fdaf482-a72d-4e66-adff-32bbb5d259f4", "value": "12288:G5seNRDnfTHPe6oS6b7AOea6iz7OkCiiKETX359rMYZGnI1fFy:G5tbfTgbpea6kOkCmETL50I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909267, "uuid": "8a026445-26ef-4048-b91e-5dd6a431d354", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909267, "uuid": "f0bec192-800a-42c2-b1db-98e1a72163b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909267, "uuid": "b6f36c2c-d5d9-4e5c-87f1-f2e267277658", "value": "83e750232decd09ee057c45ff7083e0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64d020c-20de-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632890252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890252, "uuid": "fcacc22b-779a-4ebb-88b2-71a72a23cf38", "comment": "Malware payload (AgentTesla)", "value": "2a335a98a8cdaa87e0fc648fb04bdc3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890252, "uuid": "850b8350-666d-4f38-b1bc-c9d23615b0d9", "comment": "Malware payload (AgentTesla)", "value": "268ca772e3e7bef1a82759917e3b9c4377869aa7cb04a829397978adf495c340", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890252, "uuid": "6dc2b87f-64b2-4e8d-8d5c-c55b0a2b6006", "comment": "Malware payload (AgentTesla)", "value": "77067c04973734acaf1ee35bd8092ca488dec1e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890252, "uuid": "2c7dbd4c-16ec-430a-9384-1ab2162b3099", "comment": "Malware payload (AgentTesla)", "value": "720660b35c41e242b93a983642257b3fda0644ad565fbe72b213d472be6a06c099a613f962eca34811bb94bf153d16b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890252, "uuid": "7da54b9b-3961-4f0c-a161-6c0471ef67d6", "value": "T1FD158D2AB60CE64AFD1433F02524BCC411B81C981C6CBA17B97676EAB4F9D27DCB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890252, "uuid": "167674e7-ee75-4061-aae0-15bed01da1af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890252, "uuid": "a648e3eb-5415-4513-8256-64dd6e6946f8", "value": "24576:gD4VHfQe6ZyWshg+qbZxTZZWunAWvf3M3qkCYZwE3oYiZZnDUZUAE:I/4yYZ3otbDUZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632890252, "uuid": "233bd016-65dd-4457-b37f-64f5185f5851", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632890252, "uuid": "902f0d21-b64f-433c-9839-2f479432473f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890252, "uuid": "817aa82f-51bd-404c-9dbb-384f293814b5", "value": "Scan0100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121a2b85-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902325, "uuid": "6d5d85b0-ec59-4f48-acde-3c2ab5a61ff1", "comment": "Malware payload", "value": "a1c6ae1b6ef6d2ebae77af87f18c7edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902325, "uuid": "e5f61c6f-ccad-443f-9d5f-540be5442ab9", "comment": "Malware payload", "value": "26aaf89aa3039f135b4aa47c4628dc4d33b341ceaa865788705468dcb3ef2967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902325, "uuid": "8d047518-bd12-4a71-9141-b8a5833679b6", "comment": "Malware payload", "value": "ce9ddb045fdca728530ccba0df622f1bbf8bd077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902325, "uuid": "501101b7-9522-4902-bdb3-b5aacbabc515", "comment": "Malware payload", "value": "260ae10e3af25c4f91b7816c5c7f326b993e76ca08fb607f147df18896e1597d58291763e11f06e8cb691e929fe9d5f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902325, "uuid": "71ae17ef-ca89-4fa8-a409-a76338d11c3f", "value": "T14A73D012BF811D08E7BA0B3726EC31C606BFBB89AC7197CB642E59C85F37A5095D0718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902325, "uuid": "d3f292ba-0360-4c7e-a9c9-45e092de8bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902325, "uuid": "79d07334-d9f7-4a06-bbdb-ff8233bc6a3b", "value": "1536:YSV52XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt961b9/I1bO:YSV5+SyRxvhTzXPvCbW2UGb9/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902325, "uuid": "63e61498-b302-408e-a862-e4d25af2ae42", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902325, "uuid": "6a01d9d1-5140-46f6-9518-297924fb1d57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902325, "uuid": "7f6d638c-18bf-4500-8c32-ead5a436857d", "value": "26aaf89aa3039f135b4aa47c4628dc4d33b341ceaa865788705468dcb3ef2967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62c7774-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898815, "uuid": "5f072697-d347-4a4e-83b7-5374bae71a04", "comment": "Malware payload (AgentTesla)", "value": "8937f0e49113b577b7c3e442cb15b5b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898815, "uuid": "c9808d56-161b-4608-9cb1-5aa50faccffe", "comment": "Malware payload (AgentTesla)", "value": "26ffa832d5d66fdfaae1498459dadfc14ea70419dc51a45a3f6eafe2fc192315", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898815, "uuid": "7a3fd22f-4aa3-411b-ac77-741b6ecf9ff9", "comment": "Malware payload (AgentTesla)", "value": "953eae20b666de11c9dbda0ef419679eb1859981", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898815, "uuid": "b770084a-56ee-40cf-ac34-84c82f76596d", "comment": "Malware payload (AgentTesla)", "value": "23e66861ce5ba39bcceafeda128e685f6baaf93c90a5683606fb803e927815aebfca7f3b6a604474e67e319976953859", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898815, "uuid": "9007f330-202b-4e47-afe6-c4f887d4ea6a", "value": "T15EB42330ADA4FA05F24F3AB165552CC9B74CD87ECE4364056B43E63451F04EC59A8EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898815, "uuid": "d9301a8a-193b-4d8e-a365-9050fb4d8944", "value": "12288:RMF//jQPh/iaJYkST5M63dd9jTckLuHHB1wqnh5vuH57nlDn:RMWZ9ikST5MENhunIM5vuFlDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898815, "uuid": "21fa90ae-9b89-4a8e-ae93-698d101ea41a", "value": 535588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898815, "uuid": "373fe892-fd8e-46b4-90b6-5be59e2d4347", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898815, "uuid": "fc9233b2-755f-4464-b4b5-5914cdfead3a", "value": "PRICE QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a495754d-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632903000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903000, "uuid": "498b5312-5a23-4def-9bb3-cb1bcf6e5c22", "comment": "Malware payload (Tinba)", "value": "da908ede38e7fadef27def420ebcecc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903000, "uuid": "342a752e-95c1-4d55-a26b-e6b3e3e7fa77", "comment": "Malware payload (Tinba)", "value": "275002abb4cdec1dc338ab33fb70aa51ba8eb9d7617e558ba56f46f1c911133b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903000, "uuid": "a00dc9f9-d176-404f-ad30-a0736dbcea6b", "comment": "Malware payload (Tinba)", "value": "aabfdf5021d8c53b372c6323e32cf10d8fe8ec73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903000, "uuid": "580df63b-f922-4495-8129-4650effcba8b", "comment": "Malware payload (Tinba)", "value": "63c20aa4c09e045e3059b4c7b89aab4131b856773895480d4005427d130ebf97476d07e035ac4e656a12e4f7429ff76f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903000, "uuid": "fd95b0ac-b59a-463d-bfb8-625658d77c0c", "value": "T1B773F812A3A6A11FF4B75AB96A78813216237D709F34D1CB32C84E9D56B3DD28D31723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903000, "uuid": "484b74b4-1fbc-4663-a05d-586c921aa879", "value": "a0c97e54c7cc84aa5e0a7c186f29e1d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903000, "uuid": "44a00c76-96ce-41ce-9a77-ffb60b5bb7b1", "value": "768:xHAl7xH0U2VFb8OaYS0a6L+nznGOevsCWg9nrC3Xybi9HW+C5c9JT:al7ln2HLPL+znGOe0CWgleHosHGm9JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903000, "uuid": "165541e0-26ab-4fb9-94fd-42a98ee02826", "value": 77828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903000, "uuid": "fbe52b2e-10b0-47d0-8fa4-4f0141487a18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903000, "uuid": "16340ef8-b62c-4f6f-a9e0-e162d518a6f8", "value": "275002abb4cdec1dc338ab33fb70aa51ba8eb9d7617e558ba56f46f1c911133b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae85196-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632896488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896488, "uuid": "90b15322-d315-44a4-b7a7-088f7025b5d7", "comment": "Malware payload", "value": "908cfed6afafd9b15422a10ec069fa9d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896488, "uuid": "45ce5fba-7c95-4537-8f4d-cee25c146615", "comment": "Malware payload", "value": "2765dfd16fdca9a7de04c08d68e28ed8331d98df4e082f10d3cc62ae9a6d09a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896488, "uuid": "098c6840-7c9e-487f-b6a9-f7fa58b0ffe2", "comment": "Malware payload", "value": "039bba1e26fdf4e2c7c9e150451ced968d419ca7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896488, "uuid": "c910ba6a-718a-443d-8651-59756e6a8cdd", "comment": "Malware payload", "value": "dc29fc5f5aaead90d7edc0b1a81d90e569517a8b4828aaa9d23e780482d0cdec3cc9105a759ac60efae7b8f2c882f4d3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896488, "uuid": "7a72c618-22c6-478e-8414-f2edde8eb4fc", "value": "T10CC4AFD458DA80A6B98105DDD9C0F44D9820FED1355FDE28C7AECC73AE596F8AEC408B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896488, "uuid": "5c6a265a-3145-4da1-833f-4818b45ae582", "value": "12288:G///////////////////////////////////GEMMvdzFHRsU0:rGRsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896488, "uuid": "8de69850-11b1-4aff-882a-f6ca3b94849d", "value": 549299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896488, "uuid": "9d19d49a-fc23-44de-85c4-31922972500a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896488, "uuid": "adc4c856-75fb-487a-9d30-aa168ba177c1", "value": "Vessels Particulars.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb43e85-2158-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632942259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942259, "uuid": "536bb235-65d3-44b1-b2aa-ea181d128ee4", "comment": "Malware payload", "value": "be489c4415757ddcc6af1392c2f7bc92", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942259, "uuid": "8f90d285-cf17-4ed7-936a-e78227ef7cd3", "comment": "Malware payload", "value": "280efc48af2241a2e06a8d5a5c4a943296c42578bff354ca5e97f9c77193f239", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942259, "uuid": "40257e2c-d7b3-4111-91bc-ae6a66566c25", "comment": "Malware payload", "value": "04f431e4f1f034fb2ba677afe969600ad214e69d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942259, "uuid": "8e41020f-91a9-4938-a5c0-cddc9e291282", "comment": "Malware payload", "value": "591aa002cea42eb8e88a6b22dc86be91ffcb260866c3063a6ed5961197484756b9b730bad0e32caac9f230b36e29c7ef", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942259, "uuid": "d6efccd3-bb66-45b1-b4c5-bb77dfb3dc88", "value": "T1E7D38D563399E84AEB6C23350ED997E6372ABD15AE6347133108731E1DF52A0CE07B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942259, "uuid": "774be7b0-5eed-4a0b-8de7-cabe43d548cf", "value": "3072:Yk3hOdsylKlgxopeiBNhZFGzE+cL2kdAH11ScHlwFPYidH4C1TsNku0KRjkR+T99:Yk3hOdsylKlgxopeiBNhZF+E+W2kdAmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632942259, "uuid": "e24f85d9-3854-4e45-9d4b-ba0048771986", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632942259, "uuid": "4bbc2af7-006b-44ce-b8ad-2a3773b34d9e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942259, "uuid": "c0882b65-53e5-40a7-a8ae-156cff905e27", "value": "280efc48af2241a2e06a8d5a5c4a943296c42578bff354ca5e97f9c77193f239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4e7b6c-210f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632911202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911202, "uuid": "38690c5f-8cea-4ee0-8863-1186a067dacb", "comment": "Malware payload (AgentTesla)", "value": "a3f9ca9cfdf6a897decfa1d803bce116", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911202, "uuid": "f0270195-0358-4db7-837b-a2e603578524", "comment": "Malware payload (AgentTesla)", "value": "28361df2e00fefcda07f805ea5c17613194fd69b28f143d393f8aeb123cc5eb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911202, "uuid": "ec2a2555-d2b2-49eb-9568-24f2842de4c3", "comment": "Malware payload (AgentTesla)", "value": "671b4567aa1382b93ff0ee1b7ef367d542135c3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911202, "uuid": "3d7ad5a0-133b-44ac-b1c0-0bcb5785be07", "comment": "Malware payload (AgentTesla)", "value": "844192d7e02a33609b66a4466ef636b272bb775ec4b4df57a5f59eb4e2f3e9f93f1bdcdce4dc60686da9489f97bc3e0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911202, "uuid": "9fe09796-9386-495a-b3fc-378959b63ee3", "value": "T1E7F48D69F60CE29EFD0903F021257CD425E81CAD197CFA27BE97B5E230AAD7551F00A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911202, "uuid": "24cb63e8-b742-479a-bb4b-65229f65d8f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911202, "uuid": "ac1af297-a4c2-48a7-b8b3-f3d9bea792f6", "value": "12288:SD4VHfQe6ZyWshg+qbZxTZZWunAWv4vdIlHRQHEf7J/kEZfMBjaChh0AqOV805mt:SD4VHfQe6ZyWshg+qbZxTZZWunAWv4Vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632911202, "uuid": "28c7e079-a4b2-48a3-a03c-1764183d0569", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632911202, "uuid": "7d52689e-468f-4441-b392-acec3627f9b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911202, "uuid": "3de5072d-6a57-47cb-9b1b-37e037bc36f7", "value": "28092021123218-0001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3723b267-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902387, "uuid": "fc74732a-1305-4c3d-b01c-1011b588e6cf", "comment": "Malware payload", "value": "219654e85ed81ad4a04c89fc717451f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902387, "uuid": "953a5a6f-cb60-4a56-befc-42e12c317f01", "comment": "Malware payload", "value": "284c5ff2d2f46b8c2fb770338d82ba6a112069c3e4604f2aaf0fcea046496010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902387, "uuid": "9955847c-bb20-41ed-9650-27a3fd4e9beb", "comment": "Malware payload", "value": "436e642e4da117f0ac465374ba9298cbee4af93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902387, "uuid": "1e4680a7-afbd-4201-83c8-d72b8f70c445", "comment": "Malware payload", "value": "59f53a04ac213b3e39b022634afc21630ad6bd6175f8a25bc02ce76ee6a7e7a25354df6c15e684c46ea891d769b90da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902387, "uuid": "5b482b96-510d-4e8b-b146-35a7f3441905", "value": "T19373C011BF811D08E7BA0B3726EC31C606BFBB89AD3197CB642E59D85F3BA5095D0718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902387, "uuid": "4274abee-9300-4aeb-a47e-06a37a427f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902387, "uuid": "4fa69220-9a30-45c2-8fc5-65986cb952f9", "value": "1536:v4V58pXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt961B9/lS12X:v4V58ZSyRxvhTzXPvCbW2UGB9/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902387, "uuid": "3e35a094-99f7-4da2-ac14-aa8daf1a7ea7", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902387, "uuid": "d056f38e-df8c-4e3e-8400-878686199869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902387, "uuid": "c94f4429-c6bc-419b-a550-aac3cda16099", "value": "284c5ff2d2f46b8c2fb770338d82ba6a112069c3e4604f2aaf0fcea046496010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1119bfd-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901357, "uuid": "9de80443-21f4-4bd3-b7ce-f0d5948c451e", "comment": "Malware payload (Dridex)", "value": "ac2946276d21ed5449386fd5b1ea65ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901357, "uuid": "0fdcfddd-c50f-44d0-9fda-19880c34eb0f", "comment": "Malware payload (Dridex)", "value": "286f9c732a36e647f74d9a87b07f24ced5e110821a77e1e4a63c3153434bc201", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901357, "uuid": "f60a2fb7-5942-42ad-8e08-68c63249ef22", "comment": "Malware payload (Dridex)", "value": "0fee485ff875b4cd060184b4288a166aedac7dea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901357, "uuid": "cd7e00cd-c6f9-4371-a6d6-dbc2c98aac15", "comment": "Malware payload (Dridex)", "value": "04d0706cdf80921b23e3508b54c04a8eefe3d3729d552e8b00523e61e1207b03b6d17a8efbc3cf10489d48b8667a0229", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901357, "uuid": "723ce74c-c5cc-42d0-9433-ef19c385f821", "value": "T10375E010FE69EDE6C6B99F3E9408352317B93D75030DA18CC391604F6EF82546E3E99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901357, "uuid": "78621312-acb7-47f6-b379-78d740b078cb", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901357, "uuid": "7bebb7f3-739c-4e96-a8d1-97373934502b", "value": "12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1wXV:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901357, "uuid": "eaaf3100-ae3c-4edb-839d-ab61e6ab3952", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901357, "uuid": "ea33f7f4-6183-4e64-abb8-d30c0fbacd7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901357, "uuid": "5793df5f-ec2b-478c-a362-dd2d38685cdf", "value": "286f9c732a36e647f74d9a87b07f24ced5e110821a77e1e4a63c3153434bc201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cedf22-2159-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632942811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942811, "uuid": "c114b250-41ea-4ac9-8e2c-2096d048e2ea", "comment": "Malware payload (Mirai)", "value": "852acdc2de029f82b52c304ace9c94a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942811, "uuid": "e3375ba5-c8b8-4ead-91ac-6a68560a82cc", "comment": "Malware payload (Mirai)", "value": "2883407974956889b9d7bb16be1ca13bb20aa955e9a28407c47b7e3a28001ee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942811, "uuid": "c5a222e1-85e4-4f7a-91fc-232d5be7f26e", "comment": "Malware payload (Mirai)", "value": "9afbf7aa01a3c95991f858356d549bef50f83204", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942811, "uuid": "9a41c5bd-563f-4dff-a50a-233ed3fc57b3", "comment": "Malware payload (Mirai)", "value": "144d41bd93971e5825a85bb974c3d869abdfd257091e5b7408d8f77fe61c160acbee52b381fe9c9489f1771abd43899e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942811, "uuid": "04d24b80-de1e-49e5-b2ba-4d361681b856", "value": "T1FCD2E12EAE06027DEA26C0B1ABF413522D241BDBD15B5DF27D4173539CA65783883FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942811, "uuid": "b2d5fef5-3197-4bd6-8cc9-d647f22bdf8a", "value": "768:7FqhCAkWQ04BQ/wLlkE1DKeFSJgGlzDpbuR1JT:7shzk/nxk+aVJuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632942811, "uuid": "8c32b173-6853-48f6-a9da-1b772e75696e", "value": 29420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632942811, "uuid": "3f77e601-9a3c-443f-b842-8eb489c21902", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942811, "uuid": "628d5f03-c9f4-46bd-b24f-53758f9946cb", "value": "852acdc2de029f82b52c304ace9c94a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd92d575-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1632909109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909109, "uuid": "9a0316f5-8d9b-47ce-971b-70f697345bb9", "comment": "Malware payload (NanoCore)", "value": "9e2030e8edb6d27dfd2683d0d50da618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909109, "uuid": "547cb34f-c294-450a-8a5b-2f45c5e74b2c", "comment": "Malware payload (NanoCore)", "value": "29c14fa450005566a69336d545bbdc87fd8c6fa52fae3a88c194fa4f01197483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909109, "uuid": "3e2b51ac-a51c-4128-8d1b-3cfd8ef6421e", "comment": "Malware payload (NanoCore)", "value": "a0706eb3e9fce9b589143e5ea6d80aecf21af57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909109, "uuid": "85fe44b1-bdbe-482d-a4f3-26a3ba374b7e", "comment": "Malware payload (NanoCore)", "value": "512a60f8996856e44b5c9571389edc5fa411b6f45247c9487b6e604d0e2ea643574e21397f2137a8bcd14e1990b3bf8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909109, "uuid": "c7a1c083-afcd-47ab-b393-063e804ba8cd", "value": "T172F48D69F61CE29EFD0503B021297CC424E81CAD1D7CF917FEA6B5E234AAE7591F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909109, "uuid": "da2690f8-4388-4bf5-8790-5e40977502b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909109, "uuid": "fa45e54a-f0d0-41c3-adc9-c33da2a776df", "value": "12288:8D4VHfQe6ZyWshg+qbZxTZZWunAWvLmzYJtlLZfoZq0OzKTQ7kjuIqlcvjfi6AUz:8D4VHfQe6ZyWshg+qbZxTZZWunAWvLeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909109, "uuid": "a31d64d7-d7f2-49b6-959a-d6a52c8d49cc", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909109, "uuid": "831d18b3-5fe6-43b1-ace7-d9623dae1a76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909109, "uuid": "0061a7a9-778a-4c08-b20e-506e621646c7", "value": "T.T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9c7f3c-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900410, "uuid": "3be5887c-deb5-40a1-817f-4df485658327", "comment": "Malware payload (Dridex)", "value": "0ffcc7be4750a819a9a3e02bdd59117f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900410, "uuid": "bca38a16-d579-4b9b-a584-8c5695a1a4a3", "comment": "Malware payload (Dridex)", "value": "29c39c3481208c5a406cc43aad5336725a4637104cc33345ab3059711dd41dd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900410, "uuid": "8bd98fe9-e63e-4cb3-b0e8-1dbcbb504ed7", "comment": "Malware payload (Dridex)", "value": "0f21f5537689ed333b7e2e7d8a2097096a9f91a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900410, "uuid": "fc285cc0-58de-4e8c-a3be-8cd2da1b9741", "comment": "Malware payload (Dridex)", "value": "26f9671349695f53195978c0512152c8633558f57f6af2dbc7086c061e6e6da6fe600141790b511f1da70f92d265a8f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900410, "uuid": "be73f805-41b0-4b62-a88e-4c4fc2da997a", "value": "T1FBA5E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900410, "uuid": "b2463fec-7bfe-4f43-a897-d4e8d187b36f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900410, "uuid": "6d678c00-aeac-4186-8490-c8298fd7b531", "value": "12288:eVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:DfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900410, "uuid": "d729fb4e-3b57-4cc9-a959-f88a6d231672", "value": 2174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900410, "uuid": "676683fa-0df4-4b57-94bb-cd1f129dfff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900410, "uuid": "9ee0b68a-c4c9-4589-82d4-d12b9278d189", "value": "29c39c3481208c5a406cc43aad5336725a4637104cc33345ab3059711dd41dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3e26d5-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900334, "uuid": "6c11573b-b78b-48e0-8035-2833c738c3eb", "comment": "Malware payload (Dridex)", "value": "a3e9971216067f0388db192f044f7361", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900334, "uuid": "ed8cb165-8a03-494a-ade1-4f78f136e4c4", "comment": "Malware payload (Dridex)", "value": "2a082b773bb6718589202f6a6a707ca3c583276c5b2ce6811e56e2010e525093", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900334, "uuid": "44178272-41f1-400f-80d2-02b3f1ce1902", "comment": "Malware payload (Dridex)", "value": "549a7330d53007c9db85eda6d10e8fceb2eb4152", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900334, "uuid": "4a7241e1-718f-4528-9ae2-2a307ddcff3c", "comment": "Malware payload (Dridex)", "value": "8fae494a89f4a2aa122163a48be10afc81195afcd9c3e5ac123a83993d1b7556d0f2010c942ca5b2766c34e4763b1f29", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900334, "uuid": "bd66cd7f-e36e-48ee-8a74-c4c98781bd0f", "value": "T128B56A10FFF205C3C09DF739789D3415A2B3AA65811F8A1D824F131E6CA5B913E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900334, "uuid": "9f77f85e-e2c9-4d0f-8bd1-afe9b97f8b34", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900334, "uuid": "5a47c83a-4246-4297-8db3-00bbc88b0715", "value": "12288:XVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1EH:efP7fWsK5z9A+WGAW+V5SB6Ct4bnbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900334, "uuid": "1c2e8a9a-fe66-46ae-87af-53a4bdd2ff0c", "value": 2273280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900334, "uuid": "1128064f-68fc-4ce1-a0b2-799dc64db80f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900334, "uuid": "6378219c-dceb-4dfd-bda0-75aad8524650", "value": "2a082b773bb6718589202f6a6a707ca3c583276c5b2ce6811e56e2010e525093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb46619e-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901777, "uuid": "8ec5012a-499d-48f0-9cea-144972664563", "comment": "Malware payload (Stop)", "value": "c1b8dc51c3745d2e1949d72f6303da7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901777, "uuid": "ae675dc9-50a5-42cc-8ea0-8a3ad9bef6e7", "comment": "Malware payload (Stop)", "value": "2ad5958a9660a51f8daa1340e35491c608eb39b3ccc52d00744c50795122e81c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901777, "uuid": "ba489ca9-5ab7-4f7e-8258-e80513b617dd", "comment": "Malware payload (Stop)", "value": "0b1889d280e75a58f62310d9faf74972df88dc13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901777, "uuid": "880300dc-db82-43fa-b59b-af90be4e6b10", "comment": "Malware payload (Stop)", "value": "1f6003ef62c0084600d3639808256b750b772fd375347aaa249730eca666cb227d9996dd7df6bc305e7c794bc7ee33ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901777, "uuid": "1a1a57d4-cd06-48f0-9124-d2aa3cf65040", "value": "T104E412E47BD1C433E3AE45314A75A5A0967B3E369DA3424BE23C1B9E5E2C2C15AF1307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901777, "uuid": "eef9a552-1508-4a1f-984e-efae06d90ab9", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901777, "uuid": "b26bfe6d-f647-4c91-9442-fc18b716bb0c", "value": "12288:11bwDzLYKxgJXZJ35d3nFbr/xALKmbtsEVFjPKEmxSnY8fRPJwls5U3xpA/wKJ1d:fbCnx2Bjb3nFFALrsEDbKdxh8pPJwlsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901777, "uuid": "97724bb7-4a37-4151-87d4-6b01d86e8d4c", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901777, "uuid": "eece0a62-d716-4975-9178-5003d3eb5443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901777, "uuid": "f1b63a9c-9c67-4445-b1d1-73b3661e7a16", "value": "2ad5958a9660a51f8daa1340e35491c608eb39b3ccc52d00744c50795122e81c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c6b3d8-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632899278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899278, "uuid": "7064f78e-4d71-46b7-9604-509b8ee0116e", "comment": "Malware payload (AgentTesla)", "value": "f8fe57167b5de800c15dcdd9ebfc9e8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899278, "uuid": "587f4e50-6c95-427d-8fe9-ad0cd1703f42", "comment": "Malware payload (AgentTesla)", "value": "2b0433f5696ef9d7b2dfec117200ba52d566837a2fe7faf64c9cdb85a982c91e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899278, "uuid": "87cd7219-6167-4fa1-8573-dfc746abbd03", "comment": "Malware payload (AgentTesla)", "value": "e2b7268cfefd9f486eaefb69f25d15e5358dd480", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899278, "uuid": "fa1188aa-f1bf-425e-bcdf-9283a7b575e9", "comment": "Malware payload (AgentTesla)", "value": "819a8f099522adcfe16da8c36b44566775ae8e687e89c99781cefbde34e4bed871b9e54132623652923090480710fed1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899278, "uuid": "d0d66c22-8ce8-47da-9afe-fbd9c82b79d8", "value": "T184358D57B60CC59DFD1832F12215BCC422A85CAD581CAA07BBB532E678F9E63DCB111E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899278, "uuid": "ea4f112f-c0ad-4c58-8eda-bbdb4ce8b21f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899278, "uuid": "1f57c169-f855-4d89-acd4-f7d3643c24d6", "value": "24576:4D4VHfQe6ZyWshg+qbZxTZZWunAWv13M3YSOpdFkdgrj3DSrquc6de6nnjqKoe:QJ4ZOp6gvGrXdDjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899278, "uuid": "97af8596-816d-4af7-98fe-f1cf7a3581c8", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899278, "uuid": "52a8973b-e4d6-4bec-961d-5c26e9f8c3c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899278, "uuid": "c7dd9b01-d3da-4c18-a985-5cbfdd19f923", "value": "f8fe57167b5de800c15dcdd9ebfc9e8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee93f21-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900279, "uuid": "d57a0b40-d3ba-48e2-b6f4-5c8d76bf8dcd", "comment": "Malware payload (Dridex)", "value": "cbd11268c5ba2c70bab3edc0c2f7fb59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900279, "uuid": "d7c197a5-b201-442c-940a-feb7c8e47967", "comment": "Malware payload (Dridex)", "value": "2b57e2d57cdce2497a07d92f5a3dd67c0c444e74e867d2e9b9cc6ac054c3ff74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900279, "uuid": "2cd592f3-dbe3-4c1f-bbba-58518b1054b5", "comment": "Malware payload (Dridex)", "value": "43f1b5ba5731826d9976c213de6c34b26c95beac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900279, "uuid": "bee627c4-1434-4b1d-a831-ddc606845d8a", "comment": "Malware payload (Dridex)", "value": "4e6296583bb5dd3e06d3d24225602acdebb141c0a3c7c102d5dbb3bb3104e04840729abb9a69341c8eaffa27876f37fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900279, "uuid": "a3ea6bea-d48f-4d9c-a1e2-3e4dc9579d52", "value": "T127C5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900279, "uuid": "00acedd5-f400-4c08-85fa-42b2ccf47f53", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900279, "uuid": "f2b96de4-9849-4333-93a4-306e6dc924b5", "value": "12288:4VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:tfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900279, "uuid": "8425fd42-bfb6-4e4b-9ab7-eca70ae2793f", "value": 2629632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900279, "uuid": "8e6c8390-3d2d-463b-94aa-cc19fc4e3896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900279, "uuid": "4c82fa6b-6144-4083-ab57-350f69591b17", "value": "2b57e2d57cdce2497a07d92f5a3dd67c0c444e74e867d2e9b9cc6ac054c3ff74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28846d90-212c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632923408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923408, "uuid": "e3426a8f-3401-4664-8825-40931a7fadb8", "comment": "Malware payload (Gafgyt)", "value": "8a49bdfaef298d0688c60dd0242f90b6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923408, "uuid": "2eb125be-26b3-4a84-a503-1f6135477fdd", "comment": "Malware payload (Gafgyt)", "value": "2b57e3e0d2c6ba825f76c7ded9e55e9c609cb8ed2a0dcbb17197d9674552a48d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923408, "uuid": "3ec3e4cf-ee58-40d7-86f6-a3c170b51e44", "comment": "Malware payload (Gafgyt)", "value": "163f12bec8f45cdd16d2c580474556a87d7ff796", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923408, "uuid": "7d724d31-3f7d-414e-8e76-2f0d534de54b", "comment": "Malware payload (Gafgyt)", "value": "c0b3da3e63c976ad6d35e7d3b5b3dfbce759319b772f94ba79ac275f5ece7abc74a388c086ebb036fff35a5caf1cbdd9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923408, "uuid": "62a2b6c1-d6e3-4927-8cb2-390629ff0f58", "value": "T1B9F3F705FD04976BC2D327FBEB9903CD373616A967DB33169A34AEB02BC17982D25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923408, "uuid": "4bc8f1d5-5c81-4068-a04b-ea99f8479140", "value": "3072:GAnKDuce30IDxt275hUbipe3rjX5VC2mUTrQMbLfWBj/9q:pOuce30IDG75hUb7rjJM2mUTrQMbLOBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632923408, "uuid": "3a41883b-a58b-4114-bfef-3cb83c277241", "value": 162635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632923408, "uuid": "5789318d-f7c5-4c2c-8930-e44ab7a06de7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923408, "uuid": "1cf3fbb0-db49-4d47-a4c6-b33313dffd79", "value": "daddyl33t.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcecdaa-2161-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632946284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946284, "uuid": "8dc39b34-bb9f-440b-9f53-35cbbf9c5333", "comment": "Malware payload (RaccoonStealer)", "value": "f62568a501f9473ed95ec61054f8f495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946284, "uuid": "abb9b076-f460-4d3d-a199-20c790a8e038", "comment": "Malware payload (RaccoonStealer)", "value": "2b9336ac05de09ebf6e39fa98c551939055a789dccfef9c6bfd97c5d3f1adfcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946284, "uuid": "482c8c61-e92d-4881-a09d-001eb473ac6c", "comment": "Malware payload (RaccoonStealer)", "value": "471ad71ca83d3e101dfce718127673d194f66a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946284, "uuid": "350c21f3-193d-4746-8be8-ae0482d1d043", "comment": "Malware payload (RaccoonStealer)", "value": "327cce4894febe546c30a56bfea7852fe4840e5f133c254bf9c567aadf94aec92f163c5d3b6594c1dfeffda65e3bb321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632946284, "uuid": "a1282e36-bb96-49e7-95ab-b878db0f05aa", "value": "T19BA4F1D1B5B1D432E765D5B148E2C362CAB9BC345E7046CB3BC096B96E321E29B27313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632946284, "uuid": "40482290-7df8-491b-bf39-19984c6275d3", "value": "80a508c8657a344b6b8e2e6999ecb92a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632946284, "uuid": "2ab29060-3671-4b82-a883-fa03a1cf8645", "value": "6144:HtbYz7jOqNyBb0+3zsz8eXFBArFbfR3lCihKZlzOy4rYYu6mlkfNzUH5RO:3bvsVFOrF7R1CihK3zOrYYuDClgH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632946284, "uuid": "76f4cc6a-0707-4364-bd4a-4c8c56bc1fc8", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632946284, "uuid": "59de0cbf-5b48-4f05-94b8-2eb0911a154f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632946284, "uuid": "0e6de464-c573-4347-bde4-8cf26468052c", "value": "f62568a501f9473ed95ec61054f8f495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28baca6-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900554, "uuid": "6155e037-b178-4915-bd1e-6cc2463c4103", "comment": "Malware payload (Dridex)", "value": "e7234ee4a49099bd60d204150653f0b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900554, "uuid": "05af7c3e-23e3-4f7f-b297-f0a488abdffb", "comment": "Malware payload (Dridex)", "value": "2bd10983645f789423689d3d2531fc1419613a04e77027a2ca205641accf8f71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900554, "uuid": "554617b3-4414-409c-951a-53812c3941e0", "comment": "Malware payload (Dridex)", "value": "83b134d82f75acb5c1242a24fb005a1c7ba7d8f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900554, "uuid": "ee4bc1c1-272b-4c23-9baa-955b7af76d59", "comment": "Malware payload (Dridex)", "value": "5a8cf9865ed1d58fe765ecfc4aae4ab226ebafb0685dc03454d0401e2c96df4f1f9dce1dc03462292dcec398186d2afc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900554, "uuid": "3912c55f-151a-45e0-b5f8-68c81bf4ef46", "value": "T14395E020EE69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900554, "uuid": "c5f6969d-df40-4541-9331-df4a76954928", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900554, "uuid": "0510e1cc-7b08-4386-883d-1d1476fa2b28", "value": "12288:NVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:UfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900554, "uuid": "ec40cb4a-40e5-4485-b1dc-249780b7c044", "value": 2048000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900554, "uuid": "f0692693-bc90-4256-839a-4cf1c756d3ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900554, "uuid": "b5ff6a10-2280-4c08-81f3-fecca3640fcd", "value": "2bd10983645f789423689d3d2531fc1419613a04e77027a2ca205641accf8f71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd320e35-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900142, "uuid": "09c478a6-db13-4565-a9f5-f1d2700bbcf9", "comment": "Malware payload (Dridex)", "value": "37a4a0101244235595b78e0961f038f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900142, "uuid": "0acf1642-33e0-4f2d-b3e8-87e6a1cf096d", "comment": "Malware payload (Dridex)", "value": "2c0bb6993ecaaa6bc4dc67b98ea637141626bca1b98e27b8121491e6b43d0840", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900142, "uuid": "181c98ee-d134-4598-b1d3-f64658f5213c", "comment": "Malware payload (Dridex)", "value": "c9d81a9a61555431f233122d036cf22aefe9e4cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900142, "uuid": "02ae331a-a6db-4153-82bd-26da8079d4a8", "comment": "Malware payload (Dridex)", "value": "6e4254c74372a91293a2a9e27e3ee4c909aed77bcc86db3f4b0108afdf1a0901693803b41b8afa972204c30ab4643721", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900142, "uuid": "6eccbfdf-8ec5-4789-9c6a-a28ac9d56f7d", "value": "T117E5E020EE69E1E6C6B89F3E9448352317B93D75110D608CC396608F5EF82546E3F9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900142, "uuid": "d9bc3560-a170-4d2e-844d-2973933085c9", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900142, "uuid": "ba178218-e01e-4d38-b223-31eaf517374e", "value": "12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900142, "uuid": "3824bfb1-1707-46eb-9f45-d0d333d86b4d", "value": 3264512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900142, "uuid": "ca2f6d7c-e36d-421f-a0c1-30718cec3dae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900142, "uuid": "6f5b144b-a3bb-429c-b046-d3401d32dfcc", "value": "2c0bb6993ecaaa6bc4dc67b98ea637141626bca1b98e27b8121491e6b43d0840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadf44c5-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632900058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900058, "uuid": "51d7cf27-4592-49d4-86bf-966e34064251", "comment": "Malware payload (SnakeKeylogger)", "value": "fe8276048a0a4cc98275c46c81849ab0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900058, "uuid": "09f79130-d076-4202-86d6-be52012d4fb1", "comment": "Malware payload (SnakeKeylogger)", "value": "2c7460ccde4679ae369036b98c62cf74862efc79ec2c3fffb322bd8ce567a33b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900058, "uuid": "415e83c8-8246-4152-acee-13a2243fad6c", "comment": "Malware payload (SnakeKeylogger)", "value": "d8c669b078579519856840cc466ef6fb50c14af3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900058, "uuid": "b1b1eb47-e260-4edc-9be5-bd750a00969a", "comment": "Malware payload (SnakeKeylogger)", "value": "c47dd7d4be8f30d08e63437bc5ce46cfb8c8c3e0717e9fb2b5bfa53024564d9c10b2a12fc95f267a82e9be634a930ea9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900058, "uuid": "e4425246-64d3-4499-895f-8de866e23bed", "value": "T101942385F3A0155861B3A3C09A51DB65FDD813CE36A37518D9357E0EACB80A23B70F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900058, "uuid": "b465a75f-ea28-4d6b-8ecb-43b5358aa1c3", "value": "6144:xyamP1B027B8z2NN8uWU1Q8lr04a6aglHyOU9mWhtXq3sEXpoROny6C6SZ5fS6:xyL1B02SqNd1gR+lIwWhtQsEZ6+yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900058, "uuid": "d2df3eeb-e8e7-4bd4-ac34-788a3ed3d240", "value": 432704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900058, "uuid": "ebf9788d-a714-4fa7-9daa-ca703d7aa0b4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900058, "uuid": "3d26416d-964e-4434-a634-5f1cbccf83c5", "value": "PO126127, PO 126128.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e24d36-2122-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919219, "uuid": "57b463a4-b39d-485b-8b0f-471f619e7980", "comment": "Malware payload (AgentTesla)", "value": "dde4f0eb2a54752be5f5881225f7f3f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919219, "uuid": "c51fe238-2653-4eb9-a5e1-31296734e844", "comment": "Malware payload (AgentTesla)", "value": "2c772497308a2a5839f12d5783de37818d95575fab41572371675a5d71a5d705", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919219, "uuid": "7d205ce8-66a9-485a-a6da-c76bb1ad610e", "comment": "Malware payload (AgentTesla)", "value": "3d4ef202b06bee0d7a44e254c267ca8ab60f238f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919219, "uuid": "7a776df0-34f3-40ac-9633-d0dd4ed291d4", "comment": "Malware payload (AgentTesla)", "value": "59ac71bcba1e4ef7571c47bab1839c93d6e8553ab883f08dd86daa3bd63ca4b68305414292c0b1f4f4dbd8e0c616905f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919219, "uuid": "2bea0af2-35f9-4777-ac39-18690ae0fd2b", "value": "T1E0F49E1DF11CE29EFD1903B122297CD421EC0CAD1D6CFA17BEA6B5E270AAD7A51F0056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919219, "uuid": "4690673e-fd15-42ee-a6ce-0dc44b068fd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919219, "uuid": "ba6f0052-ce87-4010-b72e-7e1ea5676b8b", "value": "12288:I9BTAgI8O06RmEOQnA2fgatiF72WOv5feFKLlTwv80c4D4VHfQe6ZyWshg+qbZxv:0jXCP+FCvnqD4VHfQe6ZyWshg+qbZxTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919219, "uuid": "15ee897e-daf1-44a8-a0b5-2ac79cb2d48b", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919219, "uuid": "0155d215-02b2-4f7c-8b55-7ff2402f8789", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919219, "uuid": "cc57d6f3-c09e-4ef7-876c-0bb286d5fa12", "value": "3xPM5BwYvQVewuv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ade6e9c-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632919600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919600, "uuid": "529c370d-1c7b-4f71-8e8b-0dc30e260ca8", "comment": "Malware payload (Formbook)", "value": "6d62dcb582ac4dcd944c44e1a004b182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919600, "uuid": "360ecf39-64c5-4f09-88a2-36eb31d253a0", "comment": "Malware payload (Formbook)", "value": "2d004b934e7508e13159e81f394f80e254d8ddbe0298be23f30690282a01d217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919600, "uuid": "a6d2fc08-d26f-4fc9-adf4-e83c5a679bba", "comment": "Malware payload (Formbook)", "value": "13ab24eba2b10087f38f546f6731222c0c0b0477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919600, "uuid": "73fe51a6-6aab-442b-a183-14e4c9dd37e3", "comment": "Malware payload (Formbook)", "value": "ac944bf0c45fde85a33d5f9fae30acf203718608bc029699eef1df3c6166f2cf642b290d88e1c284b9299bcb6ad9d4ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919600, "uuid": "90722082-45df-476f-aa16-8a9fd52436ea", "value": "T14CE48D6DF60CE29EFD0903B021257CC424EC1CAD197CFA17BEA6B5E234AAD7951F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919600, "uuid": "1bfd1fba-086e-470f-95fc-d546cebae9fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919600, "uuid": "5e658705-3931-43a9-970b-be860df1e310", "value": "12288:bD4VHfQe6ZyWshg+qbZxTZZWunAWvyss7K6LLhkcOKQRIupuUM8TYoAG7TtrpE87:bD4VHfQe6ZyWshg+qbZxTZZWunAWvnYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919600, "uuid": "8f012049-daa4-49c9-8b62-f046c516cbde", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919600, "uuid": "c85d2797-f975-4491-9564-53564157a2c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919600, "uuid": "710a0837-4a03-4cd8-8628-b0aae6a8c6a2", "value": "HPMT ORDER LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e680ba2c-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902252, "uuid": "b4ba20de-e804-4574-a646-62cc0bf23c4c", "comment": "Malware payload", "value": "218831930c2130bcef4f3782151a0c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902252, "uuid": "37155c68-01b3-40ce-baf3-53045bf84c92", "comment": "Malware payload", "value": "2d0ea75b6ec3c6f2931dddddfe633509be9e3fbef2e2bf069b0798ad3a6e9521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902252, "uuid": "aeca2c21-78f2-449b-8dad-6c40a237f28a", "comment": "Malware payload", "value": "18e31fc61b54be280799a59921b52892b4f9ae8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902252, "uuid": "2db348eb-8570-4990-aa3e-4522e6e479fd", "comment": "Malware payload", "value": "4fb069070b0b84389510343a75a6cc66f3bf9b4aac50c8d944b27b5001a624a9635adf2a6c94b40af82743afb00dc2f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902252, "uuid": "f41454bd-96ad-4bcb-a75d-b2ee6192ba39", "value": "T12B73CF11BF812E44E7F91B3316EC25D606AFBB8E9DB097CB682D89D84F37A1094D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902252, "uuid": "4fa769db-d593-40fd-9d57-1937cfbb3097", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902252, "uuid": "74192f92-57d6-4911-8412-ba3343921f41", "value": "1536:+S58WXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt961k9/gx1ia:358eSyRxvY3md+dWWZyGk9/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902252, "uuid": "41e31cdc-6009-452f-b84f-0cfd9ac962ec", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902252, "uuid": "b1cae090-08c0-485b-b56f-229117ff8cf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902252, "uuid": "779976fc-dc84-4485-8fe1-8ca821baf603", "value": "2d0ea75b6ec3c6f2931dddddfe633509be9e3fbef2e2bf069b0798ad3a6e9521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf5032e-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902261, "uuid": "7809e970-8be8-48bd-8196-8e32c3d4a93b", "comment": "Malware payload", "value": "1514da1b23e44818875be19ec7ae0dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902261, "uuid": "87a89607-719f-4940-a54d-898b2d92a353", "comment": "Malware payload", "value": "2d857a890b689cb4f67955c084e4673f1de1b1dacc7ab899de4c40b8bad39a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902261, "uuid": "677b16e4-e391-4fcf-a5fd-e31f3556b94c", "comment": "Malware payload", "value": "93dca1110db32784f998598a63f9df2d664a38c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902261, "uuid": "c08e5b03-8e9f-4207-af02-fa12ef721197", "comment": "Malware payload", "value": "163b9484ae0574e0f98c3881da21e597b34c4d238e5992ebba357a9b8a63eb38a97d91891bebf0976098307da2f5f72e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902261, "uuid": "d4fb3ac0-0ded-4ee7-ac62-67b15a390a51", "value": "T1AE73CF11BF812E48E7F91B3316EC25D606AFBB4E9DB097CB686D89D84F37A0085D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902261, "uuid": "1c71f87b-dc2e-47db-8ce1-d794e9e6a56b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902261, "uuid": "4dfb9ca5-4826-4ada-b255-0ec32a8a9518", "value": "1536:058wXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtN6j9/gm1F2:058oSyRxvY3md+dWWZyc9/gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902261, "uuid": "27bd30ae-4dda-4758-af54-05b405554c05", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902261, "uuid": "8acd5fd1-36e0-45a9-a90e-e242bae3f4eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902261, "uuid": "61f46af6-3fc8-4588-8558-067ef4be6705", "value": "2d857a890b689cb4f67955c084e4673f1de1b1dacc7ab899de4c40b8bad39a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbc9a59-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632919709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919709, "uuid": "5ffb006e-ab49-4b3e-8e2f-295872f6475a", "comment": "Malware payload (GuLoader)", "value": "25696e209cfdafdb8f0726aeb0134591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919709, "uuid": "40caa7a0-14ab-45c0-b57e-3c50a75a2a5a", "comment": "Malware payload (GuLoader)", "value": "2e9abde5f35005800a60cf25add0fea892fbf5ca1e46fbd71bdda447c5a563ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919709, "uuid": "4575532b-95fb-4bb3-af42-9a8e08293aff", "comment": "Malware payload (GuLoader)", "value": "6ceab01311132e682056fdf05a1ed3526b6e0922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919709, "uuid": "7e46ce64-bc6b-4ce4-b024-96a3ed49c3c2", "comment": "Malware payload (GuLoader)", "value": "ad037dd3f876fa36331efa9adb913cf901ef0f72d101f3bd81ef7e66ccb0826b80f0a8b9f3c772e3bf957af1189940e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919709, "uuid": "9006e9ff-e4c2-4425-87bc-d8624288d439", "value": "T11BC3AFC1B566FAA0EE4A0C3C48228928B1637D5146C23A17667F7A4D0CBFF8DBD57063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919709, "uuid": "c34c6427-4fab-419b-a0b5-0f00ca5a3d7f", "value": "474031ee85b355592e6b4f7d7327e399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919709, "uuid": "85889997-c251-45d6-87b3-b386d973c827", "value": "1536:43KFq0wSYncXf6quy6agBlFy4AajgRavDNz42TiJZq2v8HzErDL:tFp3vuy6agBlFNABavhM2Tiy2UHzEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919709, "uuid": "8098d6cc-f7e5-4c82-a68a-a7554d190041", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919709, "uuid": "6f3148f1-cb6b-4f49-ba5e-ff14a7a74a30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919709, "uuid": "4596a453-35c6-4e85-86b1-ba050836965d", "value": "Garnisone2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea4a085-2105-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632907017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907017, "uuid": "e2a1bf81-2cb9-4ae9-b072-5da7418612bc", "comment": "Malware payload (AsyncRAT)", "value": "b8ae4393f751610681ef2947fbda6e5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907017, "uuid": "45fca86b-5abc-46d8-8494-c5747e89a04a", "comment": "Malware payload (AsyncRAT)", "value": "2e9e908607cf5f2e839d584b96194f0cf64c66a788fcad12d9d31bd14d3d1415", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907017, "uuid": "ce874a54-98c6-4830-9e63-74b3df3abf1d", "comment": "Malware payload (AsyncRAT)", "value": "57d72e5623f085980ea8e7c4012655f1f8335035", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907017, "uuid": "93c4a098-c6c0-4d8e-87a9-afe9cecb3299", "comment": "Malware payload (AsyncRAT)", "value": "e3c1650b58f40ee83dcf445f16dfaacd63442c2c38e58f0f2ffe21957191469dbececc5661424f23d487ff47fe761f10", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907017, "uuid": "72c42f82-f3d5-4797-bb55-162f45db4c54", "value": "T11DC44B6DF60CE29EFC0903B121297CD425E81CAD1D7CBA17BEA6B5E230AED7551F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907017, "uuid": "df7f4e9a-313b-49d2-bcdb-4af60fe07d0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907017, "uuid": "d728621a-c30a-44c9-8e6a-9cf31cc1bdfd", "value": "12288:nD4VHfQe6ZyWshg+qbZxTZZWunAWvjLeiQJSSkTLP2qpsGQ0c:nD4VHfQe6ZyWshg+qbZxTZZWunAWvjJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632907017, "uuid": "d503d3b6-c051-4162-95c2-ecf6372ebb18", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632907017, "uuid": "43dbd704-73b5-4556-b0cd-f8a0108a6810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907017, "uuid": "fbfdff71-c6d7-4ff4-a340-f80895d2360c", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dfb747-2171-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632953170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953170, "uuid": "0f55731f-b14c-41e5-9c3b-a1742f3e6820", "comment": "Malware payload (njrat)", "value": "6d0941f64b7968007db7eef0a06a0cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953170, "uuid": "8804bf36-69a8-4c8d-8b44-2801e1dc11b7", "comment": "Malware payload (njrat)", "value": "2ebca90b91d537ccf128e52e55d48bd2ac2563319dc07f9435942c42df9a4d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953170, "uuid": "8b49d1da-693f-4272-b61e-1b942dc6aca4", "comment": "Malware payload (njrat)", "value": "0a9fe217013e7a27134ee5633f1c5e750b0604a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632953170, "uuid": "61121d66-0f22-4f18-942e-ef35aac7fbd2", "comment": "Malware payload (njrat)", "value": "4dca27436ac71d08e7a4c8f78c1aee2d8ad68ece09c71049ffca6c9fed5dfd9c53cfedbb829819db0fcdbb43e2b41861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953170, "uuid": "d2362205-8166-456d-9d96-f3cdff7d6714", "value": "T1D8E3824F9A9C2F9CEC2F25378164E14B27BFA4D74203879E1A8116E4CC6A2D97D7D483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953170, "uuid": "dc11e0d4-c0c2-4f40-90f0-88257278a6d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953170, "uuid": "c7b8bb67-6b32-4ab9-b890-8b4794a4d1d4", "value": "3072:aqPp7svdOIW+ICPMzV83HIxCmEIAVSfy9vqGQR:5hs1OrWQkSfy9vqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632953170, "uuid": "aeb784e9-e1b7-4c27-ad4a-7a4a9601ea49", "value": 148240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632953170, "uuid": "4ecd23d6-f50d-4fab-b96c-171a02fafbbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632953170, "uuid": "59c9db69-8030-4509-b7b9-67dadb8b00a2", "value": "2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534b1129-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902864, "uuid": "ac76aefa-e9fd-43e6-8b6a-327c5e2ab147", "comment": "Malware payload", "value": "80dd3e15017213c2e291dab4e6cd3dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902864, "uuid": "85993038-d8a8-43a9-b106-fc86f7934dd4", "comment": "Malware payload", "value": "2ffe713d4f23f0def795f78e44f51364bbb4a8c015099b0e49966d8791238c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902864, "uuid": "c92cfdc6-7f47-48db-b9f4-b262c30ae9cf", "comment": "Malware payload", "value": "1063d4464d91b8e9e1adc555ab42d596b17c6ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902864, "uuid": "a87eedc3-ba76-4830-8f6f-257b7c1efada", "comment": "Malware payload", "value": "f1fa6c59240b5c4f32520abcdc9df515e62032e1f34dd54b71a207381ef16a8523b43099173f02b44834331bd7424e66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902864, "uuid": "51e68460-569d-4e58-964a-97057bc899f6", "value": "T17673CF25BF421D48E7F80B3359EC51CA06BFBB89993046CE296E9AD80F37BC055E0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902864, "uuid": "5b2d2d79-7e9d-49ce-b2cb-fdee57042d66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902864, "uuid": "7a7c1775-64cf-4fc6-a670-bcb6ab26586a", "value": "1536:0cPWtHF3uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qtkk9/i:XPWtHFP3ZAtWDDILJLovbicqOq3o+nk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902864, "uuid": "d616808e-01dc-4c89-be5b-b598b412fe01", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902864, "uuid": "10958295-64cf-41ed-b55f-1a3072d1df95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902864, "uuid": "e31df2bb-fb29-4de4-94da-b4f76d270c72", "value": "2ffe713d4f23f0def795f78e44f51364bbb4a8c015099b0e49966d8791238c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa10e187-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900567, "uuid": "07f7a483-818f-46ba-869f-578e09b3058e", "comment": "Malware payload (Dridex)", "value": "20c9118d1be37f021bf25599d5742b33", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900567, "uuid": "ee0da2bd-7ebb-462c-8543-4879e0fedfae", "comment": "Malware payload (Dridex)", "value": "3026fecc147709dcc3f8969b0338338826bf30ed2fd103bec40af9f21faa42da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900567, "uuid": "c8825dc5-cd1a-41ba-8681-0a75a01d54e2", "comment": "Malware payload (Dridex)", "value": "4ecdb27c9493d927b74b1ddf19045426a7e16dd1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900567, "uuid": "8641769c-cf44-4ca4-9f45-883565062258", "comment": "Malware payload (Dridex)", "value": "e83cfdd45a6b617b189b89001033621aa4fa495d83e517b3c5c6efdc2b70bce51bdda24175154bd7f2d102939ff0e12e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900567, "uuid": "43d65325-908a-4479-9b6d-17c8b03eb5b9", "value": "T19F95D010FE69EDE6C6B59F3E9408352317B93D75030DA18CC391604F6EF82546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900567, "uuid": "6ef6cd11-abb0-4a73-a839-d19978118f1b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900567, "uuid": "5d945e40-5cda-4fb7-b6cc-51bdbd18f8bd", "value": "12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900567, "uuid": "02a0d0a0-9c9f-4e8d-983f-c6996de39879", "value": 2023424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900567, "uuid": "e8522ac5-18a8-48b9-b2cc-02ccbe04fc0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900567, "uuid": "7d697242-a4e5-42b6-bb01-9080fe2e0c96", "value": "3026fecc147709dcc3f8969b0338338826bf30ed2fd103bec40af9f21faa42da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4b2817-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901783, "uuid": "e2307eea-3b8d-439a-858f-663c4bd5abdd", "comment": "Malware payload (Stop)", "value": "8108ba038e091b2d315d19652ce576ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901783, "uuid": "8c717390-1e53-4201-bb1e-6b3566bd55ee", "comment": "Malware payload (Stop)", "value": "30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901783, "uuid": "91d463b1-2bc9-4a11-8bd3-b6ae800a7f0f", "comment": "Malware payload (Stop)", "value": "fa27cbc95b3f83589ea82eae8056b841ab960da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901783, "uuid": "44965449-03a4-416f-bd66-05b0880545f6", "comment": "Malware payload (Stop)", "value": "9470d5b1960679c7fb1dab9c5130cc888fbc49d42063a6ba4fe098bc55da87cbdc4c5c11b6a5d0f316d63f03095dbbeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901783, "uuid": "4d3cf27d-ffe2-4f7f-9c87-c8e9ec6065ef", "value": "T10EE412257590CC72C6F39A358530C1A1AA7E3932AAB3958F35150B693FE36C1AF35F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901783, "uuid": "b17b030e-64e1-44a2-a7b8-f926d99069a5", "value": "e0383fee3aa7c9c4dbf3a05a98d01075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901783, "uuid": "5b21d50a-0d4c-43f4-934c-897ffae44bf8", "value": "12288:7UYoq29vbOvEUkJiCKZdLtjED5cueOFxrGFI3V34fkMkkWMR:7UYmvbOvkzkptjE9cueyxrGFIFI3kkxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901783, "uuid": "408896f8-1b85-4b95-aca1-8ba5351fc41d", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901783, "uuid": "48016198-dbf1-4b5f-9e52-15f56438ed4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901783, "uuid": "b0e57c98-de88-4906-8370-9b1d18485e35", "value": "30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe945472-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632919902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919902, "uuid": "0741d7bb-655e-4fea-a501-d5b75e204034", "comment": "Malware payload (Formbook)", "value": "88937152602dfe2d4cc65885b173e704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919902, "uuid": "c11f8253-872f-42d2-a2a2-b37cc7b9de18", "comment": "Malware payload (Formbook)", "value": "31469420ecc53323634fbb276c40cb2614eeb8940b92bc31978956cf6f845b41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919902, "uuid": "e29f1c9b-af8a-4ebe-8ad8-eac341bb07f0", "comment": "Malware payload (Formbook)", "value": "14acefd0bccf2c2a41c81e2396ed03b4dcc28d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919902, "uuid": "a40b6607-b9f4-4b8e-a207-f5ad0a0d778e", "comment": "Malware payload (Formbook)", "value": "3123114293216df2537f7ba0c522e763614ee9e997e3fcc941444c8cab4420307787302abbe86ae85f84de8a8466958a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919902, "uuid": "d8b2db18-6f00-458b-9613-50db6dec5e06", "value": "T1F435171FB108E2BAFC0802BF2915BCC4D7A85C5978E8B51FBA5671EE21AFD3551B3052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919902, "uuid": "30106be1-f7af-4785-8f10-edfeafc6f4cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919902, "uuid": "678485e3-5b4d-4bc5-b23a-84bf1a4a21c6", "value": "24576:dD4VHfQe6ZyWshg+qbZxTZZWunAWv/ugYTpdzEaFOqNm6j:PfCEaFrNZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919902, "uuid": "58461b50-0e6f-4921-8ab1-15f1b149b1cb", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919902, "uuid": "e761e39a-89f8-4291-9abf-0d466f3393c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919902, "uuid": "94735b26-8352-4f45-b496-31b4bda2f7c5", "value": "PO#006555.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28e3036-2166-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632948604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948604, "uuid": "6f5789d6-fcfc-4b6b-9d4b-5d5d1ff973e8", "comment": "Malware payload (Mirai)", "value": "1cacbec482d6cd361332c0c000443e84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948604, "uuid": "e4e306e7-4dd0-4f16-a0ac-01c877f8c2d3", "comment": "Malware payload (Mirai)", "value": "31a7351e8567eb2029d2d3376b04f20ebfbd4bdbf4f349afae65c64e0f53ea88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948604, "uuid": "fa7ea497-f23c-4833-8809-757ff196e43a", "comment": "Malware payload (Mirai)", "value": "b75dee67f0e2f1ddcc846f64b5930f19deb904ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948604, "uuid": "a930458d-2dea-4300-9485-56898258f184", "comment": "Malware payload (Mirai)", "value": "9c44fe6ac9714f7c96b8fd8d498e18be5819eb05359b944082df5e4d238a23126b7962eb97c6bc7b5f67206e2c0624ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948604, "uuid": "f0a53c46-3469-4fa2-ab13-94c6842a542b", "value": "T10BA2E049E582AC67F8BD7132CF00EF818A816971629DA78CF6DD421334BB277E4209F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948604, "uuid": "0cfdc143-ec73-46e8-a000-13c7fa1d72f4", "value": "384:MHX206yHsN1UBC1N4ARkQNI/zSB/UQbOYk+SSudJnNyrJ:i2/gQtRk60K1CKyyrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632948604, "uuid": "06a1c6bb-d637-429f-8fe4-61b2db081cb6", "value": 22008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632948604, "uuid": "a71f5679-c7a2-4b2f-9ae4-b3b925e9ec73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948604, "uuid": "1273513a-a297-441e-8f85-41935ca3234b", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86195bf9-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632899084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899084, "uuid": "c7ac3a4f-ab5a-4ae7-bbe1-1ee0e04a57db", "comment": "Malware payload (RedLineStealer)", "value": "96aa164af51367cb80b3b60ff9d7540d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899084, "uuid": "2e102242-3beb-4cb3-ac04-4f2c229b0e14", "comment": "Malware payload (RedLineStealer)", "value": "334071b7eee35fde1773c48e13dd422a46fd68bc3511120883e8c7c822446bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899084, "uuid": "473c3faf-ed60-4524-8e16-ab6bef115127", "comment": "Malware payload (RedLineStealer)", "value": "59692c81aaecfc0ec383f8fe66b26f8f7a751515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899084, "uuid": "2732e23d-96c9-4f53-bbb8-6eb1ab70e19d", "comment": "Malware payload (RedLineStealer)", "value": "b4c8aadeed985a134795a5b3bdd2f0ea47c2cdebc02f4c35fe0122653b7505e751cd73a11ba8055680f0728d5ed0a6b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899084, "uuid": "a90288d5-926b-456e-816a-da66a28986e5", "value": "T154B5231873E99522E0F797BC7AF24B865B7ABE212C25C61EBB09254D4432D04EB36317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899084, "uuid": "62de3bf2-9f4e-406c-a508-bac61a26c1b6", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899084, "uuid": "9944774a-b84f-42e5-b476-bad29bc0ce5a", "value": "49152:rLM6d5nuDmZa3GHeUYgrChmNJFuPo9AS9FnOhIYyjXFRH:vMY5uOPYgrUo90hI7jX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899084, "uuid": "fb494f4c-9c44-478e-bb3e-e4480d4e268b", "value": 2428928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899084, "uuid": "8d1f251d-2843-451d-bd2b-c618a51316d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899084, "uuid": "f7e481f5-997a-457c-9eb0-2ea280a9e189", "value": "96aa164af51367cb80b3b60ff9d7540d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c53848a-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898235, "uuid": "88120a5d-b841-44f8-9f9f-67592c72436a", "comment": "Malware payload (AgentTesla)", "value": "8e7f9d39e74053dd75439c6b0313021a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898235, "uuid": "58793695-96b7-44ba-839b-7591d0337382", "comment": "Malware payload (AgentTesla)", "value": "33479e621225b6713bfe13e84fe5f2a3f1071f32cc2410b2a34681c744896a71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898235, "uuid": "6b770abc-dcfd-4b86-9ca7-8e84d1bafd4c", "comment": "Malware payload (AgentTesla)", "value": "b2fffd54b8416f53b29dfff8dcb26d870967620d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898235, "uuid": "4a278b37-152f-43e5-bfbf-0d48f63327ed", "comment": "Malware payload (AgentTesla)", "value": "e3f2b9b5ec60c6d637f42bcd77ca8661d82607ef1d2adfb2c4987b754b5c29cd34b1e21aa85eab563ea33d3e252d7ca0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898235, "uuid": "15e84a0c-00e5-42fb-b719-4f8c67ca0820", "value": "T1D6E2B501F5449370D7E15AF3B4DFF04CE26A9C2D022B998AE4547D9C2632B916FF962C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898235, "uuid": "ce88a9ba-e724-47fa-a34f-57e88f12de70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898235, "uuid": "32b08a8b-e4cf-411e-b62f-239062ff784c", "value": "384:cYISVRVpcFiOdpihjxbQEu4uL+r4Z9IMM/wpv1vNes+A:cYIiSFiODKb1g1a4db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898235, "uuid": "e235cefc-85c2-472c-845a-bd3d25cc8c10", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898235, "uuid": "c4f1065e-81f7-4154-9f76-4a4472811d95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898235, "uuid": "b3dd8ded-8569-49eb-9f6d-30a97a419eb5", "value": "Copia de Pago_ Banco Santander_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba6c64a-20f0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632897831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897831, "uuid": "18750147-e3d6-45b5-adae-960eb66c2f25", "comment": "Malware payload (AgentTesla)", "value": "8b7a4768414a9b866c76c4fdeb014e81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897831, "uuid": "8ccf928f-49a8-42a1-a769-867495c25122", "comment": "Malware payload (AgentTesla)", "value": "341b9b7512db317a05d5f640c6188556fa8303a559fd258512f6b3effc959fa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897831, "uuid": "3545808a-88a2-41e1-9488-5f58e6b8aec5", "comment": "Malware payload (AgentTesla)", "value": "3ac0d511a48fdc06c07b39a51cf8110a014e4ebb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897831, "uuid": "e8a227b1-1c05-4bdc-b602-afb7db6d4974", "comment": "Malware payload (AgentTesla)", "value": "b5c0809262c33ca82a653d72bfe35347da889f511b9436e1ce6695ec0a0f2b573c61c4405fc526bfcd638ee56cdd2a77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897831, "uuid": "2d690673-5995-4729-85c5-35314904f7c4", "value": "T11C6521394D1686F7C3EFC66CD04C0A8EDAF2A4877661CF19DC82D6C60297B0BE28955D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897831, "uuid": "9e844054-dd2c-4287-b804-8d4d35b7e848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897831, "uuid": "7724326a-f547-4bef-974f-304359da1379", "value": "24576:dK5UK8ln1hqHfaBUfOdM1U1TnO5Dh8YJJ:dKCK8ln1hqHfaBUnI+KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897831, "uuid": "00446133-1c31-44c3-aec3-003218f94295", "value": 1540608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897831, "uuid": "af3624c4-8d1b-439a-809d-e78590fc51c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897831, "uuid": "43927a7f-08a4-4c9f-85c0-119a3d5bbc17", "value": "Kop\u00edrovat_000394893903_29-09-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cdc1ed-213b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632929946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929946, "uuid": "2d2b6ff8-e935-4bf8-a241-acadde858e7e", "comment": "Malware payload (SnakeKeylogger)", "value": "1d6924a19986656d658c63d7d3fe2e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929946, "uuid": "b3ebbb11-b63c-459f-9255-4b7649ac6887", "comment": "Malware payload (SnakeKeylogger)", "value": "356e1df5b08f19fcb6ed70013861cc3f0f418a5db664dbc3c80e80c83f4b012f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929946, "uuid": "e97babbc-c027-4ce8-add4-27f6e47aa42f", "comment": "Malware payload (SnakeKeylogger)", "value": "ba079ebdafd2b34efa1d2e636ffa1fc126399bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929946, "uuid": "13c62b87-cf65-4787-906e-cf18a7026bcd", "comment": "Malware payload (SnakeKeylogger)", "value": "05acbb64da10c942dc37664d24c11953b753cde5a3433a5412fd44f4d8918d74eb60cde375c8ea723773848ca3f5db44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929946, "uuid": "24e736bc-778b-4455-bdc5-5bfc54a4416d", "value": "T191842391F1F664F7DAA324702D7BB2BDF373705601229A179BD44F3B6A5242B021E28D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929946, "uuid": "2881ca4f-09cc-4dd3-8dad-644f84d6c3e5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929946, "uuid": "6a6c862b-33c9-42fd-87e0-6560479dd6c7", "value": "6144:b8LxBBXsPUCr5/TRIoM9gWkwtr5BBj14Qr+dhqJFdrUs518wMXOgWTo6K6PAX/y2:ysMyTY9gQO7gvdrUsh2WzoyNosXmt/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929946, "uuid": "e1292464-043d-4fd4-a880-fa96712fd7b1", "value": 376210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929946, "uuid": "09bbee60-c129-4a70-a228-7d28364cdb9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929946, "uuid": "942f3035-191e-4599-81b0-98801c0856e5", "value": "237654345678906543256789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f88c8e5-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902455, "uuid": "59e57c72-030d-410e-9552-fa3e6224c572", "comment": "Malware payload", "value": "0cec167bcc462dfa280b2bd6fb3968f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902455, "uuid": "f98bb297-0237-43ea-ad85-7cc8bbf9c566", "comment": "Malware payload", "value": "36121ca2463629d488c08ea6beac8f05200d3ad851624e4fbec34988d91798ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902455, "uuid": "b5e4b58e-b331-4765-bf4e-1beba64e0309", "comment": "Malware payload", "value": "d6595d18912fc1de346232e16d78598d866af308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902455, "uuid": "d919d1ef-5065-4973-95e7-23a904449b9b", "comment": "Malware payload", "value": "3fa4340370dc7cab0480cd0653d867cb6f8f02a4825a6903de95cc24d3ffb7533daa1cdfee1b7d0fe8dfe33f35df7cef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902455, "uuid": "346d2881-8be9-4108-a062-4702a7cb9ea8", "value": "T17E73BF117F821D18D7F80F321ACC35DA0ABFB74E99705BCA1D2E99980F37A9459E0B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902455, "uuid": "59b04acc-caee-4edb-b2ca-98cd7979adeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902455, "uuid": "b0af42d6-2c96-4e82-9a18-1a5e87babd87", "value": "1536:CCHHrdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtqe9/81PH:CCHLdSE2EwR4uY41HyvYj9/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902455, "uuid": "6a46ccfd-18f6-4fe7-9c27-be393d6af2e1", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902455, "uuid": "eafe2b69-0a49-4575-bea9-7d7f29a48fe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902455, "uuid": "a6a0145b-f69f-4c59-bbd5-5a9ad19fd714", "value": "36121ca2463629d488c08ea6beac8f05200d3ad851624e4fbec34988d91798ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f5aa8b-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902655, "uuid": "229f78b5-9a9c-4c82-8965-c26b29b7f277", "comment": "Malware payload", "value": "ab02efd1d60c14e8b45120826c4dd392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902655, "uuid": "c3019cac-fda4-4a98-869e-640a8dc9165f", "comment": "Malware payload", "value": "364397e172864f00d62b630630355d8deb33af1b3932e08c00f79e28b5ed1aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902655, "uuid": "b52f0cd9-578e-467b-bc50-a832fe59cb33", "comment": "Malware payload", "value": "ba0f5a3b7ea442509b127be71dbfb5ade36c734a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902655, "uuid": "fd337dee-e08d-440f-ac9f-f1ee7817d24e", "comment": "Malware payload", "value": "ecd69c80e3e4690caeb843d620df0921ee9bdd51860fda8a02b6106c11c02c785a15cb597c91487ca6735a593a5be411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902655, "uuid": "20ce9b46-3d98-4899-9f95-d1235491905c", "value": "T16573BF11BF811E08EBF907371AEC24D60A7FBB5AA93057CE291E58A84F37F4159E0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902655, "uuid": "bbeec05a-03a1-49a5-a32a-575775370f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902655, "uuid": "70e63cc2-96bb-483f-8b63-79cde145b734", "value": "1536:ZRWtHF3cadnvZv0kH9gDuS+1H/kEEQL8exniQrl0MjwPzoYR+Qte6j9/4H1RN:ZRWtHFBdnl0Y9M+1f/L8unNrlBIxFe6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902655, "uuid": "d436fdf9-e05c-40e8-a025-2bcac89ed1e0", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902655, "uuid": "9491e710-6dc2-41ff-ba62-f91a799d1da7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902655, "uuid": "17f2422b-b2c2-4831-9feb-cdab071fe789", "value": "364397e172864f00d62b630630355d8deb33af1b3932e08c00f79e28b5ed1aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67c6138-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632885045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885045, "uuid": "ba5f908d-1fce-4d6c-bf6c-e41a5badca72", "comment": "Malware payload (Gafgyt)", "value": "9d04a18bed047b3e8bf1be55e98cda0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885045, "uuid": "0dfe1055-6309-459c-afd8-e8a9b688cd1f", "comment": "Malware payload (Gafgyt)", "value": "3884f84209ce34d6c5ba63f10eb57e699600f600941a611f48f7bf218888ea2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885045, "uuid": "606b31cd-4d19-48d0-acc4-02aaca152ffe", "comment": "Malware payload (Gafgyt)", "value": "deaa72036646d441b9b8c6f3d63ff979a67f4004", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885045, "uuid": "109f9ea1-88c4-43d0-b1e8-02d13fe1ed83", "comment": "Malware payload (Gafgyt)", "value": "7c3fd887d68b06095ad0a70dab225907655b8bbe8914ba240e6fb5563a0798cf65b2edb46ec3c437393dc31ee2110210", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885045, "uuid": "57e14f9d-5b4e-4877-bf4e-0b124dc156fa", "value": "T17EE32B05D550876BC2D327BEFA8E415D33222B78939F33259A34AFB42BC17AD1D39560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885045, "uuid": "b713a0b0-4c9e-4085-9c85-cfbaf7026140", "value": "3072:UcE6eZBgKW+azyG9kssd8rAGh3PQAjckmh/QfOYOMN3:UcFeZe2azyGFAGh3PEkmh/QfOYOMN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885045, "uuid": "07ffec1c-5203-4a80-b179-7baebab401b1", "value": 148710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885045, "uuid": "5dd25357-11c0-4e49-899b-470635e20b77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885045, "uuid": "6848f524-2423-4e52-8e17-6429418cb7da", "value": "9d04a18bed047b3e8bf1be55e98cda0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c31423-2151-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632939268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939268, "uuid": "94e77fce-2778-45a0-9f1b-54391f7900d8", "comment": "Malware payload (Mirai)", "value": "8a031820a066d22665f27b4201ef47ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939268, "uuid": "5e85f115-d749-4699-a6f8-0e7762af7cf5", "comment": "Malware payload (Mirai)", "value": "38bbccdcd38b43b76a3c91a77cf90af0f4310777adf221a6a09f1c3f5f40963c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939268, "uuid": "436f6e37-6185-484a-a05e-63d1d33f7847", "comment": "Malware payload (Mirai)", "value": "ca3e5ec542e09ffd4f9583bc47e4fb4704b18163", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939268, "uuid": "d0efbb46-dbc6-4319-9534-0f12237671ff", "comment": "Malware payload (Mirai)", "value": "f6513e2b27aa9e4421c8b934f3fde6a9b520463a2341bd964050cb40fcee41a333808ec7539788929591b41d0f5a38a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939268, "uuid": "65d9613a-7b56-4744-9040-2303d33a2dd3", "value": "T11F93AE23C9202D24C1058AB171F5EA369363951691CB3EFAD585CB6D7843DEEF226BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939268, "uuid": "aa2ff8c3-90a5-4777-b0b8-9b9f391d6abd", "value": "1536:4PxmkLbgX0FC5+KgedpyTd4+2XimOiPAqPwyCfwJhKVaw54JAag5hrs:K3bSJYXsyTd4ym/7PwyaVOAt5hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632939268, "uuid": "0c9951fa-63e8-4fa7-8555-e7acae8a2f86", "value": 91508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632939268, "uuid": "5e916167-0071-4745-9b2f-7f3b420e954c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939268, "uuid": "30411284-c98f-4f5d-9885-a3349314ea64", "value": "8a031820a066d22665f27b4201ef47ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a17868e-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632902795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902795, "uuid": "b9982b5b-d456-46b6-8016-89060946a5bd", "comment": "Malware payload (AgentTesla)", "value": "98e43788e6aa499cc6a80abd165bfb91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902795, "uuid": "2e521d23-b99d-40e9-8951-471b8adf9378", "comment": "Malware payload (AgentTesla)", "value": "3b35dfb35043d3f0778e6497d35beeae26db592b97e693ee586f96038d8f65a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902795, "uuid": "98d7f430-ec79-4108-9488-060db2a9206a", "comment": "Malware payload (AgentTesla)", "value": "ab636f07cd87d6b9db99f73d495b4aea6550d574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902795, "uuid": "e5b489de-ad3e-47c8-ade9-d6d7afbb8442", "comment": "Malware payload (AgentTesla)", "value": "fed4c7604d3f576aeb95d61710b5eac9de4aaf597479e36e52046c5f3bcca68832a97286ffa7ace411a8535428832d8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902795, "uuid": "a07548ad-cfde-4e06-b55e-aeb68826acab", "value": "T12784016DF680E4AAEAB2DEF2157BBDF6A7333D3880315546227F3E7A33321451512582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902795, "uuid": "a29140ca-d6cc-4d7d-afce-549b0ef11894", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902795, "uuid": "2c0514e3-2860-4eef-b1b7-639660eeebd1", "value": "6144:18LxB0rAWrBEzjRPe1yUsgkDl6kkVGcTWZZgjl/5haCfcI06C2d4BzMNH:JrCPe1yUslB6TzawZ/pfc5c4x6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902795, "uuid": "bd724c20-8485-40d8-8105-b9b883e33ec5", "value": 377849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902795, "uuid": "84e1abcd-db45-4552-a80c-374a73412d83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902795, "uuid": "f303c7ef-8296-403e-ae9e-28c9e295d0bc", "value": "Agreement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ed5237-214d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632937797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937797, "uuid": "dba9f639-abfe-4fd4-8ad1-9c11f04d7462", "comment": "Malware payload (RedLineStealer)", "value": "a84d4beb7afe8f90e2113efe20beb6b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937797, "uuid": "9f22e25f-c652-46d4-89ba-6eb946ac7315", "comment": "Malware payload (RedLineStealer)", "value": "3c15a476c92a73d481bb2633b1f155ab4cbc184cd66285faa34f913b3191f6df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937797, "uuid": "2c3ed029-6ce1-4c7d-ae2a-3abc77b47135", "comment": "Malware payload (RedLineStealer)", "value": "d3a5dfbe1e9f1f8153baea25d39361df6563e2bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937797, "uuid": "840a0cd4-74e0-4438-ae49-87c67c586073", "comment": "Malware payload (RedLineStealer)", "value": "7ef0085c0c9fcc3b30bab048d628278d9132e746c8fb82d1d0269dda99471f8b3bf99b2f0622365edf53208babbf72b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937797, "uuid": "737544dc-23f6-4ef9-acef-94d792cbc86e", "value": "T132B5232137EA5102E9F30F3AA8B603664F76BE925C36D51FF508360E1970E54E77A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937797, "uuid": "b0c0148e-29a9-4200-9de9-8f158d266974", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937797, "uuid": "18082062-f837-4af5-816c-f6cb49641f79", "value": "49152:Rb6wKNPdei8Q65QwXnCUo0JVqMuGxEMgBF9YLKy3fUeJpQ1wa4ypZgdse1yzHAqa:RSNPGQCQ7UoCHuyElPYLKyPDJsBpZ2He", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632937797, "uuid": "50e99ea8-2df8-43db-82d6-81bddd4e28f4", "value": 2391552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632937797, "uuid": "214057fe-edb8-49de-bc05-e3d4fb08a19e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937797, "uuid": "b4ae0daa-befe-4751-94e1-ee3910bca43c", "value": "a84d4beb7afe8f90e2113efe20beb6b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67204c1f-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632896455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896455, "uuid": "886951bc-6340-4d13-82c4-6828caca7f7c", "comment": "Malware payload (SnakeKeylogger)", "value": "9574dee23e2256c09c2db68d65a9e05c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896455, "uuid": "14c46f06-f041-4104-a3fc-b9dbfbf2fc58", "comment": "Malware payload (SnakeKeylogger)", "value": "3c2d13bed08fb1f1161870188f6e3bd192ff27f6d7d4ec51e81ba984cbab90e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896455, "uuid": "c034cb05-1ba9-4b2a-9f48-05203593b0de", "comment": "Malware payload (SnakeKeylogger)", "value": "e558b5631498f7035485ea8f57dc4e6ef02bcd0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896455, "uuid": "6343f119-5cea-44f7-9e19-e0ecb8a3490e", "comment": "Malware payload (SnakeKeylogger)", "value": "8ae163fc81d0fd1fa0872635a52abf63f2c202edc14c233682e4d6d1ce6750a4ce51e9ce0ff22fdd8d9e2d58457ceb75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896455, "uuid": "2121805a-547c-435d-bf49-d3a036a5937c", "value": "T1B7056C2AB60CE65AFD1433F02524BCC411E81C581C6CAA17B97672EAB4F9E27DDB405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896455, "uuid": "ce94c4c5-b89a-44e3-ada0-72d1aa58b039", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896455, "uuid": "7089a858-a69f-4234-a437-146a6136a8f4", "value": "24576:7D4VHfQe6ZyWshg+qbZxTZZWunAWvv3M3fI646mLdd7:pv4f1/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896455, "uuid": "54dd5d3d-a25f-4875-84e9-ffb624600fba", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896455, "uuid": "42c2b982-014b-4652-a1ab-a8b64d18a82a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896455, "uuid": "6b31662a-7a5f-4dd9-a128-41d90a7da211", "value": "QUOTE2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1161790-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (IcedID)", "timestamp": 1632903021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903021, "uuid": "0bffaec2-75e1-487e-b628-cb3281f544be", "comment": "Malware payload (IcedID)", "value": "0eba555b92d3fe517381d13207015089", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903021, "uuid": "c83f6f88-8fe3-47f8-9e15-35a7d277ef9d", "comment": "Malware payload (IcedID)", "value": "3c3024e4c2b075b12063e4af1bb3886d4e7ee25e8d1bb4fc52ea51535ab1e1ae", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903021, "uuid": "6dc82be3-4750-48f7-b5e1-dbe5b83d5f07", "comment": "Malware payload (IcedID)", "value": "8ff38fa6f072d07f9d767f991d9cc57c59030ada", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903021, "uuid": "51344d0f-87b9-4310-8e1e-ed3928d64172", "comment": "Malware payload (IcedID)", "value": "fa6360e75f89b5b08f5ccdf64bbc57925ec0defdf0de3029102be13e9f98a721b9c4be9dbf2e158e9db8a19c94312198", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903021, "uuid": "342aeb38-9d62-4c03-9db8-f79cd783663a", "value": "T183634C5FB3451772D78203B2370FADC6BB2A9475327A88D0546D805E232AE68D3FB395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903021, "uuid": "1e1c257a-8da0-42db-9a03-ec98f7b7c924", "value": "e0a50dc3fd59f4d700df0d8bd00d3fe2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903021, "uuid": "8ef2e327-92ba-4a79-9f98-3045454aec36", "value": "1536:SDNz2EdUapfw5SS0ZNjEVwzo/TgPMSMWr9C2:SDNDdUa111ZZEkoLgPtMr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903021, "uuid": "7427ffec-187b-4ef7-8057-ae39d5c84e2d", "value": 66914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903021, "uuid": "1716f97f-25a9-4afd-af3e-ad573e933854", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903021, "uuid": "69476d5b-7e0d-4a1c-8d04-fd5ea0be0efc", "value": "3c3024e4c2b075b12063e4af1bb3886d4e7ee25e8d1bb4fc52ea51535ab1e1ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbff506-216e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632952032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952032, "uuid": "ff10aa67-aa59-49f3-afb2-8b508e7f463b", "comment": "Malware payload", "value": "e170b1c343198f9cf6e34adb34d25d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952032, "uuid": "f9bc21a5-0350-4f31-b9a7-5a43a6c9e259", "comment": "Malware payload", "value": "3c939ee9e33c39b72fbb4ff7675bf096d390fc099ada3ee9fdad5ae7a6a43796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952032, "uuid": "3260094d-a415-4de0-b024-2c0b34ccb03d", "comment": "Malware payload", "value": "32ab87a3f79bdb1542ae3de73905d50c1744e875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952032, "uuid": "4bc1a01f-3c7d-4088-9489-20f4ad4fe78c", "comment": "Malware payload", "value": "99b61d613a84ca369f2242ba6796226c2a615850872b63e84d1301069171a250fab4f1a63008207bdc70812557a4a4ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952032, "uuid": "6ebcb730-ef85-4b62-b2df-d984f39ce3c1", "value": "T1D1029F5DBF05F6EAE9105CF3182C05BC49EBD5AA089B207048E6E91CCA064E7065F3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952032, "uuid": "01b69f04-6eb2-4ae7-9527-fe843eb3a66f", "value": "192:fTu2PzRurki7SLDLVpVovt9SbVySN6TQ3JuGpymy/qD1zX:flzEBkDOvTCZuQEkymy/GD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632952032, "uuid": "fef2201c-48fb-4728-bf6f-ae23299cdbad", "value": 8568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632952032, "uuid": "20ec2471-d729-4cf7-8d16-589132416a43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952032, "uuid": "01e5f821-d021-4fa6-a6ef-b7cbf4130265", "value": "SecuriteInfo.com.Linux.Siggen.4217.9548.8730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d4b310-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900286, "uuid": "a93283c0-f217-4846-90f5-67efb87dc794", "comment": "Malware payload (Dridex)", "value": "008cebea1fa780ef1ca2f9dfe6e7c38c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900286, "uuid": "92733813-781f-45bf-b71f-13c853a073d8", "comment": "Malware payload (Dridex)", "value": "3ca4d093eff4134162bdb3edcd6a32f3c12283bb356aa49732b42f8477f794ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900286, "uuid": "6e37f595-6c75-4d4d-80d4-7821057827a4", "comment": "Malware payload (Dridex)", "value": "7500893f024e6cfeeb9ed57bcb906e155d83b78f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900286, "uuid": "5e21509c-78d0-4474-9cc7-4ccabdbcdc0e", "comment": "Malware payload (Dridex)", "value": "d9728ecec202fe53aa2863864c2d40e84620c10792f368ebf39e6a5d8b47221b876b4a8f8e7076396e4a88d8a9e9e8c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900286, "uuid": "709282a7-9196-4027-84e0-0305f6e0351b", "value": "T1E6C5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900286, "uuid": "0c12c11f-458b-447d-9f08-3ba283da41d7", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900286, "uuid": "329f362d-f963-42ae-993e-aaefce49a51c", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900286, "uuid": "2f23c6bd-33ec-442c-a0c3-d2e2247c26c8", "value": 2498560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900286, "uuid": "3402416d-95cd-4bd7-82d1-2e34fdff969a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900286, "uuid": "8fa701cd-f7b8-40da-a419-61ba50f1f608", "value": "3ca4d093eff4134162bdb3edcd6a32f3c12283bb356aa49732b42f8477f794ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584416ef-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902872, "uuid": "bcc89dc0-85a1-4903-98b5-fa7cdf8e44bb", "comment": "Malware payload", "value": "4e9eb7419a53304c1828ed21ca76686e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902872, "uuid": "9d2c437c-6ba1-42da-956d-6c8873f14468", "comment": "Malware payload", "value": "3cf8dcb6225303d0cbb8c485727406129ae46d68f8c11883b4fbf5a2192e7ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902872, "uuid": "a58d1016-950c-4669-b846-3eff813e4a63", "comment": "Malware payload", "value": "7a981227e2ec3cbccb692137d33fa278579161f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902872, "uuid": "6db5f00c-e500-4d35-be41-c864c7f333a0", "comment": "Malware payload", "value": "a931c2e51fc9aa8e85e44acf8dc3eee795636350908cc5c0bb10cd09f07b01f6ca093ef9609c12456d9d4c0ad5650e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902872, "uuid": "0381da28-093a-4544-9945-6c26dd64fd6c", "value": "T1A473DF25BF521D48E7F80B3369EC51DA06BFBB88993046CE296E9AD80F37BC056D0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902872, "uuid": "9e89c0d2-a201-4a20-a348-0c2a729f842b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902872, "uuid": "50f5e7bd-b1ae-4001-87e3-2a606137c3ff", "value": "1536:mcsHFo6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qtkc9/7K:9sHFoI3ZAtWDDILJLovbicqOq3o+nkck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902872, "uuid": "29e24ea6-0638-4e58-b11b-256f1db3c4c3", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902872, "uuid": "fb115313-d4a0-4308-a546-e31e44ee3e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902872, "uuid": "9cba0c40-7e2b-4369-81ee-1aca8d4472f5", "value": "3cf8dcb6225303d0cbb8c485727406129ae46d68f8c11883b4fbf5a2192e7ae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc7fa61-2123-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632919816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919816, "uuid": "630f64b8-08b1-415b-b43a-a2957b8f12e4", "comment": "Malware payload", "value": "a4367cdb56cbae87f18a3a9a20c4e3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919816, "uuid": "b896e923-fd62-4635-a1f7-622cba60b07a", "comment": "Malware payload", "value": "3d151c342ac68a045f9f25904335e34e12b282dd165e44979ac3222bff5c9201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919816, "uuid": "b5556939-8cbe-4c74-9fd8-70a11a1eb456", "comment": "Malware payload", "value": "b8d5ea9d06914b14ebe1dd92317d7589aa312200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919816, "uuid": "3233aecb-2438-4824-90df-be37ca87be10", "comment": "Malware payload", "value": "43f752e028868b75916aefc4e82f6b9b85bb2af5d3b1c0961d84cfb4ae04fea53092885ee3ac517312c4382267f759e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919816, "uuid": "935c4b9d-44d5-4bca-a879-dff62e9ec78c", "value": "T19D848D11E28DC1B1E45A29B8B4AC936662B27D28177CABF3EF607F1895732D47C31D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919816, "uuid": "4110561c-e7a2-4ee6-a6ab-16afbc493386", "value": "547cd05356c429dc57b17bf0fd6daf12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919816, "uuid": "fd55dc8b-c47b-4e18-9d8a-0e4132c51d22", "value": "3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoO:JjqVG/pJZzfwsGX+LOODUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919816, "uuid": "7fe4600a-0dfc-41b9-92fa-9e825635626d", "value": 407030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919816, "uuid": "8c327e8e-0c7d-4026-a10b-bf1bed36d919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919816, "uuid": "1206da85-de17-4502-9090-4b7960e79401", "value": "doc.msg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d484046-2129-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632922181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922181, "uuid": "ccf2878e-a500-4617-af36-6aac081d768d", "comment": "Malware payload", "value": "4a9dad401a4015f8ff0607a22c8c5d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922181, "uuid": "d50979ca-2134-48f2-b6e2-9747e54fa7db", "comment": "Malware payload", "value": "3d3e30aa1a7ae5935e5eb048139163d1aedf06936feac660a5ce819422d80e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922181, "uuid": "a5ad99d4-6568-4bae-81d0-8e0d2b0d0b74", "comment": "Malware payload", "value": "b5743025758f3142c061a57035974d315e264a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922181, "uuid": "fb782a35-813c-44f1-98e4-28c89e5258dc", "comment": "Malware payload", "value": "d74ef00d0be3561b417ac4c4048074b708519e42384f7e3e9be9a7da6351afea96aee871710daa4f85de1c03645d881d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632922181, "uuid": "4eb837cc-2c13-4558-82e3-dcfcc82f5aea", "value": "T16942F8A0FF666F43D77D8EBA806B29204022E5712648D38B7DC07ED4D616ACD58477DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632922181, "uuid": "93ce31d0-c523-4893-a806-e3ca110e1374", "value": "192:9haDHic7NaeCswk9eUIqMlof/apL+RN7HCeVqtm8ohcshMT:9CNdXwk9hIqHnuiDiPoxhMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632922181, "uuid": "7d360814-42fe-4057-b2a1-fdb1bb1cbd27", "value": 12702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632922181, "uuid": "1600b259-85a0-468e-a752-998545cb09cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632922181, "uuid": "c7d3a84f-1f28-4f1f-b037-677b03dcab5a", "value": "4a9dad401a4015f8ff0607a22c8c5d28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbe7b17-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1632919870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919870, "uuid": "00ab4225-1088-4c8b-8ba2-997d36b54e7b", "comment": "Malware payload (Quakbot)", "value": "e5db9f07346ea0649a769c3649847f09", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919870, "uuid": "bba43fa4-b2c9-49b4-b941-c73392a460f4", "comment": "Malware payload (Quakbot)", "value": "3db836aa01204f3f894360b086384595b480b8c45472f97214d1676091851c9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919870, "uuid": "fc26cd30-5f00-47c2-88f6-6d32adca4b64", "comment": "Malware payload (Quakbot)", "value": "23e451605d5d61ef5333a52e984dc3e78670aea0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919870, "uuid": "cfd2740a-7af8-4040-9a51-b7b945050942", "comment": "Malware payload (Quakbot)", "value": "2c96b26e98dec82c29681a696aedec81a1e101e697d0b8c09d379981a906df9d0e46c88053b51785d5111c04db268614", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919870, "uuid": "48503126-0637-4667-ba46-1b4335f08e16", "value": "T15F945D407A59F525D2A85A368F5AE5E807487D09DFF9704F78D03F0F3ABA4A3C62530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919870, "uuid": "5ed02cd3-6c40-4e9a-8f7c-b4055ff18da7", "value": "41236dcb3f0ee486c9586fc42b5b299b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919870, "uuid": "a04830b3-6190-41d2-b752-bf1d19fb33db", "value": "12288:nvT1+i+eRbPqeSIvNMenaJ8bECkSNDopGI5coPYb:nv3F+ex1MrKECBf3oPYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919870, "uuid": "0b95a66f-470a-4b83-84c5-e33d91c8da3f", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919870, "uuid": "67c9066e-b5ce-4b1a-8b45-06188f3f9bd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919870, "uuid": "23c4eab8-88f3-4694-90fa-67b3e82126f8", "value": "3db836aa01204f3f894360b086384595b480b8c45472f97214d1676091851c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861915d4-2108-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632908103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908103, "uuid": "fb6ae7ae-9781-453a-b3e0-6faa8ec7b7ad", "comment": "Malware payload (GuLoader)", "value": "01a73a74c0f01ff769fcd5fcaae92598", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908103, "uuid": "061c97a8-bddd-489e-ac9a-94b0ddd15a2a", "comment": "Malware payload (GuLoader)", "value": "3dd90bca336828bb4832d955a81ccff768202342522cb480cdd85afbad92d887", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908103, "uuid": "5dcc2c91-5521-4b9d-a7bb-0a6d62b60575", "comment": "Malware payload (GuLoader)", "value": "833d4d95e0a6ca5150e3cc93dcc46d57e2d9954c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908103, "uuid": "3bdf50cc-8e33-45f3-bd0a-f2dc3f3ceb35", "comment": "Malware payload (GuLoader)", "value": "14f9ff339335b556470a02e90370b7fbdae47c3b3e6f3b914b3071748c848399e3ba3b57ef6537341275140dd17bccc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908103, "uuid": "d11707dd-8cb8-41f4-8fd2-514551892973", "value": "T1A4B33940F580EC5DE4904ABF84D28EF85521AFE6893147037395FEDC3B7AA8CEA1E255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908103, "uuid": "d2a667fe-0f2b-4f0b-95a8-d1615f146197", "value": "a587116cc4241097b364fa915d1c4c46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908103, "uuid": "e0b1b890-91a2-4b7e-927c-5fa81f779f07", "value": "1536:e0ekkZggj9rlDld1rZWuHbQXMRQ/cvnHGM:NekkZggxvZNHUdKHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908103, "uuid": "8b55ffe7-1002-4c8f-94a8-a0c0051dedc3", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908103, "uuid": "a53939d9-2f20-4597-9d9e-8e4af279abe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908103, "uuid": "0d37453c-2d4f-494e-b114-25ae9ae7ee9a", "value": "01a73a74c0f01ff769fcd5fcaae92598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6cb788-20cf-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632883555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883555, "uuid": "2c3a66cc-f4d5-4783-9bfd-08c9e2e7ac7b", "comment": "Malware payload (ArkeiStealer)", "value": "87c6113e8b5175bd3ecbd7e14e7cb845", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883555, "uuid": "9ca17fd4-9320-43cc-b83f-db66aeaf7a40", "comment": "Malware payload (ArkeiStealer)", "value": "3decf0329e1b897bb576210f182a3e9d1369613a117cb02d6e47ccaaa151c7b9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883555, "uuid": "2b6925cf-f29a-48eb-b7bf-45391f32f6a8", "comment": "Malware payload (ArkeiStealer)", "value": "d24d1e8536a89b54ac01760f86909daeb6790273", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883555, "uuid": "f3bf7d5b-60b7-44b0-a49a-4ff16ff1016f", "comment": "Malware payload (ArkeiStealer)", "value": "1c6312e23a680b4c543ea2c2b1f94e3dc34a20d5552bd1d3223432b24273648cfd968048aa66a67af0417bf34c635c43", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883555, "uuid": "d66bb750-aa5a-4e1b-8bb8-3398484ea5ef", "value": "T119E40110BBF0C039E0F752B9497993B9A52D7AF1AB29D0CB71D416ED5A296E0ED30343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883555, "uuid": "e74df81b-f391-4508-b05f-f2be66531956", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883555, "uuid": "a7f3c2e9-0bc9-4acd-b628-657ab8c4c8cc", "value": "12288:ILE0kn/f4kYpusSUHbPYjl3lVG4tw+uobszTUcwz3VxLxUMtIF25xV0/c/aiQ:IY0k343SUHbPasrRDzTUcwz3VFGMtIFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632883555, "uuid": "24e6232e-3cc5-498e-ae85-b00950c7755d", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632883555, "uuid": "03cc61af-c9d8-4813-92a7-45d8f495a13e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883555, "uuid": "f8231aa8-f329-453e-8d49-a9ae6fc4b170", "value": "87c6113e8b5175bd3ecbd7e14e7cb845.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd677bf-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632896493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896493, "uuid": "2345a6e6-d0fc-456c-835b-60c0e7fa54db", "comment": "Malware payload", "value": "20ebabf1b737d2e16a2290953d886320", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896493, "uuid": "48feb2c6-99aa-4746-80e3-d7e01c95dbb0", "comment": "Malware payload", "value": "3dfa5c045488b69407370bbe79536e6fc9e98bfe9e8ee744b4473b5e8f474766", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896493, "uuid": "dc7ccaec-f974-4f63-bfce-7b52b30e3b42", "comment": "Malware payload", "value": "95fe89caa549666a880dbd067a0d49ad712715da", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896493, "uuid": "e381b550-bf6b-4a67-89ee-32b69053b3e8", "comment": "Malware payload", "value": "582eade787643cbe75acd952ce469b2c4e735b2cfa8c145153cb12b1be2e9d570068e5d3ea8f7e0db7f7e35056af026f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896493, "uuid": "bd1387db-deef-4221-addc-84a93b23e561", "value": "T1EC845BD548D6E889F9A142DAE5C0F44D9411BCE47DDFDD28D278CD7722262B8FAC808B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896493, "uuid": "0f62f16d-da8b-42a1-ba4b-cb0a95948698", "value": "768:3lJ3T3kk3ooemziDyvgHvY4UXP8W1BEkc/GeZoJ0Oz9AgER+KfzQP8ZrS14s:3lZHVzGyvgHvY4Uk+BEJGeZEzCgEtjDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896493, "uuid": "b32cddf0-0085-4d66-8b34-7a2e470bfd34", "value": 402852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896493, "uuid": "ddbdfad5-22a4-482b-870e-f3306b7cb960", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896493, "uuid": "974ab195-8250-4c2b-90ba-fece89fd6b35", "value": "MT RICHMOND.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ae9653-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902272, "uuid": "77d48a1f-5c20-47de-a07d-c49b38974748", "comment": "Malware payload", "value": "d3306fea4b5b32867da933296ca0a203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902272, "uuid": "b2abc4b9-c5aa-4852-975d-7c1dea278a32", "comment": "Malware payload", "value": "3e4821dae8e506d8e283d035f4502f2c5479fa2b6fecf1d291cf681abd16957c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902272, "uuid": "02caabcd-e857-4c2c-b0dd-7eccde1fdff9", "comment": "Malware payload", "value": "90b681d2185cebf08412ef141330478b7bfbfade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902272, "uuid": "47a64151-6eea-4f30-85e9-c2acf9232ffb", "comment": "Malware payload", "value": "6423ee87ad70bb32aae0c1d6d39bb384f80911e724e605ff9a737b5264555e624df497b1860b172c95fd88f814bff621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902272, "uuid": "9fa3615c-30cc-41c7-b9b3-dbeb735773db", "value": "T1CD73BF11BF821D18D7F80F321ACC35DA0ABFB74D99705BCA1D2E99980F37A9459E0B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902272, "uuid": "87d7c629-a8d6-4789-88a2-5c08946c9d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902272, "uuid": "bc89c8cc-ef92-4783-822f-715974621fd8", "value": "1536:3RWtHHrdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLg99/A1r:3RWtHLdSE2EwR4uY41HyvYLg99/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902272, "uuid": "cf89357c-e693-4cbf-9ffa-23f12986a927", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902272, "uuid": "d1bd6da7-c436-45d8-a7c7-75c614232e5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902272, "uuid": "1ca6f1ba-30d3-4572-ac6c-2b2ba0cc0e47", "value": "3e4821dae8e506d8e283d035f4502f2c5479fa2b6fecf1d291cf681abd16957c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f18a3f-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632901951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901951, "uuid": "33dafdc8-f468-45b6-9795-b13525a98e8f", "comment": "Malware payload", "value": "7ba046a496ebd067598678cf4e3f1a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901951, "uuid": "066c0cbd-07cd-4221-8404-f7e6b63881b7", "comment": "Malware payload", "value": "3e61e4eb30e0f729eab579c2ce63994dabe84bd0e9d299e022b16ad243fe64ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901951, "uuid": "bdf5cb63-fafb-4da6-ba3b-9d2d3f4be415", "comment": "Malware payload", "value": "e2480987bb0b003374684ae0bbc607728d40b5ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901951, "uuid": "f6013812-2aa0-44a4-8b9b-de157ca81348", "comment": "Malware payload", "value": "be71dc1cff33ee66d8c179f91b879fbc808d45b498be80d8482c9401703749290c1ad60fe60f3b656e67e8befeccc009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901951, "uuid": "08c827cf-9bda-4d89-a24f-093e523a839f", "value": "T116E3F91E334D0BB0E42C1D36C4C720254BB1AEEF27B5DE936E0DB78A5A737951B68609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901951, "uuid": "2dec447b-4af1-437c-b805-32ad48a77e80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901951, "uuid": "c6974c95-f3eb-402b-b8bc-12b076be6cca", "value": "1536:f3ZAtmyiuh/bGQgogfUbgYd8/RGzdl5jkCYA:vZAtmRuh/bAogfUbvd85cVZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901951, "uuid": "757ade63-7155-4e2b-b0a8-3de24e231f5e", "value": 150227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901951, "uuid": "e36db14b-ad15-48cf-9e9b-e9ffc69f443a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901951, "uuid": "4e1526c5-c6cd-4271-9c86-ab3474b6154b", "value": "3e61e4eb30e0f729eab579c2ce63994dabe84bd0e9d299e022b16ad243fe64ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d095e640-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898350, "uuid": "86c7c49b-b49a-463a-bbdf-4ccd07d0e1e4", "comment": "Malware payload (Dridex)", "value": "2a6aba7fc5548f96d9fa34754d47fc5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898350, "uuid": "5ae95844-3ab7-429b-8d77-b75cf7818acd", "comment": "Malware payload (Dridex)", "value": "3f24346d5770bcbab007d79c9a6a4b9b29b6d232e32fc217109d0701d8ee5bb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898350, "uuid": "60934932-b492-4967-a8c9-cd3d7c497047", "comment": "Malware payload (Dridex)", "value": "47b231422d838a07aafcdb598792f7e9ea2b9604", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898350, "uuid": "6f2345f6-591e-40af-8901-f9b1ceeec9d3", "comment": "Malware payload (Dridex)", "value": "9c3b3f22273c7cab9edb001d12d0026fc60a6816b85050c1650c20cb9007992c60ab9ec6c0935f65a485549576b113f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898350, "uuid": "c728797e-ba0b-41fc-9573-8f1e56226f8c", "value": "T16426D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898350, "uuid": "092b4d15-b864-48b1-a76d-43730984ed12", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898350, "uuid": "7432fd69-2569-4d05-adb5-cfd37915a946", "value": "12288:UVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:RfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898350, "uuid": "953d17b8-7b1e-4b7e-b65f-5170677e989a", "value": 4591616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898350, "uuid": "b353286a-5b08-49a4-a466-c57a5f59bc92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898350, "uuid": "dc853bc7-6e84-4b24-8053-ab8570762b99", "value": "3f24346d5770bcbab007d79c9a6a4b9b29b6d232e32fc217109d0701d8ee5bb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99300b65-2118-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632915007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915007, "uuid": "dd724d5c-cbf9-4da8-b181-237baa1021d2", "comment": "Malware payload (SilentBuilder)", "value": "fa6369788a5f5490d4c506e65b82a166", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915007, "uuid": "97d5e408-87fe-4992-8bda-345c1a350c6a", "comment": "Malware payload (SilentBuilder)", "value": "3f3f21189390158abe6d01848ce995c762f3b0e908ea27192778effb160a6014", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915007, "uuid": "1f8eff34-1a0c-4b0c-a1d7-22a64d04d0e3", "comment": "Malware payload (SilentBuilder)", "value": "f12d615a708cd6e83c669e3a16c1bebbf2510718", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915007, "uuid": "df7af633-673d-4257-bce4-0a5f4238f1fe", "comment": "Malware payload (SilentBuilder)", "value": "a043e909331182b42768e532ece8d977679e8b28a2c2ffa8ff2312ac4d15411f91cbac0cf16b7417d84f4a29a4abe58f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915007, "uuid": "7c2e290b-82a9-47e4-b707-2543a67d5c8d", "value": "T16234E15AF175C849EE56473B4CD70B9B2376DC238FAF0247B681B211ADB1DB81E0624B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915007, "uuid": "9e1d92c4-df28-4910-80f8-41550f0c2782", "value": "6144:iKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgD9fWvcZZdtLq1JOjbwvOMPDslAvS3+Hw7Q:n9fVrLmUjbwvrDa33LvfH1WOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915007, "uuid": "6dd8d9f4-5b32-4bb1-b41f-8cb7029240a1", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915007, "uuid": "727c607e-02a7-46fb-a798-7dac829bc806", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915007, "uuid": "24267b08-3cd4-46eb-b475-997b1581c3cc", "value": "recital-1267320846.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f3b0ef-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900295, "uuid": "205cc159-1bb0-493f-a9bf-338604907b9e", "comment": "Malware payload (Dridex)", "value": "4425c056416f31ac3a62af66cc2d1ef4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900295, "uuid": "93162df0-ca46-47b5-a318-d303886ff044", "comment": "Malware payload (Dridex)", "value": "3f7e202697c0a18176cf2545d418e200f78023e13a63c7fcc8b1913ef79c4995", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900295, "uuid": "a9a4ab21-0568-40ed-acce-b40cdcfa847b", "comment": "Malware payload (Dridex)", "value": "2fd3f5ede5240a17962790bff198adbb75d543b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900295, "uuid": "d313591f-dd69-4ea3-9490-638f96408927", "comment": "Malware payload (Dridex)", "value": "d49a8ec10cf742529a629fb68775fac0c7a4db97dc011b737a5d605c6c774df980929be1ff55cd819b537f21a6c8bed0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900295, "uuid": "56968e21-2957-4014-b27e-065b574a5c4c", "value": "T113B56A10FFF205C3C09DF739789D3415A2B3AA65811F8A1D824F131E6CE5B912E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900295, "uuid": "7caa2637-fee4-499e-a79d-ddb33b5b4e7e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900295, "uuid": "9b1a6cd2-5782-4e51-80bb-7ab43dca6a18", "value": "12288:xVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1nQ:AfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900295, "uuid": "ad41610c-ceee-42d9-8e84-dab1ac30a1ab", "value": 2453504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900295, "uuid": "90d46644-13f8-478b-8468-f820b90d1ee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900295, "uuid": "61266e03-cde8-4ff0-abd5-a6144afc6b89", "value": "3f7e202697c0a18176cf2545d418e200f78023e13a63c7fcc8b1913ef79c4995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57773c2d-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1632899435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899435, "uuid": "46b018bc-054a-402d-a021-7bdac8a2406f", "comment": "Malware payload (Quakbot)", "value": "ebec2f5ac1e5f9d51d12ff7131795c35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama105", "colour": "#6451EF", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899435, "uuid": "d224d315-d2d2-4735-90c2-5615559f24e4", "comment": "Malware payload (Quakbot)", "value": "405e8907b3775351b266445fae051055a10d97fb89ed926b5fa083f32028f5d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama105", "colour": "#6451EF", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899435, "uuid": "8f0e6a1e-150a-4f5b-af67-9e4006baab1c", "comment": "Malware payload (Quakbot)", "value": "2c07ee3f23fd2a62373412d67ddbca312445d29e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama105", "colour": "#6451EF", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899435, "uuid": "72e31b93-e3d4-4719-83d0-820b164fd433", "comment": "Malware payload (Quakbot)", "value": "b64dc091ee72c6198ace60cb4e7d21a9e3a6592abbe210a53525798cb0e499d7422f1b9122743d6ed85da1f4dfbaeb5c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama105", "colour": "#6451EF", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899435, "uuid": "a76b1995-0f32-4768-97a6-fb5e5f648a98", "value": "T133448D7AFA93DC27E52C2B7193C34F14AA179AE13250250F0671DB256E8A7D47C32E9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899435, "uuid": "02996810-b71e-47ba-8b21-3ddf27eed669", "value": "8ce87900279a2c5d67be86bdc38f51d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899435, "uuid": "3e85d1fd-d812-4566-915e-cf57a3ab6f47", "value": "3072:0PQdEOItJPxluIalXQOr+nxQNBO0jTL23i7eBnaVImWeqSR4G78SYSuDSMv6UWo:MUr+nxQNBO0jf2Ee5aSzeF4DSY7Dh6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899435, "uuid": "c15a9a56-c4a1-40ce-b622-637f06240717", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899435, "uuid": "a32aa093-c013-4323-861d-fd1c110efbb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899435, "uuid": "aa36df78-6435-496d-984d-5dae5b3b57b1", "value": "ebec2f5ac1e5f9d51d12ff7131795c35.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58331687-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632896430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896430, "uuid": "ecc41120-df02-476f-b358-06093851ff3a", "comment": "Malware payload (GuLoader)", "value": "62a8508629f28f3f7c17c296097374b8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896430, "uuid": "280aa2b3-f563-4f7c-82d7-14418ffe62aa", "comment": "Malware payload (GuLoader)", "value": "406a9de8f5641a60a4f6891e4371e05aa6fbbec85ba4cc0cecb14ec22c1b7571", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896430, "uuid": "775cdf07-8fed-4861-9a23-ee277518411b", "comment": "Malware payload (GuLoader)", "value": "ff632f100b6bdcd06195b25e3e8ad5e4949c71d2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896430, "uuid": "58841ecf-af19-4f20-b4aa-c36c69d1e4c4", "comment": "Malware payload (GuLoader)", "value": "00aac5538764c39367b447cd0c03d1c7cf2ef68a947da653e52ae396c61e884c9933456d4611c4b67b54a84c4d33aeec", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896430, "uuid": "5a5baf37-3dba-4e31-9a0e-d4f7028ce592", "value": "T18794231AFACC1F82ED2FE5BA4C8908200735FC51C3E289AE5A1D7C1907BA75C853E55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896430, "uuid": "dd4c2fd3-b38b-4bda-8399-dc138343de49", "value": "6144:Nu9mxttgrQmAjxxd7dgb8Aw06vJIymmQix+oPrjsD4M6gB/KVYe:U9mxUMmAjxH7GnwdvJISQiNPb6Sqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896430, "uuid": "a6fed5f6-5285-4fa0-92c2-991811c25ed3", "value": 420120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896430, "uuid": "15e9fb4a-dca9-47ef-9409-75a690087322", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896430, "uuid": "887419f3-ca66-4b38-89c4-4b3f92b436b2", "value": "79032189.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5078aa1b-20b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632873653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873653, "uuid": "63080d8f-b82d-45db-b516-7fda31a80618", "comment": "Malware payload (Mirai)", "value": "3b18341643710a646f9a083525bc76fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873653, "uuid": "d84a07fd-4570-4f2a-9619-2cee9a152864", "comment": "Malware payload (Mirai)", "value": "40a0b0b7bb810e55c3c8717edb28e1cead736fd681b95e0d4ecba5c74636a702", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873653, "uuid": "6695fe8b-66eb-4809-ae6e-fa18c7dc0cf4", "comment": "Malware payload (Mirai)", "value": "a4862119abf8d59e52d0af68ff3fd49b2283b642", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873653, "uuid": "ae4a6a15-aab7-4056-b89b-4b738d9423a4", "comment": "Malware payload (Mirai)", "value": "7a6a136fca6a505d2be40ad7000dc9bc7dcc0ee34b1a24625a3c5c7edefe713b3390e277b528530b5b952f69a896b57a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873653, "uuid": "b90b06de-8863-4ada-9417-ad04eb9ab168", "value": "T17413F10482581785DFFD9A79398E4F0032B98FDB34685FA5357A52E38E4E42307CADE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873653, "uuid": "2c34ded8-9ac4-4532-973b-bc0bd4e4dc58", "value": "768:+xVfR1NMJ+u2/S5ThiT24h4MmYpOgp0s9VjQQpTBpF/n736A4uVcqgw09o:+bfB9u2/z2jcrzxFrf4u+qgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632873653, "uuid": "209b985b-c9f3-4b86-a97d-711635fc6581", "value": 43172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632873653, "uuid": "79a4a41b-8411-43a5-95a7-13c57de198ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873653, "uuid": "e0086939-5dca-44db-9827-fd78db78b2d2", "value": "3b18341643710a646f9a083525bc76fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d8c2d0-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632908824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908824, "uuid": "00600ff9-6729-4976-8f23-dfe4efbe50e3", "comment": "Malware payload (Loki)", "value": "2b3012f5ab8b76a5389c905f0bb3200b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908824, "uuid": "6dee60e8-380d-4d90-938f-25498b6ffb30", "comment": "Malware payload (Loki)", "value": "4125367a8f689dd1a812db65b45f019f739bba81c802c98ebed6941cec06d7cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908824, "uuid": "5c099002-30df-47af-81e8-c6c59054b795", "comment": "Malware payload (Loki)", "value": "1c6b0846a633fbe77c51037f632ed80d0aac0b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908824, "uuid": "721c3e4b-ba7e-4395-9b0d-aaff983c2d63", "comment": "Malware payload (Loki)", "value": "749873e25e9fc482908a47b156ef1a09f45cc9def229f61a24256b4352477456d52b8320cc5d2fe2ff8e07b9cf86f8f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908824, "uuid": "efe1c0ac-214d-474c-908c-283f32f3c0e2", "value": "T1C3E47B59F60CE29FFC0903B121257CC415F80CA9197CFA27BE96B1E2F0AAD7A51F1196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908824, "uuid": "fd6269cb-ae8b-47ee-9943-755fe37ea4ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908824, "uuid": "15e41c91-89f1-4867-a859-2bd6649a5bbe", "value": "12288:eD4VHfQe6ZyWshg+qbZxTZZWunAWvrKheCcurYM4rNQDsof8KwvC0BiNPyFe7eN7:eD4VHfQe6ZyWshg+qbZxTZZWunAWvrZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908824, "uuid": "c046fd45-ce9a-4c87-86c3-5704bfa2ef79", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908824, "uuid": "f5c1d7e7-d850-43b3-bb99-b7b41934242c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908824, "uuid": "19120a9a-82ef-46d7-85d5-ce36a27ca1cf", "value": "FedEx Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4597d7c-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927562, "uuid": "f979ff69-e29b-4561-947b-b4e5cb45c960", "comment": "Malware payload", "value": "b21e6be69f4aa560c4fa64d242bf71c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927562, "uuid": "4fa86cdb-0eb1-4ca8-af4d-480cad886c4e", "comment": "Malware payload", "value": "415e38a7bcc16b1753e462b6c67adcb675fab0dc21826e57dd2fc7c7d38511ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927562, "uuid": "485d868e-9b76-4487-b33c-d1300a9e0a86", "comment": "Malware payload", "value": "1e4049cec3ffb30e75d2c9b7e37e9e4736858613", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927562, "uuid": "00a7a3af-56c2-4d49-b1ca-1b626e8afbf3", "comment": "Malware payload", "value": "b8a57ef8572bb7305b1dfdd67e759bb176335b6bc157b7921a8f9805c3d48de1809ad673ed4a7bb6d1e6071ddfe523de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927562, "uuid": "dbee2664-cf3a-43f0-b1c0-0ef595528ddd", "value": "T19FB2E70A9552F1ABC9C352F2544F92F362408B465FE59ACF6E886CF0BF0A1D5667C223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927562, "uuid": "625fde3d-72ec-4cbe-b665-01688f9a97fb", "value": "4a8d018e31c39639b2152b7077292629", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927562, "uuid": "d2a73d8f-8671-47e4-976f-0edc426009f5", "value": "384:zt+65SU5r0uoCL4hV6dAbxnRX2Hm2RDvUir2nWwYAkoo:zt+65SU5rPoCLwTiroi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927562, "uuid": "71c965b6-d2de-49ad-be70-69fd614fcd49", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927562, "uuid": "04f0c91c-7e01-4373-b3f2-7cfb34e2d442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927562, "uuid": "fb37c587-d9cd-4a4c-816d-44e8417a7ec6", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.16151.4025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784a0488-2118-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632914952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914952, "uuid": "b8996e31-9d3e-498d-9201-a3f84218c8ad", "comment": "Malware payload (SnakeKeylogger)", "value": "777345b9b14d6428bfad1150a41fdc5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914952, "uuid": "545ad28f-70e5-4f4b-893a-1295b3fdd95f", "comment": "Malware payload (SnakeKeylogger)", "value": "417894c8dc4d79c866ddceb0a20b4ed7545c66b67b203568ee14497dad743f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914952, "uuid": "a32d1207-30e5-47fe-ab63-b6f02b8c9b68", "comment": "Malware payload (SnakeKeylogger)", "value": "f12f1729cd481ccb14c96a255e876496e64dd085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914952, "uuid": "ca570d28-c11c-48d7-b095-8419cf3bd757", "comment": "Malware payload (SnakeKeylogger)", "value": "6df891388b6f32b62e8d50e445eb1f76de89346c0a60b74cd1e4c162c80b62f1f750160d1ec90358df408f44e2bd720f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914952, "uuid": "25026d77-2222-4f20-9965-859079da0b21", "value": "T17CC1B712A7E8433BE0B6473869B3430177B4B9021A5BCB4D65D0521EBE2B7018A53FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914952, "uuid": "791f7b44-b671-41e3-8f5d-0294b3ee3d18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914952, "uuid": "33652e81-6ac5-4c32-8d0e-f8b78562510b", "value": "96:XjdM+w3Y+xWmBh4RNhbhdlioElYeIdGJzNt:XSvkRNh1nMlPXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632914952, "uuid": "e6941f7b-12ab-464f-85fa-98a9e376dbdd", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632914952, "uuid": "8fbff3fb-5c29-468d-a1ac-77fbb15bdc7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914952, "uuid": "c11c4ede-2d95-43f7-8a7e-98919d41c3fd", "value": "hesaphareketi-01.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d13341-2164-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632947771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632947771, "uuid": "244190c6-71c5-43b1-9fac-926229faff30", "comment": "Malware payload", "value": "cd9aac7328ff0fab3ecf04526126239d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632947771, "uuid": "fbe08b04-e762-4d48-a7d5-04db00f4c50b", "comment": "Malware payload", "value": "4246ab73c31c3720b1208a84e002a511dc5d6820f5b247aac6c8409f91a24054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632947771, "uuid": "b58699e2-5de4-4c11-837d-9856100cf44f", "comment": "Malware payload", "value": "5df74785c8997a0ca6131136649d149eb0b6669f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632947771, "uuid": "307a7ecc-dd79-4f8b-a4c0-8a7005d30931", "comment": "Malware payload", "value": "36429c905349f56ce3334933fa5b13e6dc98f2723210f592b4349f68b3e7632799f8ae25426676ac5fa00d69ac609226", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632947771, "uuid": "e6d3a4fd-6b93-4fdd-95bc-857cea6c046e", "value": "T178F48C5DF60CE29EFC0903B021297CD425E81CA9197CFA17FE96B5E230BAD7A51F0496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632947771, "uuid": "83311aae-b616-48a0-aae8-22d2083a5937", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632947771, "uuid": "3a8cebe4-75fa-471a-b4c2-0568fbd2a9c6", "value": "12288:gkD4VHfQe6ZyWshg+qbZxTZZWunAWvgoFdOdhpXPIyE7PZOsb5XYt6qtqZNYejev:gkD4VHfQe6ZyWshg+qbZxTZZWunAWvCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632947771, "uuid": "11e69798-45a2-4b37-a133-f471293b28a0", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632947771, "uuid": "0bad3d16-d89a-4ddb-bfa6-d3a88c103f57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632947771, "uuid": "2f59a14d-d01f-41cf-9f80-dd8d6d505bcf", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbd6186-2124-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632919977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919977, "uuid": "4f868e96-a1b5-4150-9e80-6fefaee8ff27", "comment": "Malware payload", "value": "841137c3e96dfb7bc473b34fc3440b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919977, "uuid": "942cc18b-4712-43d1-8c29-9bae5348284e", "comment": "Malware payload", "value": "42681e218de839d78ea1ef33380a5199349f54d6270b155cb8a4a4c74c6338f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919977, "uuid": "ece19554-04e4-4f89-a4a4-1b69fb8b2142", "comment": "Malware payload", "value": "d9bd625ac61e27931af03bbd3b22b07d7efe2b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919977, "uuid": "09180816-be94-49f6-8c1d-814806ef94d5", "comment": "Malware payload", "value": "ee1c1a6fd9f1085dfa33dc378bb06a17f4bd9dc598f4fa15111efccfd20d5da6d059a67632a6915957f8f4440ec1c668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919977, "uuid": "651c29bf-c8f8-49ed-bda7-96e9a07a3a39", "value": "T149046C63355441C4EDBE5972A91F982027F275BF86EAD64D24DEB32289E1333027BB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919977, "uuid": "3534ceb2-bba7-4e3c-8a14-e43d57c41c51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919977, "uuid": "abd03836-9f23-4171-850e-782804352f19", "value": "3072:z6e6APQlfHG1ncAmEQ9zBUktfA/Ady0Jan7rEBtCGmt+SAhcZRNUYQATQAz:alfHaZmr9zB3RJa7rIIGTSAhc9xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919977, "uuid": "1db1648e-dee8-4168-8d41-4eccee6e76d3", "value": 176016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919977, "uuid": "0d0d3c7a-fd37-456b-9dd1-48f4e589cefc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919977, "uuid": "c8d77d04-19b3-4de7-baa3-69f0d3654cbf", "value": "PO458098689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55898218-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632919618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919618, "uuid": "9bfe1665-0caa-4169-a8a2-56579ad0a742", "comment": "Malware payload (RemcosRAT)", "value": "3397e0e3128bb90a1b74c58688f06c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919618, "uuid": "2249aa8c-2b0e-4bba-84ed-7993b91f0bae", "comment": "Malware payload (RemcosRAT)", "value": "42d7b502dea09c3cdb997873cee2edcfd5ff84059735faf712111ea5542a065e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919618, "uuid": "0db60bbe-05a6-48c3-8b84-146e5a4cd42d", "comment": "Malware payload (RemcosRAT)", "value": "f23d4ec399fa9f5cb781742f8d1d7c451ad2adcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919618, "uuid": "d353202b-34d4-48fa-bd07-23a41f84d9fb", "comment": "Malware payload (RemcosRAT)", "value": "f422a6c9cd984bbaf9bee6ec812a7630c25b36227da3b7a15a879c4674437b3d87e83a74c454e0fe6bc035850ec26874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919618, "uuid": "37bc9401-8e91-46c0-9cad-58a081a143ba", "value": "T1A5056C26F1C15CF2E321273C8C17299454AABFB4651C748D69F97E323E792C1683AD8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919618, "uuid": "c3cca336-7f5a-462c-97b5-04bdcc9237f3", "value": "f0c25cd198950ba1bc931e9bf4f4e5f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919618, "uuid": "d1115e0d-b8cd-4853-b912-09513d4ab01f", "value": "24576:C7FJ/5KIXmNwWZsUraU0Qcwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww6:CRKFpZKMVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919618, "uuid": "f4725e47-f65b-4282-8e63-8038d294b59b", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919618, "uuid": "1f628b7f-9b2c-4219-8137-dc5caa7e7dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919618, "uuid": "41729fbe-9628-40a5-81e5-3d4e90d9c66b", "value": "Shipping Document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d99188-210e-11ec-843c-42010a9c0014", "comment": "Malware payload (Amadey)", "timestamp": 1632910579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910579, "uuid": "843e762b-f7e4-49b7-9fec-8429edfa168b", "comment": "Malware payload (Amadey)", "value": "3c76e12084f57410323212b79c24a4ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910579, "uuid": "c9a8e566-9e3c-4f0b-b223-3aa01cc825db", "comment": "Malware payload (Amadey)", "value": "42e369c8a08e42bb7ca81f3b4598b1352766fd602c32adc21cd5f1afab85f7f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910579, "uuid": "336298a7-0c0a-47f3-b86b-6a5fafc457ff", "comment": "Malware payload (Amadey)", "value": "c2663a2189440deae7a3826109bceacaea3a99d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910579, "uuid": "8d5cc178-a2ad-4a02-9a54-71dd13be33fa", "comment": "Malware payload (Amadey)", "value": "ae2d2d9d1f7067111f77fe16d03b8a3cd6baac618a4575b11e231d56bbce8d78fdea7370700f7e908e65fd07d6accf0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910579, "uuid": "83c74c2e-74ae-4011-9360-ccc9a50dd59a", "value": "T10D76F130768BC52BD5A605B15A3CDB9F5128BFB60F6250D7A3E42E6E05B48C35332E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910579, "uuid": "254c1c60-e144-487f-9895-773b24f60e3e", "value": "0ab020de3096b6aafb4fadfac4d16825", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910579, "uuid": "348251eb-cf98-4150-b1b2-7237cc5c8175", "value": "98304:LH7CgqLPRPYv7cZuwYx72XPo0+XH6zVLexfY+/1P6w0UYv6M0kMfRG1DOUYeixTA:b+gqLKB2pUca6+NP6yYbUGbYemTENFZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632910579, "uuid": "5f3a7279-f0f5-4cfa-8e7c-bc4495287a03", "value": 7513112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632910579, "uuid": "f26749d4-9312-40be-858a-d2bb98ed2e9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910579, "uuid": "86a50749-daee-4d6f-b4c2-e78de27959fc", "value": "3c76e12084f57410323212b79c24a4ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a860adc-2157-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632941933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941933, "uuid": "f4fd3bb6-f1b6-4700-a8a6-bc26c1cb3925", "comment": "Malware payload (Mirai)", "value": "b9ce9894408707c7d6b49acc57d2c7cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941933, "uuid": "1bfb2c34-95e2-4d75-84e9-de11a787b7e4", "comment": "Malware payload (Mirai)", "value": "432686dd33fe9a3812076944c86afacf8916f8bf844fb3ee6a1570629eba7a78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941933, "uuid": "d13bb85e-9a33-4ae9-b4ae-0224154e1508", "comment": "Malware payload (Mirai)", "value": "80955c7bb5f9c72dcae66f8701410072ee872bca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941933, "uuid": "582d1139-649f-4ca2-aa92-2bab8b04c9ce", "comment": "Malware payload (Mirai)", "value": "36d064da1651e86a9d1853d3b22dd30e5b98ff2b8ca483d0a83e591f832fca1ac9f830092f25884a6e7fc0affe6c1563", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941933, "uuid": "014248f1-8914-4501-90ee-72c7966c797c", "value": "T179C2DF22D0424E74D77945BA4C9A86C5BFE30E3BBE27CE7116D5B740943E83A2254FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941933, "uuid": "90d62fce-f803-4dce-9316-30c425c6b1bb", "value": "768:ZTGnf0XlOr6efViNFsJpeYu+4uVcqgw09Z:e0gLfCWJm+4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632941933, "uuid": "3c5a8aa2-4d86-4e56-946a-8a4efbb69422", "value": 26672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632941933, "uuid": "6236a150-9a93-4a13-a64a-ff3c67ee569b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941933, "uuid": "20bdc0c6-0436-451c-8e49-ee29f8e7594b", "value": "b9ce9894408707c7d6b49acc57d2c7cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24557b98-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632899349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899349, "uuid": "059c3b4c-02b6-4d13-ba6c-af813e7aa1e9", "comment": "Malware payload (ArkeiStealer)", "value": "0db3a82397ef8ab644aa25d2de29c706", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899349, "uuid": "a9125919-afab-4a23-858c-d142d5612061", "comment": "Malware payload (ArkeiStealer)", "value": "43280785b563edd0d7af1fb1041f15fd311b610b63bbc794f76f52bb2e7c6794", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899349, "uuid": "5652db23-a812-41a9-b5b1-9bf48b66afa0", "comment": "Malware payload (ArkeiStealer)", "value": "5e1b768610bab7a4478e150e0eb35da2ae844aa4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899349, "uuid": "c13afaa7-6851-4b0d-8529-49292fe4dd78", "comment": "Malware payload (ArkeiStealer)", "value": "f533242cc6d2feabef7e4f8d4b8efcd9747ebab563927117499316a54ce43c28b43d2241398f2e52fe6f538457f0e27a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899349, "uuid": "f4d838d1-5c1e-4039-a028-da3cb5831846", "value": "T14514CF01B290D2B1C711057EA825CBECAA2DB96DFFE1A6333B1466DF6E3D2937521311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899349, "uuid": "55502931-09af-4883-baf3-3b7d53d20bca", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899349, "uuid": "fa304f96-c77b-4418-9f6f-859648a47d05", "value": "3072:ZDFSK/uwKMVs54ZDj25W4c5kBh37KujK5HrcPI1ZeqL8EuSzsz:Zh5GRMVuCHa7hXrbjWcPI19uSz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899349, "uuid": "6f0ce1e1-85a6-433b-a097-e3a55810daac", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899349, "uuid": "fac20795-9519-4b59-995b-3cea9537a68d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899349, "uuid": "69db96a5-1693-4382-b1b2-33ac894b6521", "value": "0db3a82397ef8ab644aa25d2de29c706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f156eb57-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900122, "uuid": "d0583093-e9f7-4a25-859e-6932bb650035", "comment": "Malware payload (Dridex)", "value": "5c57019dd2ce2767b37ee1667f70038b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900122, "uuid": "992be278-f372-4a7a-976b-2f4d63ad4458", "comment": "Malware payload (Dridex)", "value": "433b530c8b0a457ae7a863e4a3c70c80b2df4c9497e3d2833351faf2b19dc0ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900122, "uuid": "07f70312-42c6-43c8-86b9-7087d877e95a", "comment": "Malware payload (Dridex)", "value": "8836955d49793656d0cd2954cc08b693ff96ca06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900122, "uuid": "24c7b575-f0fc-4f26-ba3c-039071497e5b", "comment": "Malware payload (Dridex)", "value": "060183bfc5a55af4da2d713d676587f6508e8503ce8e48233e76040c6ce331747069430eabee955d4e97c56a4767d754", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900122, "uuid": "6340ab37-b69e-462d-a491-6a8b8c687170", "value": "T10DF5D020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900122, "uuid": "5e18ed81-27b5-467e-b833-e41ff2567e6d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900122, "uuid": "705047d0-ff65-4eef-89d2-3db3c23e92dd", "value": "12288:GVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:bfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900122, "uuid": "732c144f-48f2-4b51-a860-2701687e6bb1", "value": 3444736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900122, "uuid": "ab4b94da-aeaa-4a2b-8bd2-9bdc13dfac26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900122, "uuid": "9a24a7a5-5ec1-4556-ad98-a2755401e25b", "value": "433b530c8b0a457ae7a863e4a3c70c80b2df4c9497e3d2833351faf2b19dc0ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b11e90-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898385, "uuid": "a6d560e2-cf07-48f8-b669-b349f5b40261", "comment": "Malware payload (Dridex)", "value": "16cd9ca83ea24c7aeab0bd027cd469db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898385, "uuid": "3e3d0e85-b300-40c4-a14c-af472e35c0ea", "comment": "Malware payload (Dridex)", "value": "4398dfbb4af41f0a72f83a1dca4ea808082ef8f94e57366d268a3939554cb0df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898385, "uuid": "f798de2e-6680-403b-a12a-9e575316c64b", "comment": "Malware payload (Dridex)", "value": "53e8c8c903d6f23f53ef43d6b4cb231a4d012bca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898385, "uuid": "f668f6d7-3e87-486e-aebb-80f813f8b37f", "comment": "Malware payload (Dridex)", "value": "915dec37109bc7aaec1dc2e86752b4d6772b67831f96db59c13e7a5d54d4f9240605a26ec3e70436dcf417f547228fa9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898385, "uuid": "e69c1927-3e6d-4590-bf03-0f0c355a7b30", "value": "T16216E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898385, "uuid": "6cc23f81-f109-49fc-b721-32866a7c4281", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898385, "uuid": "48ac7928-dc73-4fd2-9343-91a64735711d", "value": "12288:1VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:sfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898385, "uuid": "33869224-3f87-444c-b735-2f75194d9112", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898385, "uuid": "ce6355d5-4f8b-458e-b530-ed7c113b0720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898385, "uuid": "604944c7-ba41-40ed-9f01-06bc4026c859", "value": "4398dfbb4af41f0a72f83a1dca4ea808082ef8f94e57366d268a3939554cb0df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daef60b8-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632902232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902232, "uuid": "1b1645c5-9682-40d3-990c-07c248fae11d", "comment": "Malware payload (Tinba)", "value": "74c25317e0dd1cdf3f9fefe551b65878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902232, "uuid": "eb80e7e1-3d5f-408e-a83d-df69eb8f88e8", "comment": "Malware payload (Tinba)", "value": "43b29cf8adf7e79e1c4043bb7003d63c26f735c8041a9472b267f6e4c3965f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902232, "uuid": "8a2116cc-8fa4-4bdc-b78b-c6f32b52b411", "comment": "Malware payload (Tinba)", "value": "8a1edd489017c8f10be25959b14b8ad52e20545f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902232, "uuid": "9e7cbcc2-b1ff-422f-a853-cd11432b8163", "comment": "Malware payload (Tinba)", "value": "b90b125c8462aa296fddb9d7e93ab878f8c71686badd1fb3ff58152f92f1c8f5df35a7ca4b80eb604ed7b24642a8d786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902232, "uuid": "8867a4a4-6dc5-43db-bb72-c700f3b3b77b", "value": "T110A32972E215E48BE857D8F39A19DD3124A33DBD98A0845E32D97E5C58B3AE30449F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902232, "uuid": "ac639368-0be2-445d-9631-783cc727cd91", "value": "fbfc7e971b9381e12ce92088c6ae4c7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902232, "uuid": "a9f5be4d-a035-43d9-8b95-318e39808c64", "value": "1536:kiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:kiyvRmQKTLs/ZrwWJjAqGct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902232, "uuid": "29c628f9-6212-4aaf-8aad-4317dec795a8", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902232, "uuid": "6a96cd85-c443-4d2f-88f4-a3c13665c5c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902232, "uuid": "7164ef90-c13c-4252-bed2-650b87613424", "value": "43b29cf8adf7e79e1c4043bb7003d63c26f735c8041a9472b267f6e4c3965f00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e27c2ed-210a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632908841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908841, "uuid": "c3f45b0b-3ca0-4a45-9138-061808b2a430", "comment": "Malware payload", "value": "6f5c7afdbab5034910cae6ebb19474a1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908841, "uuid": "0cc8f57b-c5e6-4431-96a8-45445b7f431e", "comment": "Malware payload", "value": "43f7485202ceb7126f1c6497d78aa21408cb1571e5d961b0e3071a9d0c22ef4e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908841, "uuid": "3813a306-7f0a-4f46-9700-590bf8b25005", "comment": "Malware payload", "value": "7d6585f3b7e0040081288f0fa9b601100e790398", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908841, "uuid": "e50471a9-a7cc-4a4a-aa11-c0d2dc31d46e", "comment": "Malware payload", "value": "fe22446c1fa11cc5cf0c44bb7ea689f9a73d863ec0c557bb85349753bcfd3c1796a7d51a451ad2155e63428f446d32d9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908841, "uuid": "cb90e34b-c040-4a1c-bb03-5b4c73684519", "value": "T1F3E25E43B262E951CBA8D3424F89BE649A3D389992336D5CD0B566C02C70FD3A64437F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908841, "uuid": "e62793d9-f612-44ff-be99-493cfe090617", "value": "48:oWw/Vsr5Ls1s6l7LP4V55Ams1s9OXPA5CVqIl:o5/Vsr5LKhl7LP4V7AmK+OXPAYVqIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908841, "uuid": "796f680b-2d06-41f2-a83e-535b66f504a2", "value": 32024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908841, "uuid": "aa94f4b3-5ab0-4c4e-a2f2-880b4a13aea9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908841, "uuid": "e0e3fbf4-dbca-40ad-9ec5-420b574208b1", "value": "VM.VOICE02-637.wav.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d534b8d-2157-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632941938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941938, "uuid": "43f4f7d6-30a7-490b-967c-b8b678ffa835", "comment": "Malware payload (Mirai)", "value": "577ea1f5f05b2b4bafabc1e2e9b1d249", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941938, "uuid": "50d1b4c0-147c-40ca-a8f7-0dc1b5ed7045", "comment": "Malware payload (Mirai)", "value": "443b213c37993139b2a4cff5559c407711d10e208459991b57e60117e223f730", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941938, "uuid": "3ea9b6b7-ecf4-48a2-801e-a05f502bace1", "comment": "Malware payload (Mirai)", "value": "1ebcb3a1e039f0260452fb499697be0ad14161aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941938, "uuid": "255eba3c-4295-4a09-9cb7-706a97003e7e", "comment": "Malware payload (Mirai)", "value": "0ca5e859af77497f0456dbd9f49127b932171940f1095dec90b3f26cfa76ab06e1ad7bca726852150f8c76b4bbc53ac1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941938, "uuid": "d54af654-b6bf-49ef-ba38-b4fd80a2f27c", "value": "T19F43AF32C86D6ED4C25D4278A9349F3C2B13D504A6971EF24E9A8A924047FECF6493F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941938, "uuid": "409cb7fe-5b60-4b86-a2c1-32057333f6c5", "value": "768:5/B04NLq+zKb5QmwDGajzQFSwtY8Ue6sedM+UvkE2SlrRQmCl3oxdfrJCu/+:5/qQLZWlfajfwtYdeldTlrRzlxBJCu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632941938, "uuid": "ddc0dc89-ff35-4dea-a1a2-d68603129ea3", "value": 56372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632941938, "uuid": "a954f535-48f9-4aae-866d-370413df10e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941938, "uuid": "47c5d4f9-5dbb-4eb0-8057-2a8d887db4b0", "value": "577ea1f5f05b2b4bafabc1e2e9b1d249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e0e787-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901145, "uuid": "35da7b5c-48b4-43fa-9145-f48b8bdc6e2e", "comment": "Malware payload (Dridex)", "value": "07852771bce8a44e24993fa67e4a700b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901145, "uuid": "c49b0fde-e2ea-480e-9395-746bfe73d149", "comment": "Malware payload (Dridex)", "value": "44d059459bddaa30fbda6536a0aac3275d7a4d5b4b7a198ba534a7e50f614410", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901145, "uuid": "9b539c10-13fb-438c-b3cb-c4b9fa95e2f2", "comment": "Malware payload (Dridex)", "value": "717442959ab22e804bdd8e926a4e06a4ea1fb884", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901145, "uuid": "b899d2b1-be22-4ba0-b302-b3a1373c03a6", "comment": "Malware payload (Dridex)", "value": "c3159c7a665d0b766b8db567e28f5824718ec0fac606d960c6f5374086967649e8741eee37e871d3e27299927576e049", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901145, "uuid": "d3452e26-77fb-4fff-b4a6-0114e2b2e2fa", "value": "T1C585E020EE69E1E6C6B89F3E9408352717B93D75110D60CCC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901145, "uuid": "9f481058-61a2-45b2-8f19-d1014f5ac1ee", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901145, "uuid": "fe5cadb1-d3be-4c96-9da8-8b3c3973adb5", "value": "12288:gVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:FfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901145, "uuid": "d3174ed7-9f0b-4cf1-a7be-71e80de109c8", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901145, "uuid": "6ccd4ec5-9aab-4c5c-a98b-5931c0cd8574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901145, "uuid": "8eeda73b-06be-4a55-9a99-e1aeaf75c0ab", "value": "44d059459bddaa30fbda6536a0aac3275d7a4d5b4b7a198ba534a7e50f614410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c2ace3-2151-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632939377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939377, "uuid": "1f91acb2-96d6-4d32-ad28-e655be68aa43", "comment": "Malware payload (RedLineStealer)", "value": "4c8981a97340a3fda39eed92155fa9a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939377, "uuid": "b694f2d1-9deb-4cb3-93e9-8ec9269dac86", "comment": "Malware payload (RedLineStealer)", "value": "44e29e5cd002e8d4d4f13432847f38fa79a1667b5fdef9b9f316c3501f3bb480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939377, "uuid": "5c7e20d9-1403-4f37-b8e4-3085a6d62bca", "comment": "Malware payload (RedLineStealer)", "value": "177e5559c59ee4896a45f43e1601fe91a41cc14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939377, "uuid": "6ebf3405-b639-4cc1-a0a3-3f436bdafb6e", "comment": "Malware payload (RedLineStealer)", "value": "a566181697373c6ce89523e429601e967f863949bda6a65e8f66ddc23fd5ca99df4ebfc080d93f02f2880cff8ac7c6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939377, "uuid": "d93a2908-cef7-410e-a158-d74cf984810e", "value": "T12124BF01B6D1D9F2D71545328CE6C6A4D62DBC6CEF3096B73B8416EF9F392D19A22302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939377, "uuid": "6b4ecaf9-1023-4b98-9a5b-c6dfdbcda237", "value": "ca5041463b2dd933d009ca1aebe1423c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939377, "uuid": "0693ad59-cc6e-459c-83b2-ecf0596d562d", "value": "3072:USAC9sRLneWyoEm5YFppV5nyrcPI1ZeELLQvNe5RHZFS4sz:US1SVneWjufccPI11L4e5R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632939377, "uuid": "4e66f9a6-119e-420f-930a-13b3d6684909", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632939377, "uuid": "098a7cea-9d28-4d84-8d97-1ed5a70e7d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939377, "uuid": "a13ef006-bff7-4577-afd3-1011a09fa404", "value": "4c8981a97340a3fda39eed92155fa9a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b0df58-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902391, "uuid": "1c35a973-92e0-47ff-96af-0c5718693daa", "comment": "Malware payload", "value": "6c4799e78bef6cdc5d42d2674c37ce84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902391, "uuid": "c4819bda-a4e9-462d-b7b4-439f81e000d2", "comment": "Malware payload", "value": "457a4af77709097e294ec5bf840cf629ccba24702e1ede2a42765a7c9f5ea447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902391, "uuid": "536a0583-a8dd-4c49-9d42-c767a93514b7", "comment": "Malware payload", "value": "d29db78940e90134323ba881d24af1ab06fc00aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902391, "uuid": "524c224a-9a0e-49cf-a00a-79bbbcdad47b", "comment": "Malware payload", "value": "353ff17465fc9d996f68308aad674d97a88fd3ddc0bbb72ce369daeccb38c34dd1b28218decf1a422e3affb6bbb4a074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902391, "uuid": "5add7d4d-9562-470b-94a3-a23e2ad4fcd7", "value": "T1BA73BF15BE810D08E7F80B3205EC65CA067FFB4EEA7057CE5D2E65982B37B9059E0764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902391, "uuid": "93876286-19e3-4148-8c95-18f46a589d0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902391, "uuid": "4f40cde0-573b-489c-8e41-fa27c377eb2e", "value": "1536:uc58Tdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC67g49/O1LG:uc58yn7N041QqhgjN9/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902391, "uuid": "6968920b-1ad3-4c11-9df0-ef9c2ac2ac20", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902391, "uuid": "ab2dbef0-6f55-46b5-a6cc-07c8b297e51a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902391, "uuid": "df063d8c-d7ea-4c9f-b782-6ab13f4e48f6", "value": "457a4af77709097e294ec5bf840cf629ccba24702e1ede2a42765a7c9f5ea447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f976b8-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902330, "uuid": "157dfd96-9015-4489-93e6-bf5b45c75c8c", "comment": "Malware payload", "value": "24bf59dde1196be21d5f2353f2531bdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902330, "uuid": "c25d8714-7a98-453b-8a17-6a3e82c4b710", "comment": "Malware payload", "value": "45a218d712b4465f4364e95598ff94fb90893f5e705f2069440de523030ec929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902330, "uuid": "eeee3075-820e-4c2f-8452-11e5580e5af4", "comment": "Malware payload", "value": "96204b8cb3d07277c71ef6b5fc0e9bff51a9a7fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902330, "uuid": "22c5eeca-a368-4011-a484-e1a19bcd8f41", "comment": "Malware payload", "value": "1b2fc9d9b7bdc94eae4daed0e2737e21082d4429a1bae6b15618b55b9d35d84576e358a0958f2e6f0ca181e1516e40ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902330, "uuid": "e80baef6-8ecf-42cd-8eaf-9a1e54944171", "value": "T19873C0325E811E18E7B94B3725DC25DB0BBFFB4EAA30528B281E19CC0B37B8555E1718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902330, "uuid": "521fbbb2-ca5a-41e9-99eb-a497234df7fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902330, "uuid": "3c405817-d226-442e-b98c-eb03d22f06bf", "value": "1536:pRWV5jOVdv5wyFppaVs+aYTCgtWzYXxxiMrBnP5oYZNQtC6P9/e01MA:pRWV5jO/vqyA11XYUBxprBPjcn9/e0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902330, "uuid": "b22b152b-32f4-4355-9721-adf94e7ae817", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902330, "uuid": "d5c89f39-57da-4cff-a6c5-c028b0036022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902330, "uuid": "9043abab-5860-4fb0-804d-339c11c8f85f", "value": "45a218d712b4465f4364e95598ff94fb90893f5e705f2069440de523030ec929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20b66d2-2121-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632918995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918995, "uuid": "eb6f66dd-8d2c-4696-ad8e-adc14adbe44d", "comment": "Malware payload (AgentTesla)", "value": "0cd686d229ac2d3b65d125c585480e38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918995, "uuid": "8f0beb92-4211-451d-9f27-4371227ccd6a", "comment": "Malware payload (AgentTesla)", "value": "45a94c022c5a3528accc736d685c467a95a9fd6aef4c26f8f52ee47f5b66cc0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918995, "uuid": "9b10c62e-506c-4618-b416-9da3277dd0e6", "comment": "Malware payload (AgentTesla)", "value": "0dcc278da17ea655160faf8c6fa4463f809d0133", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918995, "uuid": "3e8d1ff5-bbbe-4c77-a5b9-05284a7f0fd9", "comment": "Malware payload (AgentTesla)", "value": "6e758ec9c6b823eb84eace8875cff56ec804c4f5ff41cf77ab39c751f4779ff08a7eabb3c005e3303efd152f91bd39c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918995, "uuid": "ee15a132-6403-4a64-8911-788dfb404b3c", "value": "T10125AA794D2682F7C7EFC67CD09C0BCEEA62A4877A914F1EC492DB82165770BE08845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918995, "uuid": "cb8efc3d-f1b1-4289-9c73-879cf9b006bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918995, "uuid": "814e14ef-f11c-4106-86ae-bd737e45220b", "value": "12288:CrfqwovcUVo4jPCXabKgsB150lmRadAAY:5dcEjqX/bzClmyAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918995, "uuid": "edf0ee7d-c9a6-4ff7-a25b-604c32d1efd3", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918995, "uuid": "84d67464-c707-4af1-8879-fcf9ec6d0373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918995, "uuid": "5c3c3fae-34e6-40f6-a866-10016ce5acc2", "value": "REQUEST FOR QUOTATION CPH1-9001-BKG CPH1-9001-BKG(2) CPH1-9001-BKG(9) CPH1-9001-BKG(3) CPH1-9001-BKG(4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed52c80-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901165, "uuid": "e8e6772b-0956-4f21-b2a9-f0181200dbc1", "comment": "Malware payload (Dridex)", "value": "8d0b12dc946e0be0ed963437564553e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901165, "uuid": "e62830b2-cb01-4969-990b-77a7800d7dba", "comment": "Malware payload (Dridex)", "value": "45de9470fa1548a3de9555adebb6a09a9d21edb1280a72714388ae7976969fd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901165, "uuid": "1dc45ef4-926d-4c67-9a91-4369e0af06b8", "comment": "Malware payload (Dridex)", "value": "d9161829471825d339b55e79b121f55f1cbbba41", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901165, "uuid": "2e25f5ea-a463-4f0f-8284-971adb9092b8", "comment": "Malware payload (Dridex)", "value": "ee230993ddf4d2f2425bb603aa758200c67461a8a64825fc3a7ddf2059817439410bbb2d834c51e969386e16faab0893", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901165, "uuid": "36a1bd5f-fde6-4342-9e7e-3685251e072e", "value": "T12A856A10FFF305C3C09DF739789D3415A2B3AA65811F8A1D824E131E6CE5B912E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901165, "uuid": "7f42b350-ab02-45e5-a1ae-1c1a3bc561e8", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901165, "uuid": "a8d479da-1ce0-4e4e-9471-aa1b7a23bd90", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1hFuY:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901165, "uuid": "01df9744-e3a0-46f6-8353-0ae3d3a86c93", "value": 1794048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901165, "uuid": "3b02e888-9170-484b-bea7-3f9d9a86fe7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901165, "uuid": "2e5602a2-cab5-4758-b181-c0f9e6fdff6f", "value": "45de9470fa1548a3de9555adebb6a09a9d21edb1280a72714388ae7976969fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbe1fc3-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901751, "uuid": "dc8e3bbc-4875-4010-a90b-ca8f2e5d9978", "comment": "Malware payload (Stop)", "value": "97b5fb7dbd21b1bc17c12a9b2e823745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901751, "uuid": "d49962ac-3b65-40dd-a3a4-8f9624eb3cc0", "comment": "Malware payload (Stop)", "value": "45e1d742b3e10f3dbcf28ff2e4a8ecd819869a2a60330b0990f15fbdd329729a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901751, "uuid": "46cd0393-0697-4a48-ad89-b9fff025adcd", "comment": "Malware payload (Stop)", "value": "ea4d20350e8eb217bd107fe87cc769cdc52fb398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901751, "uuid": "b1c2885f-3c8c-4108-9d10-f7e7ade66057", "comment": "Malware payload (Stop)", "value": "8761612aed69bac8b06b28e87dc7e2e33dc4acd7a4f600eccd8e261f450ecf96eb5d07606b1bc8c3c2bc367fb8411eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901751, "uuid": "8b216815-9d8f-4366-96bf-d020ba30ce5a", "value": "T173E412507A60D032E7E286306971C3E19B3B39626C67C5CBF26C16DE0EE56D189E63C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901751, "uuid": "b7940370-b0fa-4c8b-9ea5-22c39ebee478", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901751, "uuid": "add84312-2905-4761-9f30-6d1a704068b5", "value": "12288:AjOJ/9gVGn6kwva4iNrMKCCoFgW7bx0loDnyMd1:a8gkwvFiNrM7CoFF7lpDl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901751, "uuid": "6e7c430e-d813-4a6b-b81f-d06bfee7f22c", "value": 714304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901751, "uuid": "6dfbf93f-cf01-4fff-a5df-a6a2a43cebde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901751, "uuid": "e1d116db-7726-4e0b-8460-df5c811b5e57", "value": "45e1d742b3e10f3dbcf28ff2e4a8ecd819869a2a60330b0990f15fbdd329729a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d97733c-2132-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632926020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926020, "uuid": "a4ef6dec-f67a-4f46-82e3-bc510f235482", "comment": "Malware payload (AgentTesla)", "value": "fcc33a35534d068f48789e638d422fda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926020, "uuid": "693e18f4-0dd3-4d28-a65c-81e95ce218f4", "comment": "Malware payload (AgentTesla)", "value": "47cffa57389bea3598a9e5b2390b8b54db4d426825396297b57a3dc362bbc456", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926020, "uuid": "ebf18223-f881-4d06-a948-62abf13f791f", "comment": "Malware payload (AgentTesla)", "value": "ef7e0757f2cbce9af4a2f82dbe989c49b92e7113", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926020, "uuid": "55a333d3-7e0a-44a6-878a-def6e6916555", "comment": "Malware payload (AgentTesla)", "value": "e1e6da66ebeb247efc3345bdb992002e3929aedcf5ffe111027d89d044b2ed95cda7e7b03eb888f91b9c09ae2ceffb2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926020, "uuid": "a17d809b-d52a-46cc-b276-6df3c9ba79bb", "value": "T1AFD42323AC667929F592BB77B438C3B93FCD21603702592B370E1A560966DD7436F823", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926020, "uuid": "4c665c9c-b3c0-4dd5-85c0-135760b73116", "value": "12288:TY8qyYbalbFWZHas6eVUD3NKYWUF5FXGJpaBN9YvD/TEIWIIyoudNBH0Ohid6AXn:TY7yYbalqv6bNKiFCpivY7g/zupXAXJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632926020, "uuid": "d0f79e16-3d71-45cd-a5a2-800e2f8d9010", "value": 627787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632926020, "uuid": "6968ccba-bba1-41c1-9b5f-d2daffa07e81", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926020, "uuid": "4dd2678f-3960-4e70-be7d-2960708261b9", "value": "BL-INVOICE SHIPPING DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202d4aba-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902778, "uuid": "b3adf9c4-0ce8-48b0-bf26-ce8a20b9a2b5", "comment": "Malware payload", "value": "a02bfd4f44600a59f55eef1ceff0ab33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902778, "uuid": "66c3594f-941a-4431-a600-9468361ff51f", "comment": "Malware payload", "value": "4824102de8dfad906c7f05f715916656258cc269d831bb2534061df460fe2630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902778, "uuid": "1037dffb-ac13-4a3b-9587-643446e20b01", "comment": "Malware payload", "value": "f1f03afc89c3c821fd898c03072fa7677c16ee8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902778, "uuid": "e4be8809-10f1-4c7e-9fae-3273c3db8b93", "comment": "Malware payload", "value": "fb4836108cab22f1fe9da6f64c4f6d3e04ec4687952acd2b236e30eca165525bf1b7ec24b5965c864f5a23ff0e1ef9e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902778, "uuid": "e16ae66c-d163-41c6-be12-12225958a71e", "value": "T18D73CF11BF811E48E7F91B3316EC25D606AFBB4E9DB097CB686D89D84F37A0098D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902778, "uuid": "2af83b5f-0d3d-4bab-900c-c9b5e895b99b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902778, "uuid": "32cb1d08-3fdf-4646-b9c1-ca41b31a8da8", "value": "1536:QPy58GXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6+i9/B1cV:QPy58OSyRxvY3md+dWWZyGi9/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902778, "uuid": "9809214e-3a2b-4862-927e-9149d8f6acd0", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902778, "uuid": "cb9ab4e0-b3e0-41c7-83a1-1ad5ce3fca6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902778, "uuid": "e00748d0-429c-4bff-87c2-05d73df11fee", "value": "4824102de8dfad906c7f05f715916656258cc269d831bb2534061df460fe2630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f619b7-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "1b634241-3ddc-44d1-a98f-f05f3957a06b", "comment": "Malware payload", "value": "c4069bea0586555109d037414d80d8f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "adbbf9af-23eb-49f2-8119-e3cb6cf07072", "comment": "Malware payload", "value": "487215f114ec707b550222a4d50064ecc13e99a4c961e12ac5411d09969bcdc9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "323edc7a-a0e5-4c87-a9cd-5fa4fb286901", "comment": "Malware payload", "value": "de9c29231ceaae918c2b7ddd24ebe731dd4a0720", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "b17ae972-172c-472f-83ba-21ace35ec238", "comment": "Malware payload", "value": "f6efc5eb6b7639afc17a567eaedc52d83b74c17ffd8abd02531a0d225f276b9b6e68bf1aef815b04516dcf2f52d2831a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "3ac12fd0-cbd4-4785-8a49-fea407b78717", "value": "T19A935D27B552C67BC08752B42BDBEA615933F4BC0B32720B33E47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "972d57ee-10da-4c16-8d85-9153ff41addf", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3AbvmA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKQ7m/KWOXF7aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949204, "uuid": "4bf92127-6030-41b5-852b-f5ec8bd83897", "value": 94685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949204, "uuid": "560a4900-2ccc-43f9-8451-2f2654538301", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "f8b15a6b-ab55-4d37-be8e-c9e8cb4f945c", "value": "vvglma", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258eefa5-217a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632956904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632956904, "uuid": "06639e91-b408-4496-a7ee-b4d9f617437e", "comment": "Malware payload (Mirai)", "value": "735cb8455741e129cb24c93702db6dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632956904, "uuid": "ddc4fcad-bf57-47e1-8dc0-cbfc338852e2", "comment": "Malware payload (Mirai)", "value": "4882555af0b153d71e17f05df2383f9c6ec26ff05685d9538f40f0d6fadc951d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632956904, "uuid": "575281cf-f599-495c-8666-326a4e5219a3", "comment": "Malware payload (Mirai)", "value": "e00740563b9806029cae9b2362c55c933021924b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632956904, "uuid": "056cbf20-ef58-4b68-87e9-8790fa30f529", "comment": "Malware payload (Mirai)", "value": "6d5d0b37371a3625b66c0bdef9752dc64f169453329abb273ad1ce77981d54df71635d5ac7f5268d6be882d5ecc249b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632956904, "uuid": "f783050d-57a7-4d77-9751-97daf9681c08", "value": "T1FD335B21BA7A1E17C0E8A47A22F34714B2F5574E25B4CB1E3D720E8EFF20A40A5536F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632956904, "uuid": "140bf2d4-2b67-490c-b9fc-34b99c785024", "value": "768:0boYLl7g492p7dlUIOQuRxYKSPp/3a7cgk6xO+g902:0bBLl7g4Qp5lUIOJYKSPoBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632956904, "uuid": "20a6db66-ea5c-4327-8128-8679b197e954", "value": 50184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632956904, "uuid": "4fbaf7d7-dfa4-480c-9742-dcfc230503ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632956904, "uuid": "dbf9406d-0f99-4fc2-9f72-66fadec1e45f", "value": "735cb8455741e129cb24c93702db6dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda2bb18-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903150, "uuid": "45b462da-d6dd-42a3-84e8-e5b446bc38c9", "comment": "Malware payload (njrat)", "value": "72c391745df454a943727593554897dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903150, "uuid": "00868793-1a65-40d1-951b-7207ffba72e5", "comment": "Malware payload (njrat)", "value": "48c3a3ada659fff5dd6571878fa4e5aa4d0e0caf683c9d48e44f75c027835781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903150, "uuid": "2c60c912-3f70-402c-a7fc-210e171b58f4", "comment": "Malware payload (njrat)", "value": "da75bba892bb982e62246e2e13135a69b8010440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903150, "uuid": "2eeb0503-f8ce-4caf-a61b-666d51f72398", "comment": "Malware payload (njrat)", "value": "a45a1d58c8a27537baa5da4e382e536170a865e03846433c7422a38957514780e9b0efcc2457860946089fd7d0606828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903150, "uuid": "77e29366-675b-4d15-95a8-3132009d6d69", "value": "T1AAB2290E3FB9C856C5AC177486A5965003B091470423EE2FCDC564DBAFB3BD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903150, "uuid": "2f4acc2f-b2f7-43f5-9ca9-e59ce968efff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903150, "uuid": "5477bfa3-cea2-4a6d-a2fc-c9fc3838db33", "value": "384:vslUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZ60:QeEvwIlLMRpcnuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903150, "uuid": "c566624d-364a-4bc7-bf35-9bdc9abb7f32", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903150, "uuid": "bf2ddeb0-9527-4772-b70f-4967d79525d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903150, "uuid": "8cfc7f3a-73c4-456b-a467-6a8316ae861b", "value": "48c3a3ada659fff5dd6571878fa4e5aa4d0e0caf683c9d48e44f75c027835781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e333ea-2176-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632955421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955421, "uuid": "4fc89911-2323-4d4c-867b-7a19a4b50a84", "comment": "Malware payload (Mirai)", "value": "ef643a31aa8533f36af64b9e2cafcbea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955421, "uuid": "85a73ff7-02bb-4a50-bd7d-180a9978dbc0", "comment": "Malware payload (Mirai)", "value": "48e9b517e0d40eb1c3f3bb5e93533b39fc8a9f612064d291fc1abd33717e50db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955421, "uuid": "32f46b01-e111-4f61-89c8-17e4020e1bbc", "comment": "Malware payload (Mirai)", "value": "dc8095c2cd9cbdbc9d5c8f076c97d459a21e584f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955421, "uuid": "6e6b3aa8-dc18-41b2-9d36-b6f8ad7cebd4", "comment": "Malware payload (Mirai)", "value": "0b27bacd4db401476c93383b9328cea1ab6edf07c9b36a656c29cf5f6cae0403614b72841e45755a0df7b4fb31b5e401", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955421, "uuid": "606688e4-7f83-4e4e-84b5-1607e3671802", "value": "T1E7138C62C86E9DE8C31D4634F4248E705733E509E2A32EF6590686A69017FFCF6493F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955421, "uuid": "a8f82cda-51ea-48b3-b1d4-3af2b7f3e9e6", "value": "768:AasFeOe9e3qaqYwBudMllg6cRrA/v3SCqPoIhvs0ZKCC5I:AasFLMpaQlg6cRQ3SpgIC0ZKCC5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632955421, "uuid": "e8ba4a7a-9170-4084-94e6-da907f916ea3", "value": 42656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632955421, "uuid": "b9198c42-5e72-45d9-a8e6-d127e89e96a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955421, "uuid": "b0b3404d-9b25-4cdf-98ba-d43fdb9b33f2", "value": "ef643a31aa8533f36af64b9e2cafcbea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c851cc9c-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632903060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903060, "uuid": "22bc0430-fe3c-42dd-88f2-2cdd71f37023", "comment": "Malware payload (Tinba)", "value": "15b4b25071ff80e72619eaafc688179e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903060, "uuid": "6c56882b-0c08-4554-833d-62d68c3bb666", "comment": "Malware payload (Tinba)", "value": "490de6e7b6c1808609bc68f97ffd104effb10a7e4dffa6a3af807b6deab3f1ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903060, "uuid": "7a3cd5c4-21e1-4611-a090-69c70c24446c", "comment": "Malware payload (Tinba)", "value": "a8e25dec57ff24a7e16076469c365bc4994f13e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903060, "uuid": "9f45c2d9-2aea-40c2-be51-fa658f30077c", "comment": "Malware payload (Tinba)", "value": "11fb66bd0416270fb50b73cfe0f92c864bcdc4fe4aab280dbf6fbaeabac8576e7c7cc91e38dde51c9b1870e7acc0c87c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903060, "uuid": "4f59021b-02cf-466c-ad8e-159ed6f79fa0", "value": "T1B223E031B67A2847F5EA5C30168BA6642651FD4E12719F2B1A3472DD3EB4392CF8380B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903060, "uuid": "b1c1fe5f-c891-414d-ad30-fb34ed715dbc", "value": "f3b40bf9ff52656d4798070bcd1b25e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903060, "uuid": "835a24cc-13cb-4def-aa90-f3477de08a93", "value": "768:WtwyMe0Jy8xwd117mrlI9m/xGuv4V7RMEnqt9jn2ACH3hLZ2HwCLlH:Wtwyedxwr1qUMv4VV6j2A83hVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903060, "uuid": "31b22422-3d40-4874-86d1-bd987366ddd2", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903060, "uuid": "29b88d58-9615-4d30-b7c3-4e401928e0f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903060, "uuid": "576621eb-05f4-463c-a4d4-4f5347b0ce48", "value": "490de6e7b6c1808609bc68f97ffd104effb10a7e4dffa6a3af807b6deab3f1ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24148ca5-2139-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632928984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928984, "uuid": "dae377ca-50fd-4b9d-8053-484c65f663ce", "comment": "Malware payload (Gafgyt)", "value": "acccef6a660baf18f705e857cabf94d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928984, "uuid": "a922a53c-dde4-4763-91df-7fb777a07a16", "comment": "Malware payload (Gafgyt)", "value": "4910d678ba9e872d8db79b74f7c3d3b9e62d2e808116e45eae229545bd4dea4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928984, "uuid": "3554a74d-0fa6-4804-8670-e84ed59d85fb", "comment": "Malware payload (Gafgyt)", "value": "43cf708f4129f3d0f35d86b464b575257b8b1a89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928984, "uuid": "c001dfd5-16d6-4f8a-be55-7bfe880ae049", "comment": "Malware payload (Gafgyt)", "value": "c23876567f6ef159f0a7ed70b54c2a0e0d0c01771f7211be0ede0d5b32b0d740023fca0639d3a76d8347adeef9f20dc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928984, "uuid": "0e317516-071e-479e-a7d6-de318c988844", "value": "T107041A09E810536BC2D323BFFB5E528E73371BA867DB33219A345AB42BC57591D39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928984, "uuid": "7158f791-ed8c-4824-9226-aa0b66eabde3", "value": "3072:QdXiuuQawnAa1dKEZLxS5hUcpebXH8zZ9y77NF3msQLnh0X0Kr:8XHlawnA6xS5hUlXH8HI7NF3msQLnh6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632928984, "uuid": "80b756cd-b727-4031-b121-65212ad522fe", "value": 175344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632928984, "uuid": "e2ba85f9-249d-46af-a012-90995da7459d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928984, "uuid": "06bf8351-de1c-41a0-b045-c94b3bf5bde1", "value": "acccef6a660baf18f705e857cabf94d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3786eb17-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "dc705e22-5ff0-4aee-92f8-c7fbe6430118", "comment": "Malware payload", "value": "93775671e49bb1411fd383aff0334b05", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "79e880aa-b389-4629-9087-48da0ffe185e", "comment": "Malware payload", "value": "493daefd8778c684c6c44c1a36846f31dd3f87a6943c1177015919549cc1d7ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "9c528ccf-2a4c-497a-89a0-6fa662bb1794", "comment": "Malware payload", "value": "88a4b364c561ce350cbfb833778777fcb99752c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "a3f35a09-8f02-4997-888b-71de2922c1f3", "comment": "Malware payload", "value": "06bf56f67c9ce8ae4d17d34da2d41a1b52da44bd5aa55c13a926ab69116bf2cb32d1894b0babd73c05233d348fee0349", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "6b841286-9d88-4261-9f4f-45596fddb9f7", "value": "T1FB833902F741D673D18316B612DB9F110532F9FF2A1AAE16F3AC2CF8AA154847663F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "2a846cb6-e016-4637-87d8-b258296e50ac", "value": "1536:vrYoW7as3D972+c6tsTngPE56XxCSn9okIc/md+wVOz+sXcfW7k:vrYnvT97hc6G7gzXxxWkrmMwVOz+ucf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949203, "uuid": "305358ee-7de2-4968-9222-7fd2d34702ba", "value": 81485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949203, "uuid": "a1908739-0dd8-4f7a-8428-4a728b94e3bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "9514d34c-ecd8-42cf-915a-3b9379ef408a", "value": "qvmxvl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641bd5c2-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900315, "uuid": "d9eed9c7-5b24-47b3-b24e-d63372d77b1c", "comment": "Malware payload (Dridex)", "value": "261630c08a46ecd55d265b06074ad7b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900315, "uuid": "63f8f460-37ca-45bd-b4a8-d62ae578720b", "comment": "Malware payload (Dridex)", "value": "496636ca904c6d802faa632d5857f3c330219d8d1f1edae703ca075bf35b3187", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900315, "uuid": "cfb7a2a8-d404-4e9b-a46b-6c4fc06ad1ec", "comment": "Malware payload (Dridex)", "value": "2f91e43fecc44b6981c6ba7d5de470244cd8e47f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900315, "uuid": "17a4db6e-3d06-4300-ba6f-bb5430f501d3", "comment": "Malware payload (Dridex)", "value": "d0fe9b251a5ea711ce159f90034563eb321f88bbb84f4e835fe5a2670af2622b8e4280e4ac885eac1a8f448988e6cea5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900315, "uuid": "e2f4d740-d519-4ac3-befd-29815245b5fb", "value": "T1A0B5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900315, "uuid": "2e04fec9-db17-4e8c-8c74-258dab022046", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900315, "uuid": "15e2012f-3162-466a-8929-df6ebfe14785", "value": "12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900315, "uuid": "930bc6fe-3ae5-4479-ac1d-dee4d10fede1", "value": 2424832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900315, "uuid": "29687e01-75ad-4153-a18d-fc0e34a1413c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900315, "uuid": "bfb065cf-0bc7-434c-8056-05c6712caca0", "value": "496636ca904c6d802faa632d5857f3c330219d8d1f1edae703ca075bf35b3187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da392a2d-2127-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632921559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921559, "uuid": "55235761-d457-4ed3-9c0d-ae23d97c5067", "comment": "Malware payload (RaccoonStealer)", "value": "a87c6c625c50cb1fc32b4da2f0bd6769", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921559, "uuid": "0923a3f5-b784-4b41-891a-2434784b12dc", "comment": "Malware payload (RaccoonStealer)", "value": "49fb0f80086891ec2621063353631fb5a5163659604820e31e2b95b7536c0c99", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921559, "uuid": "5e3dbd09-e0e9-4920-ae8d-7b15d3adf34e", "comment": "Malware payload (RaccoonStealer)", "value": "bec6c90c2ffa0f32e98b4ac7878302de0c39731a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921559, "uuid": "283b2e29-525c-445d-8e20-11ee0cfabfbc", "comment": "Malware payload (RaccoonStealer)", "value": "52dcf095fedf8832b07ca43c05f92118f4f9478d741da15d36c92fb81402b96fe94af8d8afe41ce69afe8e0d9724d9be", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921559, "uuid": "a21d84b2-c2fa-4bd5-9c85-7e21daf2ff77", "value": "T1DC230878F3485B66D26A5B7509A2352C02F15E122DE1EE1E9E4C73891AF23C30F0BF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921559, "uuid": "2c211023-21da-40e3-837a-833b04a21f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921559, "uuid": "883b283d-9178-4c85-bb99-977fff1d24ba", "value": "768:J06QS0vc4Jyn3QPfDWZepQ10pIQTNJ5PcSFyxRiMtpGirm:C6QFvRJO05d1PcS6EMznrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632921559, "uuid": "11469cb2-ae08-42c1-ab4f-67cc3eb0d3eb", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632921559, "uuid": "4ccfb65f-3751-4f09-9803-3f34d9d60ee5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921559, "uuid": "b6a68b8b-61ae-489b-9c5a-81530ba8d13e", "value": "DHL Shipment AWB DHL20200205HFGG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da89a2c1-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900514, "uuid": "ddad26c5-4f68-4aca-a9de-ba6af765332a", "comment": "Malware payload (Dridex)", "value": "45dbf6a821b85179bb44e113215d98db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900514, "uuid": "da036d4e-5d42-4956-89a5-9e4797881acf", "comment": "Malware payload (Dridex)", "value": "4aa0055b7787c3d593facc47bb8eb994769ae5330982418f09656993ce62a536", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900514, "uuid": "c63cf412-5d4f-4075-8f23-a90f60b4079c", "comment": "Malware payload (Dridex)", "value": "fec6d80342d5a0d8b3dc516ab2219dcfde849726", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900514, "uuid": "e226cae6-219d-4074-9e32-29e696b539db", "comment": "Malware payload (Dridex)", "value": "fe871cd750784c1c099fc55422d8c11ac291964f494dd72f028975b8d8d82ca427efbf1691becf2363c1eb9177df34a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900514, "uuid": "985afe86-baf0-41ad-88fd-6bb28739a904", "value": "T1E2A5D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900514, "uuid": "7b81d72b-bf88-4812-b82b-4137e97d29ea", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900514, "uuid": "055e86d0-9752-46fb-aeae-0ef4ecfffe1b", "value": "12288:vVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Ht:GfP7fWsK5z9A+WGAW+V5SB6Ct4bnbHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900514, "uuid": "a5e942a5-fa7d-47c0-9338-372ceb3145f2", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900514, "uuid": "fb0bce6a-2062-4adf-90c6-542b4876bc86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900514, "uuid": "edf24c12-ab08-43e3-82d0-465bb254eedb", "value": "4aa0055b7787c3d593facc47bb8eb994769ae5330982418f09656993ce62a536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59e5503-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927564, "uuid": "1f28164d-4a9e-42d4-9b36-fcced97c8928", "comment": "Malware payload", "value": "e1d45c65bc1cfab090a27150ec160bb1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927564, "uuid": "207517cd-2647-4c6c-94a4-d1c67e8282ce", "comment": "Malware payload", "value": "4b16be9f298ef02b61148cad3457d30850fef0939af539978c96ee1391954c96", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927564, "uuid": "129bc311-07d6-40d4-bd0b-6b58cab0b1dc", "comment": "Malware payload", "value": "40b13a65af14f97ebd6b6013f9404f6ad3a1df6d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927564, "uuid": "926e5b5b-8091-4670-ae4d-09ad84b55d9e", "comment": "Malware payload", "value": "54bc4e6ea863977a93abb1e09d264d178cd961062dee89793746baab33af31e52fada677012fe873f041eeea328e3989", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927564, "uuid": "54bbbff9-f5af-4124-8203-5bb498e073de", "value": "T167B2D7069911F1ABDAC352B7584F42F362018B566BF59ECF6FD81CE0BF095C26678223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927564, "uuid": "b52aa17a-1fb0-4248-b3db-818b9ee2a678", "value": "863e2f2e0167904b9558569c7a33ee49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927564, "uuid": "4523859e-45c5-49a8-a5c2-96d90d947f67", "value": "768:ft+65SM5rPoCLwfH2irC2+EwMmZbCJM9:1BEM5ToC0f2irC2+EPebC+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927564, "uuid": "9b0c7e71-1570-4b29-936f-fe3a0d22e548", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927564, "uuid": "480cb793-716b-455f-a896-d4a969235c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927564, "uuid": "301839a9-13a4-4c75-ad1b-c2f437915184", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.3366.15213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c65db22-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632899389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899389, "uuid": "ba104fa0-bf57-47a6-ba65-dbe8a473ba28", "comment": "Malware payload (RedLineStealer)", "value": "395bfde77f16f5015898233b75e6c81e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899389, "uuid": "be699ce3-0949-4361-b132-3b189ef86c8a", "comment": "Malware payload (RedLineStealer)", "value": "4c889775a4fa2bad1bc56a20169cd221eea94eab6d236da1928af5535071ecae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899389, "uuid": "76524409-6d2a-499e-895f-c66d9fd612b9", "comment": "Malware payload (RedLineStealer)", "value": "5512594fb0f356eee946de2cc5b2718560820e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899389, "uuid": "b17f9ecd-4c8e-414d-87f8-b853356c6cac", "comment": "Malware payload (RedLineStealer)", "value": "2f4db316fde3d9b2468fbc08bf0cfd5c3af3a718a6c008f70edff643ea16d21f00b84c04d4e42fdb45ef67892aaff2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899389, "uuid": "e0fce400-ed8e-43dd-9da6-87de96e73354", "value": "T16BC5231523E85212F1F31F766EB207821E7AFE606C31D66FB701A54E5970E48EF2A361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899389, "uuid": "06afbccb-c542-45bb-9db4-4657b76c7b87", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899389, "uuid": "c958499b-4f4a-4bb8-b80c-ea43b185fc71", "value": "49152:O3ny5hBJY4ezePNM33rStxRRYWUG3mDMwQ7+TGlTC6bWHHMN:0nMBJY4ez8NM33SzO5aw7GlTVbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899389, "uuid": "b35fb877-df4b-454e-82d5-9ba59f62a6f2", "value": 2643968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899389, "uuid": "e12342e9-2e99-4bdf-8a4e-ca22253d28df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899389, "uuid": "b9ae9562-c071-4969-af45-292484dbd523", "value": "395bfde77f16f5015898233b75e6c81e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4846d5b8-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632896403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896403, "uuid": "23cccf93-a145-47c5-b88d-13f58121bddb", "comment": "Malware payload (Formbook)", "value": "4b9b2df788a79b5deac600a8c626bf10", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896403, "uuid": "bc7faff2-8a9e-461c-953f-291ca318cf0a", "comment": "Malware payload (Formbook)", "value": "4d2f0bfcf9210f8f42edec284171835d28d6114c8ba87e32d9619a3941eb724a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896403, "uuid": "cdfac494-37a6-4c42-b5df-69a33a3c3c38", "comment": "Malware payload (Formbook)", "value": "91b4d7450c645f364aa414114b30bc9ea6d9f18c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896403, "uuid": "692c434a-8982-438d-91ff-75949460c300", "comment": "Malware payload (Formbook)", "value": "98f318189107ef6c20a13ea2b856b7ce62748af76169e53a747860bdee6ae2f54c80bce378bc1dfbff5c6dd5e7e6ba52", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896403, "uuid": "cecdb260-8d52-4c6f-95d9-159973a32d87", "value": "T1CF72D8ACD14705A8CF86ABBC5B0B2F85044C7A6DF7C8A632327897792BD5D7A501383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896403, "uuid": "713c3b48-ac67-4e9b-86d3-b50840896120", "value": "384:wUO57tBNVaUXHd1OZ89bpMHIUVjs5OSzYwo6qI:SRVX9wZqpNYjN65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896403, "uuid": "22c941f9-9108-40fe-b845-0c608bef9082", "value": 16470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896403, "uuid": "1b4b99ee-da52-4ddb-80ee-d4a15127aad2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896403, "uuid": "90d02d92-8543-43c2-a9e2-5899c5e19872", "value": "RFQ 33 55.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473336ff-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900267, "uuid": "0c186def-3bed-4671-80e3-2aa46d14d3d5", "comment": "Malware payload (Dridex)", "value": "e879c269e2c7b6239b3da2f473f5ce4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900267, "uuid": "f670f705-7fe6-45ea-90aa-96a848fbeb9e", "comment": "Malware payload (Dridex)", "value": "4eeeb0f137f462cdcf19878dc9f752ff30ca37d39498bf154ea87a57638788a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900267, "uuid": "c4807a24-cff2-46e4-b1e5-7e71dfe919f0", "comment": "Malware payload (Dridex)", "value": "44a2745054122eec5588fdaa017ad7b271b13238", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900267, "uuid": "28919cd3-23da-4be1-b7c2-3361dbab7251", "comment": "Malware payload (Dridex)", "value": "b84540552b5a16451db711c41bcab0b80cb4aaccb45384819658e60f91bf6ebdeae95c683160856782e56ab3425750bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900267, "uuid": "4d7ee6f7-81c7-47b2-8599-92a8b891bbd7", "value": "T185C5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900267, "uuid": "3a450d39-ab75-41ed-8a4e-268b10ef368b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900267, "uuid": "c57d3a28-148f-4bd1-b91f-d00cdc9a6389", "value": "12288:MVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:5fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900267, "uuid": "f70808b2-c635-4fc2-98bb-63342dedbea8", "value": 2682880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900267, "uuid": "8008518a-6b84-4859-a8ff-cca1ab5b8975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900267, "uuid": "a0c4ea62-0737-4b9c-b722-657d3d62aa9b", "value": "4eeeb0f137f462cdcf19878dc9f752ff30ca37d39498bf154ea87a57638788a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749586fe-210a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632908933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908933, "uuid": "706a9edd-04db-4e7b-983e-a106e4369c05", "comment": "Malware payload", "value": "89416fcdcd3f91a92fb27b7b94779921", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908933, "uuid": "e2b1d52b-37a1-47d6-80f7-8c43fae54f44", "comment": "Malware payload", "value": "4f6f4b913fe7cafc611a1ff5ac857ed342a0bc5a83ae5b3cb2485d5beaa31b15", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908933, "uuid": "18c45860-b405-4fca-b46f-841b0853194b", "comment": "Malware payload", "value": "b522050d6600a0dbedff9454aea62a9361353198", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908933, "uuid": "1aff0058-26b2-487b-b491-6058820fb5ab", "comment": "Malware payload", "value": "2918ddea3f7cb1a82c1d06d6faea0ac4c15255b1c879fde61c626cb969272cb5faa79276c721f802df7fedff21cee922", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908933, "uuid": "88bebf4e-3e1c-4f43-8e5b-54a2ceb0df2a", "value": "T1CA159D394D2682F787EEC66CD08C0BCEDEA6A4837B919F1AC495D7D2025B70FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908933, "uuid": "ea348850-3d67-4150-ab30-05dfa92d5d3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908933, "uuid": "cc2ce481-2bbb-4889-a4e1-2df2c6611c22", "value": "6144:EEkWE+rsr3l/KHOgiH0DEWDLiqbMi10nY/legpRcueexOYU1HS1yVFmrdTKjXEnA:zk8s3l/Km0Bbn2iYueT1HJ/0JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908933, "uuid": "7886206d-e088-4f0a-bdb7-e96a0af1fce8", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908933, "uuid": "e241ebe5-3ca1-4603-916e-b89dad1b8cba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908933, "uuid": "d46abd5e-b4d9-4eef-80db-0d5711b805ac", "value": "DHL SHIPPING INSTRUCTIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412a7214-2138-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632928603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928603, "uuid": "4b649d48-5b2b-4e25-b8f2-b5f05df3111e", "comment": "Malware payload (RemcosRAT)", "value": "8cf2c9a1f1a3ecd41ea8ecf88ce91c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928603, "uuid": "afecf29d-deea-40db-9472-48b086f48dc3", "comment": "Malware payload (RemcosRAT)", "value": "4ffcb3a19eb6bf00bf22b12ce006f2bf4599c6fa875c06e12b57e3cf585dce60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928603, "uuid": "da1cc948-0b80-4419-861f-04a03c93db7b", "comment": "Malware payload (RemcosRAT)", "value": "c605e6328931730ebfd2dcc2aa9d609778bc4e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928603, "uuid": "b1577306-9038-4592-8c0a-18d4deb880bc", "comment": "Malware payload (RemcosRAT)", "value": "bfb3da05f78bffa6788fe4424094ebac2ff43cb79d378f0053bd48abfb747e7a07c7abb8534f77737f46c9af3cf2379f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928603, "uuid": "034b3179-d674-466b-80ab-1cc54db82a3e", "value": "T1CAE44C61B2D048F3E71627F0CC0D5299592BFE703D085C9EB5C5BAA81E3D6217A1B3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928603, "uuid": "ae5340f0-fab9-42f0-9bb1-bc8fbd98e409", "value": "03c92feecf1091c3749a88a6efa56c07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928603, "uuid": "bcaf9691-0672-4ac9-950d-adf10dd953b6", "value": "12288:F4PeOVGMGWI9KL6zDD69B/buCq3VW/XNkYEQJC:ojLGWI9KL6LAB/bu3gfN7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632928603, "uuid": "6b335c53-79fa-4c5a-ba69-6ba918fc2c42", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632928603, "uuid": "f84b53ac-2fcb-4ca1-8095-f268149cfe52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928603, "uuid": "7daa9345-ddf9-41c3-aa90-e6c5f9f6a202", "value": "INV.DHL202,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279e82d1-20ff-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632904079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904079, "uuid": "3ece686d-639e-4b90-a52f-4132ac3d4322", "comment": "Malware payload (AgentTesla)", "value": "a272c7df8b4b0b2ad9fc67f94d24d233", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904079, "uuid": "a1edf342-c540-4a58-885e-41b6f993ce17", "comment": "Malware payload (AgentTesla)", "value": "500aa578d6e2b80e084dc77f2a71f0bf621a675fec4adae9773b68299741b69c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904079, "uuid": "bcc1beda-76f8-4434-9a47-82bedbfc18b8", "comment": "Malware payload (AgentTesla)", "value": "09561c308d3872ffe0adc7b54c9d09410982e0e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904079, "uuid": "ca1496e3-456f-415c-bcdb-47703ebe84f7", "comment": "Malware payload (AgentTesla)", "value": "d2319261101e7e526eb763888f9a97a3ecec86d42e1d96be2c95622c3c67dd839cf855bb4c0b4e2df871ad3e82bf9a55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904079, "uuid": "8b30bc34-321d-4ba6-ab10-dd0a50dfebdf", "value": "T1A5658D1AB60CE65AFD1433F02124BCC411F81C981C6CAA17B97672EAB4B9E27DDF505E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904079, "uuid": "7fe344df-3dab-4c86-bd35-fbeaf14d8adc", "value": "24576:VD4VHfQe6ZyWshg+qbZxTZZWunAWvO3M38zRVYnemT7/eW:3+4WROnpnmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904079, "uuid": "a5bc1f67-5bcb-4f9c-8020-2784856b17d2", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904079, "uuid": "708f4576-b620-473a-9f02-c7762dfc410a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904079, "uuid": "762cab40-01dc-4d96-a48d-d5ea9dec7ecf", "value": "Scan001.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968c81c2-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632898252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898252, "uuid": "1519d9b0-166b-464a-896b-c28d959e56a9", "comment": "Malware payload", "value": "797df36276b0669579400f9cffe7140f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898252, "uuid": "228042f2-4786-4eba-840f-c61d3949053c", "comment": "Malware payload", "value": "5028940eddc013fc2a5c03a3736eb01c11133f2efd157ef30d03eec9630c01b7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898252, "uuid": "7c7ba606-dcd2-461b-bf44-c9881252b88b", "comment": "Malware payload", "value": "21c14881273491c42c0f0fac6c56eab803965cc6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898252, "uuid": "a657952c-d9d5-414a-bb23-237656a84826", "comment": "Malware payload", "value": "a464b4aadd94b4fdf89053f1d86705e5612c50a50d586fbbbf207869d7b3640c7cd63f44a102464199f5cecd8f9622e6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898252, "uuid": "94bf36da-4dcb-4331-b47b-e6a08278071b", "value": "T18941E830BCB7D576F50BECF61997022FFB1590E0D998A346DB5660C95CA00A8060A6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898252, "uuid": "8178f587-ed57-43fa-a284-b8a32d5da470", "value": "48:9gXtgK4xUw3D9fSn+aYDQ+jra1/5Lk7INo2cbS0bo3SU1oE9uoxB6a6Jxc0:WXmt5uYDRra1/20o2CS0bUT17Aon6a6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898252, "uuid": "6c2276e5-0d22-440f-b1c7-1d7f3d64b705", "value": 2430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898252, "uuid": "1ab97cfd-507e-4897-b7e6-86b51451f0ac", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898252, "uuid": "51ceda6c-20e4-4059-84b7-6db14936f6aa", "value": "Invoice369866.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e47fa7-2138-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632928690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928690, "uuid": "b929ac4d-64f0-4990-a744-75289320dfc6", "comment": "Malware payload (Gafgyt)", "value": "dad2fc8c6c4d9fd70523e7dafedf5d09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928690, "uuid": "6b47a2e4-0ad1-41c8-9af0-769806f25fb7", "comment": "Malware payload (Gafgyt)", "value": "50f3e14fa985096a8b400b425466d6c1dea8e6bb2ba9b90fab0758e69e8896f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928690, "uuid": "305cd537-658f-4db3-8169-313b30d0e966", "comment": "Malware payload (Gafgyt)", "value": "af7e67cca700a7c1c926f532f5b4a41563657297", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928690, "uuid": "93dc8d95-f1b6-4363-bf97-83e9b162b4fb", "comment": "Malware payload (Gafgyt)", "value": "b2143631a6fba711dd9322dd6997d2ff7e0cbc5d34e2d863ee7770060fb752f224b870fed1deb581dd4078c4bbac5de7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928690, "uuid": "dcaf0e26-6b3a-4a0e-9feb-f190d51e8654", "value": "T1E3E3195BAA1C0783C49B56F13E6B27F08B5CFAF111D252C5A90AFEC01733AB52126F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928690, "uuid": "2a9c5e7e-cb25-41a7-b490-82a8a57c564a", "value": "3072:wIiNQ8Z6zklwlfKT5hUzpeL7IqsaLohmnrVybfdZrriq:wIiNQE6zdlfg5hUUfH8hmnrVybfdZrrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632928690, "uuid": "8e012e47-58d0-449b-9912-94a0ecbe4a52", "value": 148596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632928690, "uuid": "1e49e358-f646-49d1-890c-587bdb4149ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928690, "uuid": "42f09c5b-62b6-499e-854a-aa0794e622fd", "value": "dad2fc8c6c4d9fd70523e7dafedf5d09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ea5044-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632908854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908854, "uuid": "543d01a0-841a-4f75-95dc-1a45ce390cbf", "comment": "Malware payload (RemcosRAT)", "value": "0827842e95a644102a1229fb81d80bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908854, "uuid": "4770e4bb-4624-48e8-82b7-6f8e4776f342", "comment": "Malware payload (RemcosRAT)", "value": "513e3dc85e0bf7f545473fc6c7585aa35cd457eb34373618251610609e98ebc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908854, "uuid": "d0fdcaa1-5278-4c96-b3a9-bd625362f9ac", "comment": "Malware payload (RemcosRAT)", "value": "f005b2048a522d70f0c2a97ce6eb914d5faa40fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908854, "uuid": "ce2560ed-7ff9-48d8-bc52-3981f3efd3a9", "comment": "Malware payload (RemcosRAT)", "value": "30401eed265ac616124c14eb4d09617da5955f166deb8549f3bac3e57ea05bed9a6de891a963768ada4e4d3ad8edec70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908854, "uuid": "4d7020a3-61c6-4f68-ae68-4edfaba3df87", "value": "T13C4523917F8ADE69D46C4775A87B6AF002B14D6CC88AE14F39D43D2B78BB303154386B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908854, "uuid": "fd5b5001-ddc6-4eb9-a32e-aa1d449760bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908854, "uuid": "c4c558db-acff-4db1-b128-d9ecb138065e", "value": "24576:81svcb7BHrysW7klmDUn4Qf5o6kGqDEnbgeZpcDpk5:8hb7xrM7kMU4+y6kGxgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908854, "uuid": "9b3edc36-ac46-4a07-a39d-d9a29ad55c14", "value": 1240164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908854, "uuid": "5d6113b1-c56d-4386-b001-b97835f65201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908854, "uuid": "558360f1-0aab-462d-9a3e-5c20c493252a", "value": "T\u00fcketici Haklar\u0131 Hakem Heyeti Ba\u015fvuru Sonucu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaeaed0-2156-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632941403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941403, "uuid": "55172663-cb89-4dd8-8164-07f8d4fba6c6", "comment": "Malware payload (Mirai)", "value": "2928f4dfcfcdc592fe232a3990fc7f9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941403, "uuid": "39b04f54-57a4-431a-aa1d-d9141614421e", "comment": "Malware payload (Mirai)", "value": "51af405a76b4cf7f60eaea11ce1b73ce0ae95a58d29853f9b07bf1f13eaa58b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941403, "uuid": "2e35d31a-fe02-4a96-a0e8-e26295129aba", "comment": "Malware payload (Mirai)", "value": "234fd5b247d8f061a9ad8a4e92c28ab98d6266bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941403, "uuid": "574fecc9-f234-43f0-93fa-3516b9051794", "comment": "Malware payload (Mirai)", "value": "39a0cf62c5090b3f3f204d4c0440fc67ae1008290b520ab1da7c668757afcc0ce00260b1980580e0ebdcca136f393459", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941403, "uuid": "24de4b3d-087f-421d-8855-4d16a6a6925e", "value": "T1E933F184E37289F2E5789870966A09C869491FC7B3F1DA03176CEFC02BE784529FC957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941403, "uuid": "7adae1f5-9e6f-4820-80c1-1de4de0ebeb3", "value": "1536:9WGBkvFkbpdF/7k3A3FsYgICLDgAez1AYU1mONl:sGBnpdd7k36Fs4CL0zufLNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632941403, "uuid": "b4e7307a-013e-4181-b217-429ea06bc091", "value": 52088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632941403, "uuid": "4cd925d2-91eb-47e8-91b3-d24aa7572af2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941403, "uuid": "c0c70ed3-858c-41eb-815e-da5bd636458f", "value": "whoareyou.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7092f1a-211c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632916882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916882, "uuid": "6b173daa-9d4d-4379-a78c-9f041fcc6226", "comment": "Malware payload (RedLineStealer)", "value": "a94fe2d4ea938aeda1b547621f8127b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916882, "uuid": "8ffc7bcf-a975-4f51-820c-1c81e1b43dfc", "comment": "Malware payload (RedLineStealer)", "value": "51d754d17bded4a65f90a483bf8aeb78fdcbb421ccbcd5391eeb777e4ffc4d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916882, "uuid": "76c07d9d-6264-4b47-b2cb-841d69124ea9", "comment": "Malware payload (RedLineStealer)", "value": "1e5872c1fdd4bed72e7745891ccc0f29f1ae4963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916882, "uuid": "c6f12aae-d289-44b6-8fac-fa6fcc3d773c", "comment": "Malware payload (RedLineStealer)", "value": "6c90e6ac87a0e6186960b769ef15680115a912d3977f517196b654fb6dd221feb7a86fc64bbc9b836ed4a94e8191ba78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916882, "uuid": "773f919b-ea68-486a-b7ef-d4c48bb0de5b", "value": "T12FF1C506B7E80737DCBE4B7A98B3431053B2E6154D13CB1E5CC8825E6CA27140DA2BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916882, "uuid": "755515c0-6af4-4d80-9eb6-b587851c7996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916882, "uuid": "930eaf6b-bf27-4736-b6ad-a3c10bcd5fb7", "value": "96:DJOElmu1B9ilJJMOfEkdEKozt1ExafVHcqkTzNt:FLkJwGE3E0tq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632916882, "uuid": "49aff15f-2036-4215-a0a2-74852cc06010", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632916882, "uuid": "42561eba-397f-4f7f-ab03-7cdfe28a857b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916882, "uuid": "e572aeb0-b95d-46fb-b702-5cd63097937e", "value": "a94fe2d4ea938aeda1b547621f8127b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baca14f-20e7-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1632893778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893778, "uuid": "153dd66f-780f-455f-9541-804ad31a9ac9", "comment": "Malware payload (CoinMiner)", "value": "9393d00d3d52b6c5d669cc103fc95b24", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893778, "uuid": "28217d51-e9dd-4f63-8a25-8e49d1ac4c96", "comment": "Malware payload (CoinMiner)", "value": "538152a3c9f9473d34289f283d49ddac0a9f350fa5ea5b773bdae67dc2540a95", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893778, "uuid": "288f43df-1285-4dbb-a0ca-22b9abc57d52", "comment": "Malware payload (CoinMiner)", "value": "3bc03fd22ea393ab8d3525999a7cbffcd61b1122", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893778, "uuid": "670f702d-5e38-4ef1-b018-342e9dc429c5", "comment": "Malware payload (CoinMiner)", "value": "5313004df390a19938ac2451873204d723c031f31143b97d754848beb5320d08b2e309368731fa6a039aa5371334e354", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893778, "uuid": "52cb3dfa-4ff7-40e0-85bf-0dfb25866616", "value": "T1A504AE10B590E2F5C742413E6C15DAECE52EB92CEFE05633366426DFAE782A37921313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893778, "uuid": "664675e3-ed3b-422b-a71c-015cfef09beb", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893778, "uuid": "d57ce330-bb24-493d-ad3f-9344f6afea2e", "value": "3072:G6KmARLld7aSZ7rGPK5vrcPI1ZeptLbs8EuSzsz:GRTRLfeSNSycPI1EQuSz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632893778, "uuid": "5ee0585b-392f-4d9d-ac93-5a85d86ffa6c", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632893778, "uuid": "16027070-5928-468d-80e6-e04bfe4511a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893778, "uuid": "4e271c65-5adb-4a8b-a7fc-fe7ba10ca976", "value": "9393d00d3d52b6c5d669cc103fc95b24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae122b55-2176-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632955415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955415, "uuid": "3aacf773-6943-40a7-ad75-829dbd3e0c2a", "comment": "Malware payload (Mirai)", "value": "cd870f059c098ebabea860d7ebfa6530", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955415, "uuid": "c66b7717-717c-430d-afc7-10812147c3d9", "comment": "Malware payload (Mirai)", "value": "5422b2e6ba8bb1c327f748bd9ee9c723db56c8764eb5c3180794a0629e8f10f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955415, "uuid": "1bbc9030-f5bf-4f2e-86a5-20fb2905d679", "comment": "Malware payload (Mirai)", "value": "5c0bf009f2bbb25f7d25d267162e9e679bf1c0d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955415, "uuid": "be5eb92d-aee5-4789-849c-a255d8873874", "comment": "Malware payload (Mirai)", "value": "669cee8b328405a50f7a9495cf397618ee3b50a85eb30418c6d2092add176db27619272639e4dfa764f2573355aeb367", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955415, "uuid": "445ceb02-ad1c-4361-9842-db1e7dcda7bc", "value": "T1542317927CC18A06CAD0537BFA6E41CD372563A8E1DF33079D162F51778A82F0EA7646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955415, "uuid": "97e1485b-90d3-43b6-9fd3-2a153a6d65b8", "value": "768:AtR8T06qfgBFGjX2E/lDqLrKNds6Xi9LShHKK65tQ9/Dne0FsuDb4O4VlNOQd55q:C8I6YQFGjmE/lD5nzi9WhKtSrEAidj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632955415, "uuid": "0433bed0-c2da-4562-b4ab-07bc2b94cda4", "value": 47712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632955415, "uuid": "1fb4fbf5-35da-4c54-8392-f98338d17735", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955415, "uuid": "9eca8081-8c5a-4d03-a962-c2b44cb3a076", "value": "cd870f059c098ebabea860d7ebfa6530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fb5a32-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632896485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896485, "uuid": "9b422e50-8f62-4966-b122-35198f3f54df", "comment": "Malware payload (SnakeKeylogger)", "value": "30fb296430ca1ce618913935d0dc1c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896485, "uuid": "ba80ae42-972e-4a75-87db-db4a9771b797", "comment": "Malware payload (SnakeKeylogger)", "value": "558c85e2b7da5f09f5207380878f37bec4b3437b8717fd3215f1d37a9894d8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896485, "uuid": "3e2e5e7a-9a94-4a5d-a380-c94d54bba996", "comment": "Malware payload (SnakeKeylogger)", "value": "8e3cd26662c1e40ae61557261d2d46f49d6146a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896485, "uuid": "d894f203-267f-491f-a4a6-3b80a38dc14f", "comment": "Malware payload (SnakeKeylogger)", "value": "2106b6c7313b7ace1035370de8016d61cdc789e010d7b01c72a4c983bb1095abe7266b96681c81745355f049f6d15e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896485, "uuid": "1e7a64c6-51d7-49c8-8d7f-ed67f2feea56", "value": "T19394E05057DCDF6FE3696AB298246C0182A6D3DC2193DE49EC5A59B43CF621CFB01EC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896485, "uuid": "921cad40-330e-4a64-9e16-a528e86284dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896485, "uuid": "da82ba81-50fb-4518-9a4c-d30de8d39df3", "value": "12288:ToFYGE3pWRUR3A53t7g7wwTZo/rDJI0wXEyRjBa:kqYR83etgU37Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896485, "uuid": "a4b2e1f5-6741-4e48-b934-f2f400c3f156", "value": 419392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896485, "uuid": "570aab4b-81e6-4233-8ab9-eeeb686ba976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896485, "uuid": "60fb9834-7994-4811-a2a6-8082f9b7ebe5", "value": "30fb296430ca1ce618913935d0dc1c21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5227ad51-2150-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632938940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938940, "uuid": "98943734-1fc8-417c-9a19-b74d3c145585", "comment": "Malware payload (Mirai)", "value": "8049b1474b6155101d9badbd7b54906b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938940, "uuid": "4479cfdc-0ea5-48ac-8355-632fff1750fe", "comment": "Malware payload (Mirai)", "value": "5594b4142e4dda3b709301ea48eb49f63c66eaa19534daff4f08feb0671ca68d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938940, "uuid": "034943f8-de43-4968-95ce-ec1befc1d2e0", "comment": "Malware payload (Mirai)", "value": "9e34f95ff4309864b0bb33a0da7f923f7a7c736e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938940, "uuid": "b7696b0a-cd31-45fd-abd2-2219fc254432", "comment": "Malware payload (Mirai)", "value": "a2da31c0d4563d2db6f42119cb7d184d0216bdef5877f88a8737248d4129689f5e389360fd589cda7a542e3610009153", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938940, "uuid": "d43dcdd7-50d0-4e29-b8f0-172a01dd72d5", "value": "T1E023F17C2B2118E6E43FC1B89DB447E51CD16B96A485EC065918E5CFCF4523638ABFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938940, "uuid": "41dcd0a8-9a39-42af-bd08-55b8a0b2933b", "value": "768:eXLL88BFQrRKBP1ZXX8wyOvME14hDv/QJ5e8lAN5TgLY0tOPuIifir5GJgGlzDpb:e7RFyEBP1l83Ol1yv/S5llAryZAPuIiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632938940, "uuid": "f7a3595b-014f-46bb-89ca-4abdd07b3ddc", "value": 46144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632938940, "uuid": "d2057ff5-9915-406c-9d82-8c456f98950a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938940, "uuid": "ad9779a3-365c-4606-8328-fc4789a4100e", "value": "8049b1474b6155101d9badbd7b54906b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c5675e-2128-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632922031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922031, "uuid": "c65b834e-7d27-42f6-b083-5126ba07256c", "comment": "Malware payload (RaccoonStealer)", "value": "a9ad633f55e5f58f08c69a874a37d524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922031, "uuid": "85904306-fcf8-48ad-9851-5e642b6a77e2", "comment": "Malware payload (RaccoonStealer)", "value": "55a8adf695f2b0afbb19f3d8235582b5f43144a01f24e8782a1be38523441b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922031, "uuid": "7cbbe144-0a9d-4a19-bc1e-674a6d3f3a2f", "comment": "Malware payload (RaccoonStealer)", "value": "b5d01576a228f1c430d82dc03e8ed4d397df98b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632922031, "uuid": "8c6df484-bb35-47a6-abe6-012d869f8730", "comment": "Malware payload (RaccoonStealer)", "value": "92b3006baa10443c11c2ebb1163cafca1b52163d6cdbbbf2b7ae42759012ed3c94e02ecdbc7f7a7d8a2fdab65ff11e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632922031, "uuid": "ef9144f6-6040-42fa-9168-8a7fd49a03c4", "value": "T106C4F12077E0C039F5AB12F648BA97B9AA2D7DB06B3441CF52D512EB56786E0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632922031, "uuid": "329e6545-12c4-4f96-a762-20fa108a5636", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632922031, "uuid": "dc2c47da-a022-42c3-aa42-0b1accd4ee5b", "value": "12288:H3fnrjBClv/tnkjyhniNikx7JRA9y/QFBBWEsV0tA1x+lHRQK:TjYlxhiNiklQg/gKeHliK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632922031, "uuid": "d2aae8c8-22d3-4bd2-b68a-9fbcd8b93cf1", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632922031, "uuid": "4eb35dee-ea38-41c0-8ec0-fcb28a4629cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632922031, "uuid": "d190e870-be24-4118-b2dd-b634df75c316", "value": "a9ad633f55e5f58f08c69a874a37d524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89da409-214c-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1632937474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937474, "uuid": "012a54de-610e-45fe-b9dd-1a156568dad0", "comment": "Malware payload (TrickBot)", "value": "def265ed30f305eca30d450ff9609587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib155", "colour": "#7A118D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937474, "uuid": "0622fc86-b88f-4e41-a8b8-40ae1cb188a4", "comment": "Malware payload (TrickBot)", "value": "55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib155", "colour": "#7A118D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937474, "uuid": "abb67ca8-0d78-482f-86ff-c5f36cdb506c", "comment": "Malware payload (TrickBot)", "value": "95a3938ad2c57330cca719cca5f9ec5ffacfd3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib155", "colour": "#7A118D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937474, "uuid": "3dad42f9-887b-46bd-af01-fe3f195d39b3", "comment": "Malware payload (TrickBot)", "value": "e8bc4457cc7ecf8d0405dcdcac9cd821632fc1beb2a64e9ddea2ccc71de1aeca87071b06f7fb6e21f36887a27a3dafc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib155", "colour": "#7A118D", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937474, "uuid": "c69aee46-56d2-4061-8c85-87271f585af6", "value": "T12784E10271E988F2E2B299300DB56B35AF36FD744F71CB8B2354961E1D364958A3B363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937474, "uuid": "b91767ed-d061-49d4-bbc3-3abfa3084afa", "value": "17a1fa7a17d3ddbef1b7dbee846d558e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937474, "uuid": "b9499cea-f9e0-4ffc-993f-2424e4749d47", "value": "6144:ZvxsZNEIOAorbtYrHY+y1h0mEqe3MW5yX/+wloufsYPOHxCiG:9xs5orerHX1v8We+wKuDPuMiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632937474, "uuid": "78ff61b0-693d-48ae-ae1f-0b2625d14803", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632937474, "uuid": "d5badc99-3ecf-47a5-b63a-9390c489c54e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937474, "uuid": "cf9d0d5d-12b2-481e-ba0d-3e3c196d4dd2", "value": "def265ed30f305eca30d450ff9609587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07c8089-212f-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1632924898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924898, "uuid": "456f8303-7b4b-431c-9342-865faf212393", "comment": "Malware payload (CoinMiner)", "value": "6f80503f73cb1441f8e0efb0243df375", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924898, "uuid": "0b7076e8-3885-41b9-b335-6a625667d57d", "comment": "Malware payload (CoinMiner)", "value": "55cc17a628f34a739ffb2f1318e0762dbf61d41c17c6624615bffa667f4609a9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924898, "uuid": "5ba01959-a762-4639-b21c-c84df94bf592", "comment": "Malware payload (CoinMiner)", "value": "a9442c97cbe65287f517807de20c95f5a1499a24", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924898, "uuid": "824c4426-34c9-412d-904b-77529baa5329", "comment": "Malware payload (CoinMiner)", "value": "7246893295e8f63382b4b8c349ae7966649226c1dccbcf3cfd02830f01b97b0c720c7f771019835ca172915641bc6be4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924898, "uuid": "d2b95590-6e80-49ac-bb2c-ee2df0997d9f", "value": "T17B163326F8DD4AD5E0B40C74022249BA49E37A1EA1509593DBFC2D4D07875EF3DA22BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924898, "uuid": "53add4b4-d073-4e4d-8a85-c05d44c1f78a", "value": "43801be8f5954e7259ebb6bc7f6dfe40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924898, "uuid": "4938669f-de51-40cb-8468-6e9c52336611", "value": "49152:Nue+AOwO0oDbpZZVBYW7c6ACBFTgp4oLia2pRvr2FbB5M7X4kvzXymxiL/2stn1W:NuFpjfHbT44PoMvvemxi115lE1iT8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632924898, "uuid": "bf703c62-1508-4aca-8209-a22025514c73", "value": 4121088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632924898, "uuid": "01587d87-1d67-447e-958a-68cdf866ca60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924898, "uuid": "0af6df6e-2242-41a1-a57e-8386f5d2f8bf", "value": "SecuriteInfo.com.Variant.FakeAlert.2.4549.20879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7993abda-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632908941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908941, "uuid": "9b2dc257-f6e1-4589-bce3-20b350333c67", "comment": "Malware payload (Formbook)", "value": "96bb82c10404d2a6e6a07822257d20b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908941, "uuid": "b6e86fde-6407-43d0-822f-ec7fbc96e7d8", "comment": "Malware payload (Formbook)", "value": "55ed65b48cb66c266459b4bbe35faecbc6c7737a1d89d9df884152c292b4b762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908941, "uuid": "698473b5-10ca-4d91-9d53-51a44a182bb1", "comment": "Malware payload (Formbook)", "value": "421bee1ffc504c7deff67058746ec1fbb3af8618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908941, "uuid": "760b7922-4160-43cc-a7e9-d936187fc637", "comment": "Malware payload (Formbook)", "value": "cdfead75da3af5782d04404e2d54a2006c83d7dc7183fe589de6882f98b0bb7a7e1518676e53fbcd1824687768e91fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908941, "uuid": "9e7c82a8-84f8-4a3d-834c-9e8af9b50b79", "value": "T17EE48D59F60CE29EFD0903B021297CC425EC1CAD1D7CF927BEA6B5E234AAE7551F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908941, "uuid": "a3eb0c3b-08aa-4d94-ad74-76fc03e5aa05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908941, "uuid": "5dbb8e5b-5e68-4ce5-96b0-e194623cf552", "value": "12288:RD4VHfQe6ZyWshg+qbZxTZZWunAWv62RlqvVXeTfrQjTVfHb7403NvbTRT16FO2N:RD4VHfQe6ZyWshg+qbZxTZZWunAWvvjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908941, "uuid": "45daf1d8-5957-4e92-aa19-7f7528779fdf", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908941, "uuid": "9f831507-2182-4319-8841-c7ec69c9e3ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908941, "uuid": "bab51b63-8129-4ead-acd4-19f953285372", "value": "MAERSK ARRIVAL NOTICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de22829c-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632898802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898802, "uuid": "f32aef68-f909-4cea-8bd2-568540b985cc", "comment": "Malware payload", "value": "11ed7b4f994317f2a79b477b90779895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898802, "uuid": "a22bd648-42cf-485c-a85f-4dc7a5e03e80", "comment": "Malware payload", "value": "56ada1c5d6b470a4cf9cfae64a64195c76d9a96be716fb6532128b706bed85f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898802, "uuid": "640415bc-9432-40eb-867e-e7a3b2028d4c", "comment": "Malware payload", "value": "9412d20b99000ae239e6794248a511ad34aa7559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898802, "uuid": "c2272947-8fda-40f7-a53f-effd98942064", "comment": "Malware payload", "value": "f3478461455c6f40690b95d6e97eca5da228dedffd7153b3279bca7edbce78facef9290c5d42c14ffca3a323add5360c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898802, "uuid": "a4e5fe2e-5ab9-4c68-bec3-4596055f796d", "value": "T18934F259A1A687B6CBAE1F7DDD71260813F0842E7D23EF865E8032FA29733C91741953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898802, "uuid": "3aaa923d-da79-431c-b1ff-41672f77e45d", "value": "6144:dIgjWp1UL+aK9uhWxL5lRkWPeAnxAa/plC/wDy:dXQDkhYdHn//XS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898802, "uuid": "d863b3bd-7184-4574-aca2-ac4268121e0b", "value": 250174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898802, "uuid": "bd617204-580a-4df1-84ad-7af9eac73034", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898802, "uuid": "92121bf4-f94a-431e-93c0-cef5a78252c5", "value": "11ed7b4f994317f2a79b477b90779895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4beb5d7f-2145-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632934205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934205, "uuid": "2a61a8f5-6711-4094-8dcc-19f367d2aeda", "comment": "Malware payload (Mirai)", "value": "fd298b5fbb6636bcda02533222ef70e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934205, "uuid": "5491d98d-d0e2-49d0-ba0a-4d463182ddad", "comment": "Malware payload (Mirai)", "value": "5737a5eca0777e3dc9e60cefa66a24449bd3b01d2678923ece9b3aecb69cbb69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934205, "uuid": "ba95e95a-642f-419d-be0f-ec480fd26cfb", "comment": "Malware payload (Mirai)", "value": "2175d9f003b672d4fa20fdd447dbc66df2959cf9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934205, "uuid": "3d9d0dba-dd68-4acd-bb66-d7062ef20c61", "comment": "Malware payload (Mirai)", "value": "f446381d7d5d90eac318c09df71a270a3bd13080a66f98885bf1a099754dca5072320dae87b093b3d951a1c1692c264a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934205, "uuid": "05f2a8a1-fd23-43b9-b965-3e5a12efc66e", "value": "T17513F1003B9C383AF4F85476ABB5A441B73DD52E93AC76725E500283B6F49635BB3253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934205, "uuid": "bb7f2257-5830-4040-935a-0a0a54ebe233", "value": "768:IcjA4Lfj1/d4CkELWnYHE0h/rKzeR+C2xSaSsclS4k0X1Xs3Uozw:IF4N/yCkkWneE0R2egC2gHnXczw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632934205, "uuid": "1bceb826-fa48-4a9e-b543-3ce6ff9042d0", "value": 44024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632934205, "uuid": "bccaf436-459d-48f0-9169-bb719cf00893", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934205, "uuid": "6f8456ac-e906-49ba-952d-4b65ca37b5f0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d9b0d7-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1632901474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901474, "uuid": "bab5d7a1-b7e1-465a-a845-9b04d6db76ac", "comment": "Malware payload (TrickBot)", "value": "3ec49676207ba203894b6251009e1bda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901474, "uuid": "242508c6-a770-4ffa-882e-2c59296f88a4", "comment": "Malware payload (TrickBot)", "value": "5787c6b7af7d648a2dd1caae5a73e9c92c38c061edb282d4189e51d5e2a79c49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901474, "uuid": "866c30bf-7da6-4ce5-a62b-71837957ec7a", "comment": "Malware payload (TrickBot)", "value": "01012b26bc2ab4921f6dfe7ac14d58605d346fd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901474, "uuid": "d142fe4d-a909-4791-a2f2-ce9e0d42bdec", "comment": "Malware payload (TrickBot)", "value": "95c34c77aec476bcb41a34f2beaf8a7e04d6f54faaebef1096d156cd52b9655f9df1bb0116e652662b4815eb6419468b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901474, "uuid": "052ab577-ae3e-4be4-905e-34a52b6d74b4", "value": "T1DFA4E01232D090B7D5A76A708EF55BF5B3BAFD104B72CA4B93D41B0C1C32593AA27365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901474, "uuid": "2e485963-6f2c-4155-bb68-05caf1abd68b", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901474, "uuid": "9e33f7de-148d-4a43-82bc-abb2a060e2ac", "value": "6144:ZulNLvVbERG/tUxEHQk/kCzyUwSg+8FPo49RP1dG80/JM+UsInyAWIBNPe4:47V4RUtUxEHQk/5VM+5eZ1d3uFInBN24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901474, "uuid": "c7bfd0b1-7cd1-4707-b1ab-43c1de44c27f", "value": 462907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901474, "uuid": "a7db8919-b5fc-4bbc-9171-2750b52df9b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901474, "uuid": "4cb9315f-60e4-4816-a569-6dd3c596485a", "value": "3ec49676207ba203894b6251009e1bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ebb7aa-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884722, "uuid": "464da7fe-ca7c-4430-8a92-12fd8b135920", "comment": "Malware payload (Gafgyt)", "value": "b5efec422901fee6841293534470a6c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884722, "uuid": "1f04ea59-b64b-422a-b219-1d08f9867f18", "comment": "Malware payload (Gafgyt)", "value": "57a7a82884b7eb1b9c91cc77f8c244e5f90f4753eefd06067c4d7a1eb12e1c42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884722, "uuid": "729a9e7b-b11d-41f1-b08d-6aa06fbf7f85", "comment": "Malware payload (Gafgyt)", "value": "a2f130e98b3a6ca9b96b04d5e798374e81ad1db1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884722, "uuid": "7dc4fbda-bd66-4547-9687-8aa8111ed07f", "comment": "Malware payload (Gafgyt)", "value": "d42d4eaa6e633b6c347d369e7acc3ed1cb0bd3d27a48a39db35693c892e2fa0169d5c67221259226c413de6d0219a170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884722, "uuid": "8d22ef63-5f47-4856-b6e3-e3f33af2f2f8", "value": "T176C33A53572C0F87C0D799F03DA733F1875AB66102AB11C6A90BAEC04377AB96927F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884722, "uuid": "cfe8dd29-9c0a-4a16-911e-909a9e1d8a03", "value": "1536:f13EnNlxlMsZIBuyJ6xP9CsD6LYSNMAnDzUNV3jU+offmmitdczv+ghcV3NO:ftixglNMAnksdffmm2dczvFhcV3NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884722, "uuid": "fd73f555-7948-4cc2-83dd-ac13dda33319", "value": 121545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884722, "uuid": "329f5257-e771-46d0-84b2-e3de6226ea21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884722, "uuid": "3720f23b-de0b-47a3-8c1b-77f54f9bb1c4", "value": "b5efec422901fee6841293534470a6c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621c4efc-2149-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632935960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935960, "uuid": "5375b00c-461e-4e19-a0c9-6850fe7f6373", "comment": "Malware payload (RaccoonStealer)", "value": "4bc3ac49baa6da41b0c509a1b0c72436", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935960, "uuid": "d4bdec94-7d40-4314-bf27-b7d392b3972c", "comment": "Malware payload (RaccoonStealer)", "value": "57a7b15cd3b962e738b9c36b8d9dc2c16f3fa8efeafa1f9d2996fa8231a208e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935960, "uuid": "d9f9ffb5-b84c-4f87-ae4c-50a7ab242aaf", "comment": "Malware payload (RaccoonStealer)", "value": "9380406887e551367200ffbcf1759256294b56c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935960, "uuid": "4131b646-3c63-42c3-980d-3f96beeab5ae", "comment": "Malware payload (RaccoonStealer)", "value": "eb396a59ff57baa9c002e7b868384597d726a61a984f9a0ef749f26d8abf9470442fd2fb5b188b8b7c1746b92f026abd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935960, "uuid": "92b9703e-5c0b-420f-a7b3-cc990b489881", "value": "T1D4B4F110B572D5B2E72546B348E6C6A4C93EBC5CEFA496F32B9086DE7F391D1E702201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935960, "uuid": "2290ee74-03dc-4abd-8734-03d3e3c27028", "value": "ca5041463b2dd933d009ca1aebe1423c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935960, "uuid": "af36b949-3d1a-44cc-95c0-03a717e1e452", "value": "12288:5vEOqO8hNv2Qf+LyYzMrOhq/hRo7foKnqdQuxntwHI1deW:5pqO8hd2QGq/hRo71nqdvmHI14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632935960, "uuid": "00beb5ad-c64c-463c-ae14-6285bc43f9a3", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632935960, "uuid": "6f35df87-38bd-45f7-9f09-22ed727985c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935960, "uuid": "66eae215-a54d-4177-be02-c216bfd028b0", "value": "4bc3ac49baa6da41b0c509a1b0c72436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40e3488-2166-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632948606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948606, "uuid": "b7f90eac-c30f-4b36-affe-dddde4938543", "comment": "Malware payload (Mirai)", "value": "3fe865c5163a96ed8827b5b20b1e7c4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948606, "uuid": "76c0a2ba-831d-4f97-8ffa-c4a11e9de953", "comment": "Malware payload (Mirai)", "value": "5913e92769669d8c90354661a6cb543aca805fedf82f7e2f1cc0583b13009fba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948606, "uuid": "471570bc-af67-4257-9ad9-d2a7a20b4168", "comment": "Malware payload (Mirai)", "value": "7759af76d15e981592735469dcf388574683a035", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948606, "uuid": "0ebe651f-e5e3-4cc9-b021-8a04acceafd4", "comment": "Malware payload (Mirai)", "value": "f3ed2547ef7bb8b6fba7c198e6374b54fedb41946236e4a61dcab1c29b89bfa065fb237730cdce03f1441ddf3e36a626", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948606, "uuid": "60d99d5d-746b-4945-b768-6edf9794e64c", "value": "T1CCA2CF765109BC72C3F04437FA25CAE71B751B38F36A773347200AA8799E9E90A781D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948606, "uuid": "e581fbd5-4359-4caa-b75d-47bea4d0dcb5", "value": "384:Ul2HHc4JnUBGdlhz9EqrhZfutz3HbnrF/6iOdvT/DrchymdGUop5hB:St4Jnxn9EqWtzXR4TLAs3UozL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632948606, "uuid": "b8473025-1501-46d5-af71-f54ce33c62e0", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632948606, "uuid": "b4ba42a1-729e-4de6-9b13-f59163775bc5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948606, "uuid": "ea916417-b1b4-484c-a17c-da8922d95d44", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471d5d13-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902414, "uuid": "2fc89a1d-ce8c-48ce-bc41-a119a3e801ae", "comment": "Malware payload", "value": "8664fb9a886095180af304d132b80aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902414, "uuid": "f7271328-2be6-4596-ae8d-6797242d82a9", "comment": "Malware payload", "value": "5925b7c33f387ae7f00d039d14667955ef6a2fe12616a68ba5b2d1d0b1f6b2ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902414, "uuid": "ebf62275-220c-42de-96b5-ea0f2ea52ad8", "comment": "Malware payload", "value": "476976ba7a80aff9b633a674fd86403da724f3e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902414, "uuid": "0418077d-6c18-4015-8eb5-062d04954ce4", "comment": "Malware payload", "value": "80e6a54452020de870ee773d4e971b6eea1b0881adf4e637a08a72dc30edaa14fb5dae7c1c142f6f0eb0878b3f04eabf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902414, "uuid": "5ef5a4c2-6505-441f-89d4-a55fa882c1f1", "value": "T11273BF127F821D14D7F90F321ACC35CA0ABFB78E9A705BCA1D2E99980F37A5459E0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902414, "uuid": "ebc0c251-2333-450b-bc4b-afb82338e81f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902414, "uuid": "8e7efcea-e94c-416f-9238-c53b53e590fe", "value": "1536:aWV58XLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQti6gs9/L1ui:aWV587E2EwR4uY41HyvYIs9/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902414, "uuid": "b9954a84-26ab-4819-bf9f-aff54bcf4898", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902414, "uuid": "92f4ef33-7112-4cae-b469-71df08985edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902414, "uuid": "98cd2246-5c0d-45e1-af15-54bc8fd2fc10", "value": "5925b7c33f387ae7f00d039d14667955ef6a2fe12616a68ba5b2d1d0b1f6b2ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9c7080-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632896489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896489, "uuid": "c9f20e3a-3785-4cfc-94e4-83007262e50e", "comment": "Malware payload", "value": "cfbf0bb5595dddbd9e2d4b1bdef25762", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896489, "uuid": "4fa4b2e6-bdcd-49a1-a75e-b37917b676c4", "comment": "Malware payload", "value": "597a9275c3d15c813a7c62ec5d8bd5cd68eb3a1e7ab1f06b85e7d1f262610ccd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896489, "uuid": "5e91be24-2bdc-45a1-8a16-9e3674c2bc35", "comment": "Malware payload", "value": "9a70e46aa5bed70fa3a9a86bae0c9d4f372b8334", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896489, "uuid": "82258730-2f95-4c8d-a577-4e43fce42fba", "comment": "Malware payload", "value": "77cc03567bb18cf09884394e096995122d34e00874d863e2ffbf86acdc4bb14c5d5afa19ceb4d837c7d0a5e9664b21a1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896489, "uuid": "356a4131-44d7-4129-9abe-29e033ff06c7", "value": "T131C4A0D458DA80A6B98105DDD9C0F44D9820FED1355FDE28C7AECC73AE596F8AEC408B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896489, "uuid": "fb3d4ed2-b109-4ef4-9a70-ce0a5bc8da43", "value": "12288:N////////////////////////////////////Nss/dzFHRsU0:LRsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896489, "uuid": "2866431e-ab09-48e3-bd0f-5b5c47a2359e", "value": 549291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896489, "uuid": "9e74661a-aa36-4edd-a794-3e2c740be696", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896489, "uuid": "8a8d2e1e-c1ef-4798-8682-93ec535630e9", "value": "vessels details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f52d265-2124-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1632920171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920171, "uuid": "04ece59d-9e60-4b32-8cab-8db6ee124ba1", "comment": "Malware payload (AZORult)", "value": "930714b080a7c56d7ccd9e079ac46106", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920171, "uuid": "7bb3c027-542a-4efd-8dad-deaf236d21df", "comment": "Malware payload (AZORult)", "value": "59fd177d8ed9ec3a4d49921b01a4735f1570b30fce0ea4da72ba08ab3c71c33f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920171, "uuid": "5770ec3b-4b3a-45d6-858d-d3796e3e42aa", "comment": "Malware payload (AZORult)", "value": "42bd345cd1e797ea315e6c25fcd3ad60be41e7e8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920171, "uuid": "736b52d8-d482-4124-b77c-9fc1495940d3", "comment": "Malware payload (AZORult)", "value": "ad3b74cf455b5722ade1b42d3fe9813518d800205078316c0d8cb8bcfc0261640d7fe8bb44790649fe7d52f5ca669f79", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920171, "uuid": "02610db6-ecaf-48f8-91ae-d24b581b8114", "value": "T1AE24D000B190D2F5C712013E6825CADCA5ADBC6DEFE0A6373B5825DF5E782A3716D392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920171, "uuid": "5e50a146-ae78-4dcc-9398-fe1b718c0041", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920171, "uuid": "c53c0840-27be-4b95-bfc8-c5d179015380", "value": "3072:oFRgRGaayQ/EfOisbFTLBk/GzK5orcPI1ZedKq48EuSzsz:oFRAGoQLbF3k2bcPI1mKq8uSz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632920171, "uuid": "a7950ccf-335a-4adc-b4a3-e520ff98aeb9", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632920171, "uuid": "e77ee395-4ca1-48bb-ba0c-a0ed58d07ee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920171, "uuid": "d3188328-d875-4c93-b8f5-45ff9a532936", "value": "view_2021-09-29_07-17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc7ccbf-20bf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632876605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876605, "uuid": "69462de7-bfe3-41d1-9bda-0feaa4cf885f", "comment": "Malware payload (Mirai)", "value": "3e0afb5895d4d4fa77ea61cf0aa00a3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876605, "uuid": "72f2ea53-0af1-47f5-b50e-37e26812f608", "comment": "Malware payload (Mirai)", "value": "5a92a392f426b82e096b3e14fddfd9f766f1d559f66a29c1bc4c09613badac34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876605, "uuid": "b4fb0fc8-4480-4e69-9f2f-64d937c7bd19", "comment": "Malware payload (Mirai)", "value": "9e85d77edb3f245e8dd1c93196c50e6a280eff39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876605, "uuid": "ed009ae2-40c4-4aae-9c74-d055a86d79ac", "comment": "Malware payload (Mirai)", "value": "5dcac81f6138b135d2372190e782aeb1cba58b3f1aed96f0c44276735e9f01e61b242d1aee324a1738199da9b2dcaf84", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876605, "uuid": "2dbd6fa2-bab1-4c88-85cb-e9d16bebbba2", "value": "T1406302F31A39D1D1C7548D319E7C6A255F1C3FB918A93337530C5038A6B79036AF9A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876605, "uuid": "6f9d45ef-8f01-422b-90c4-c4078568cbb4", "value": "1536:pOFfVaaVZsn0bALV5O0chiMa1eCLdV8CV+GxN7icRK8zCloRJVxQ:pOFfVaeZIp5OLHCLd68V+cRK4CCJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632876605, "uuid": "9f259124-52e2-4f4e-9b25-bf89b5fcb432", "value": 70920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632876605, "uuid": "3e338f2c-3c59-420c-a333-84898250ff38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876605, "uuid": "9caf7370-5ca1-412c-8b9c-564bb6800dd0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520fd9b6-20cd-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632882675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882675, "uuid": "db445f66-a63a-4631-a738-85793caccb1a", "comment": "Malware payload (AsyncRAT)", "value": "ba52d6cf583ea0854bb216dff5c19552", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882675, "uuid": "84c9dcf0-e22f-410b-8a5b-c7ed9014c7d5", "comment": "Malware payload (AsyncRAT)", "value": "5ad065f1c6a074daa4db9b8af2795bd2bece8d9d5ca5f88a76e96896f688ad2d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882675, "uuid": "31182252-92db-47a8-b700-f29a661ed58f", "comment": "Malware payload (AsyncRAT)", "value": "63a1b0da4fb16b4d0438a042f87543eddd9827c6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882675, "uuid": "7bbb1274-ff67-46f4-8b1a-b95907b2d5bf", "comment": "Malware payload (AsyncRAT)", "value": "f731e5f42340a98582e3fdb4599589a1d21b7557505be628297a08a791265ac31cfee45068cc266f8256084b3e3d76c6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882675, "uuid": "dfb04d7f-3aae-4653-88cc-3b50525f71e4", "value": "T1B361681DA7BCB452D6DB08DCC509FEC608FC54E41F8EF2122BE6BA1E648C85B149C559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882675, "uuid": "6c71be8c-60c6-45a0-8029-58b4831c035e", "value": "96:PWfwmhg6rmkxdwyXo97iFHT7mohH4wyXaB414XHTw8NN:PMHhgrkxdtY97iFlhYt44i3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632882675, "uuid": "6d514d89-d8d7-40fa-ad98-f154b353f1c5", "value": 3329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632882675, "uuid": "b961a11c-8ada-4c97-8210-9af0c89a0ec9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882675, "uuid": "cd72cf5b-0784-4079-999c-888f88b4203d", "value": "payment.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d89cd1e-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901056, "uuid": "e53fd9d7-3158-4fa6-a7ac-e65dcab11f11", "comment": "Malware payload (Dridex)", "value": "1d71f93fd94aa7f169bfba747d7c1ab1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901056, "uuid": "1cd29674-590e-4a34-b4c2-30a4d865f4c4", "comment": "Malware payload (Dridex)", "value": "5aec30fce8d20abfe90b49ea2313cf1f8c6dfe826445acae6076fa203c905376", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901056, "uuid": "757a249e-af76-4dce-a3a3-8c3abfddd0c4", "comment": "Malware payload (Dridex)", "value": "e3504693b3a6dc68d5bbdcdf51de13906e6bac24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901056, "uuid": "63af0b8e-a196-40bb-b384-0e730829b470", "comment": "Malware payload (Dridex)", "value": "56e1ac812d50cfadb4343092b0142401036ae1147b4375cef217791f94f4cdf090af90cdf1b2948efb88ebb12d9d7e73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901056, "uuid": "c2151b3a-d749-4f6d-8848-05a772b7c847", "value": "T18395E020EF69E1E6C6B89F3E9408352717F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901056, "uuid": "3172fc39-d334-480f-925d-f5a95df80d14", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901056, "uuid": "557b56a9-0e33-4852-9f06-903fe9786308", "value": "12288:xVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:AfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901056, "uuid": "9c773722-5f02-4e4b-8e56-1c9bdc185738", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901056, "uuid": "e6abc60f-1f70-40a3-9f25-4a653480567e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901056, "uuid": "5114d967-8cef-4c28-9207-f6da2a16b145", "value": "5aec30fce8d20abfe90b49ea2313cf1f8c6dfe826445acae6076fa203c905376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9fc9c1-2119-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632915305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915305, "uuid": "c9357f3c-2a22-4d55-afa8-592261961edf", "comment": "Malware payload", "value": "e223d5116c596f1907bbcf9e163f716f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915305, "uuid": "b3ae0593-d5b2-4f9d-8259-d979053db862", "comment": "Malware payload", "value": "5b1e2006bd09f16c7d346ff1a24e665f32a5b4182cb62084a4234914e4d5ec9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915305, "uuid": "4cb9754b-4a57-4a9c-98a2-045addc73d32", "comment": "Malware payload", "value": "7b2bfb9e283f576924a505da205071db246924e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915305, "uuid": "1299383e-20bb-436e-8205-bbbfc8665d66", "comment": "Malware payload", "value": "5ed883f681cdae962bfe783e8099727233edad5aa2fdca8c4e8deb81ff455c477351dcade98399f760c1fe3c8d16a8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915305, "uuid": "ba8a61e3-d2b3-4467-a9f5-e8cfcd3ba109", "value": "T14FB33C30DA51D039CC9721F856AE93BDF91C6E71134424C793E67AF2A3792E8AC3149B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915305, "uuid": "14afc5b1-d9fc-40e9-a1dd-54cd7e895e1e", "value": "1536:w2iFxtxHaFv65tcMcVlv3GJ4uifk72xgXhDukxsZMiRrCQYpCD+:w2i+F2KM652JtH2SX/xEMipCQYpU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915305, "uuid": "1988a687-beab-4865-8280-62f864d5093a", "value": 109739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915305, "uuid": "97e4ee65-f0f9-49f5-8dd3-7d81c238968b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915305, "uuid": "afe4956e-1915-4380-9d67-a01d4ece4b86", "value": "e223d5116c596f1907bbcf9e163f716f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7234ebf-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898361, "uuid": "641dfac9-a8cc-4bc2-a0ad-ca50949c27d2", "comment": "Malware payload (Dridex)", "value": "713e1cc21d07fca6dbe765a3e45f564a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898361, "uuid": "3fd8b99b-2ee9-4769-80b2-402a4cf57a5c", "comment": "Malware payload (Dridex)", "value": "5b61ce624bbef3b5b1328ad76c0852108479ecf893c5fe223ff43f2f4187bed4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898361, "uuid": "9dec23e7-4e0e-4630-a6e7-44af928c3328", "comment": "Malware payload (Dridex)", "value": "c705cdcb770a717db3c7237449019040c2be3290", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898361, "uuid": "d0e47cee-f469-4259-833d-ad41eb9f076e", "comment": "Malware payload (Dridex)", "value": "21baad9d90bedd2936e5babdf6f53cf02f4468151e0f2502c5939b1c6543e73c4cbda8c15b350429af317e4baf4c0981", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898361, "uuid": "8e0bb14e-6bfa-460b-92fb-3340fa875880", "value": "T1A2266B10FFF205C3C09DF739789D3415B2B3AA65811F8A1D824F131E6CA5B912E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898361, "uuid": "8c40bfde-7ce8-40d8-a4bd-3c4a7e38a5ff", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898361, "uuid": "9a568706-5351-4c65-af5b-bd669cc10ce4", "value": "12288:YVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1ZSzF:NfP7fWsK5z9A+WGAW+V5SB6Ct4bnbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898361, "uuid": "6f7c1370-b190-4c36-a4db-ce251f85535d", "value": 4513792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898361, "uuid": "1853d7f1-b046-4df7-afdc-4b7c34cf5d06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898361, "uuid": "96cc6482-d9ed-46ed-830b-4bdfa780dffa", "value": "5b61ce624bbef3b5b1328ad76c0852108479ecf893c5fe223ff43f2f4187bed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366e6ad6-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900238, "uuid": "202b5748-d488-4ea6-a14e-4925cde88589", "comment": "Malware payload (Dridex)", "value": "fc99fae7a8c3345905fc65b07a6c1a6b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900238, "uuid": "38fab4f0-5d19-4dfb-9563-0de00e7c4dfa", "comment": "Malware payload (Dridex)", "value": "5bd345b55778374712cb2de2734f3a2be404f2d78f70d9854293cd4b41bfcd69", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900238, "uuid": "e685c5e4-dffd-438e-8ed6-1f176e9a6785", "comment": "Malware payload (Dridex)", "value": "85b649fe42fe53948dc85b9bfe30c0b7837d88ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900238, "uuid": "66f98738-26c0-4d0a-af59-bb5c24c17d7e", "comment": "Malware payload (Dridex)", "value": "e8392b58167421e971072fc71c06f8cdd6c3a6e98124d0e8c201aea68c98aa9898fd342cb9bc003d90996c8dc0b369e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900238, "uuid": "2f1e5aa1-d8ab-40e6-8dbf-b982e4d6d709", "value": "T144D5E010EF69E1E6C6B89F3E9408352327F93D75110E618CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900238, "uuid": "e7b7da26-b2bd-4621-a156-c52c8012e858", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900238, "uuid": "abb94ddb-605a-47b8-ae03-d70b8314e702", "value": "12288:hVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:QfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900238, "uuid": "eef027f0-dfda-42c8-a689-3ed15254b6a3", "value": 2887680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900238, "uuid": "48f76f9d-d938-4117-b34c-f9ee5f3f9533", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900238, "uuid": "4d107dca-6f66-4018-88e7-a0682f2ecf9c", "value": "5bd345b55778374712cb2de2734f3a2be404f2d78f70d9854293cd4b41bfcd69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d42e19-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632903138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903138, "uuid": "49ccac4f-b30d-4602-8838-5f9866a97319", "comment": "Malware payload (Tinba)", "value": "4d4b9cb42fb1148c095a326543e4c861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903138, "uuid": "19f6900b-3036-4f19-b484-a0ba03de98d2", "comment": "Malware payload (Tinba)", "value": "5c5306cc8550ffc5ece59c4b34ce79f9ee0a07454df45f1e4b4ebd99b969882f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903138, "uuid": "47572416-0c12-4020-9c39-1deee1eda90d", "comment": "Malware payload (Tinba)", "value": "a28d6039e8658be9d1df770119aaebc42e4937bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903138, "uuid": "75c4e6e8-82c4-4cfb-8a62-efedcc979bfb", "comment": "Malware payload (Tinba)", "value": "27b91833399dd78516d987fea9d0f55ad23a973986a162f5189236d9ee7ee35853eebfb53cbfd6c5a1a4866999bf88e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903138, "uuid": "140a283e-f927-47eb-a367-2fd718a86de2", "value": "T1E1F2E0923B59E122E0E7DC3319B5680B9632C9699E5E4F7B1AC825299C74390BC43B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903138, "uuid": "2780989c-2dc4-4391-aaea-9a38b261794d", "value": "1f818038e9a7c00938fb82807a35fdca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903138, "uuid": "0a4ea39a-c806-4fb2-a0ab-65347d5c8a01", "value": "768:pp22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:ppYoX58z1uirL98xMWnT0OQ9J2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903138, "uuid": "538aa2dd-e45f-4c19-a497-b50e48b318f2", "value": 35332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903138, "uuid": "01f6cac7-3ad3-4866-91d2-0ebdec7d806d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903138, "uuid": "57c82271-7804-4f79-80b8-05af4d7689b0", "value": "5c5306cc8550ffc5ece59c4b34ce79f9ee0a07454df45f1e4b4ebd99b969882f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f119b94e-2110-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632911718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911718, "uuid": "f531e5d3-54e1-4ab2-b1b1-f423091afa95", "comment": "Malware payload (RedLineStealer)", "value": "5803e6cb630745cf9493a14e4c859c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911718, "uuid": "328c5342-64ee-4d6a-b98c-80ec57261816", "comment": "Malware payload (RedLineStealer)", "value": "5cd56fddf5ebdb83ed61c0a86e0cf07915312bd1b4fc77e7b27064bf64e109df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911718, "uuid": "7fcf8279-6180-438a-bb7a-a0db4e94fabb", "comment": "Malware payload (RedLineStealer)", "value": "e2d1bccca1007ddbaa5760bd82d1ba1d09c1f6b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632911718, "uuid": "d21e4f16-083d-4536-a925-657eadfa7b44", "comment": "Malware payload (RedLineStealer)", "value": "b7fa98edb5513ab16aa1f4c7706d77d6cfda10b9e932ce05bb93f79dba0c51364ebb3cec4312e8ac0070b2555caa7844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911718, "uuid": "9ba573a5-0270-440d-abe4-33e3277ac5bd", "value": "T18405CFCB2C6497CBFB5E01B4F6392B5801B6DC28C9DBB2DBE549B13304767A51921CCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911718, "uuid": "3e423177-ac7e-468b-94bb-0da793bdf026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911718, "uuid": "0ae3fc09-946a-4139-9680-9eec03ae4a32", "value": "24576:yNFNi+hBr8UAGi2v+kMTNQ1s1Tl99QQdt7:nbNQ1s1Tri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632911718, "uuid": "b7cc0985-03f0-4ace-a4f8-c0a73af9fbbc", "value": 802256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632911718, "uuid": "12704247-22b3-423e-8e75-aa1c0564e9ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632911718, "uuid": "35da7e70-81f3-4bdc-bef0-d1d772114da9", "value": "IMG_534912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861cb992-20ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632904238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904238, "uuid": "5d70b2cb-68ea-4123-b448-377bd7d06cd2", "comment": "Malware payload (Formbook)", "value": "29270e068715b1102897526108751c45", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904238, "uuid": "ba13361f-db0a-474b-b9e5-9c37320dc337", "comment": "Malware payload (Formbook)", "value": "5cdbd832337e356e9c0f71f7269418a02ca1132ff682062167ce80d2fd255cb2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904238, "uuid": "b823782c-897f-459a-a49c-bbbf44c4a2b9", "comment": "Malware payload (Formbook)", "value": "8ef443371124b105662df800e94b63198bf6d24b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904238, "uuid": "9d151d11-4c79-4fa4-ad53-3b933b73d635", "comment": "Malware payload (Formbook)", "value": "a8d900b05967736f17c61004c7bfcb42e312b7ed791f86ef385530b94e8ae21d7828b231a81733b7ba1cbe24bfd12519", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904238, "uuid": "c617dd59-86a5-47ff-b0de-ff738ad062be", "value": "T12C02AD9587618088F5F10C749833D5E2D14A7B13F1CF0849A532F406DCA23A7FE2AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904238, "uuid": "634356ad-bbc7-45c8-a147-1c01f5b3bfca", "value": "192:KuGbWdCrUQ9zxC7QTTKv80jpI+9Kv6bh4baL7p:qgCr59zg7QyfjpIlvEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904238, "uuid": "cec4bbaa-cb0b-4275-b7ff-19080fb61a94", "value": 8482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904238, "uuid": "f1bc3385-ea08-4188-963a-501cb1a73c78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904238, "uuid": "2a9131a6-cf75-4355-9682-7b35e81fc69b", "value": "Xpress Business Services_XPRE003_INVOICE_INV3039327.PDF (75K).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb97f925-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902287, "uuid": "45dd44ec-8a64-42cd-bacc-351101ead024", "comment": "Malware payload", "value": "dcd6aa11c18056d16a2f2ffdb71fb6b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902287, "uuid": "8328d0da-a609-4ad7-960a-73e84911d80b", "comment": "Malware payload", "value": "5ce864a15ab764c0d12a265b37463e2041a2c0a9522cebe884df3e3c4e708901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902287, "uuid": "13ea4e62-e61f-47c9-9606-f806fa869346", "comment": "Malware payload", "value": "557f7125b2a9ff06354615b9712b11a2888a9a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902287, "uuid": "2e30117a-9986-4881-a320-1cea8746940d", "comment": "Malware payload", "value": "23a5ebcc770de5cf6630f95b771688b84dd2c1358e53e24575abe54902e33cdb04c7395e8a30fc0a62e47596f05d7486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902287, "uuid": "c08dbdfc-9e06-43b0-8d2f-a7397ab21712", "value": "T1F473BF156E810D08E7F80B3205DC36DA06BFFB4EE67057CE5D1E65A81B37B9099E0764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902287, "uuid": "ceaace6e-4165-485e-9b84-d6134a2fe4b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902287, "uuid": "ae63d4c6-d91e-438d-979e-80e189200de2", "value": "1536:4V5jS6dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC67b9/+1TK:4V5jS1n7N041Qqhgjb9/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902287, "uuid": "766fde5a-f615-41d3-ae1e-da2d8c15da25", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902287, "uuid": "85c16e85-7cff-48b4-b73f-ddf83cfd7cac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902287, "uuid": "87d198ba-2ee6-42c5-af9f-c5dbddc2473e", "value": "5ce864a15ab764c0d12a265b37463e2041a2c0a9522cebe884df3e3c4e708901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb9c6c0-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902294, "uuid": "529fe501-776c-42a6-b977-52b82569d62b", "comment": "Malware payload", "value": "330649b6a9eed9cfee298bb3a07b596f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902294, "uuid": "835d7219-3c80-4b96-9a80-7f9a204b13d4", "comment": "Malware payload", "value": "5d35bc06d116195055c321c2dba088d2469a38d21f636a96c91634e4f03b07ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902294, "uuid": "f50ce657-f43a-4e9a-bf7c-cbbb2eaace66", "comment": "Malware payload", "value": "5005ea473bc9bd48e49a90ae920d4cee44750a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902294, "uuid": "6f1a1376-567f-468f-bf34-84dd42f1bc1d", "comment": "Malware payload", "value": "5359422f856be92ff08b8116bb363d921eaa9d99a52cefc9babdeb4542020871a0b56c3e781ea19d508732d494546baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902294, "uuid": "4040aa87-11c6-44fb-9347-455f0ab42a63", "value": "T10473CF11BF812E48E7F91B3316EC25D607AFBB899DB097CB682D89D84F37A4084D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902294, "uuid": "980f1a30-7b74-4582-9a2d-b24cb7b47f35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902294, "uuid": "ea5a78a5-d94d-4984-a297-c82a82d06817", "value": "1536:6CHHM3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQteY9/U1Dw:6CHs3xSyRxvY3md+dWWZyeY9/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902294, "uuid": "d78e4bbf-ea15-4c05-ac2a-0eff14228658", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902294, "uuid": "74791059-59fb-4161-ab36-180d6151e82a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902294, "uuid": "9f9527a3-a2c6-46f1-9409-3f2cc53c4441", "value": "5d35bc06d116195055c321c2dba088d2469a38d21f636a96c91634e4f03b07ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142fc37e-20e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632892020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892020, "uuid": "ae4d221e-769e-47ba-abd7-ae80c02e3fd4", "comment": "Malware payload (Loki)", "value": "16f7cff4d92d77523c3ce8975688f021", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892020, "uuid": "98d5a1f3-42aa-435e-88aa-0191e681859d", "comment": "Malware payload (Loki)", "value": "5d3dc10faa9a7526ae47298fb65e3fc393337260b5f6c98f731b0096e623a153", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892020, "uuid": "b96853c6-0666-4a51-9614-ea69fed1a9b9", "comment": "Malware payload (Loki)", "value": "d08cc15b2f372ee091c85151d7c50ce127a1f57d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892020, "uuid": "781b46c6-9d96-4e6c-ac8f-5bd846d8fce3", "comment": "Malware payload (Loki)", "value": "adc6939b4a4a8520be3c5104cd815da15bde11e11e88727a0f34be46cc18b73d18c42d1aef88160175314c56e2eba453", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892020, "uuid": "d0d41f33-4540-4dfe-b74f-8ac43493178b", "value": "T1A53423916260B5E473F906B7899FE824713C9FEA28F07F77C088B9A196E4FF04D99414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892020, "uuid": "b00ac198-e538-4058-85c1-8d8eab397a24", "value": "6144:Cx5l5WnUlVi9pHKgu6F2Ivg3p9MVKM43BsrT7hkPFbNX:CjzWn0VIZt3KpGVv/rXuPvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632892020, "uuid": "7891feac-46bf-4645-b467-eefd2f76d8f0", "value": 239158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632892020, "uuid": "a1063053-8ec2-40b6-b0b3-a541e240bd94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892020, "uuid": "8c23a438-1530-4a2d-9d08-caf25f5980bf", "value": "payment advice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e3ddb2-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632909250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909250, "uuid": "f08ceb85-9f7d-426f-b066-89fbb29bb914", "comment": "Malware payload (SnakeKeylogger)", "value": "0835d9097fa861ee3d27494fa5455d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909250, "uuid": "18ce0c46-df49-40e0-b9bb-eb9893d08c28", "comment": "Malware payload (SnakeKeylogger)", "value": "5d9efc65f34a6fb7151c8f9330d2387b441a6341e17f8fed3a0526028080a307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909250, "uuid": "ac59dea6-e840-4266-8687-2719b4429d4d", "comment": "Malware payload (SnakeKeylogger)", "value": "b58e281bfdf22bd1a354eaa50c5888a4dedd2cbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909250, "uuid": "9b158626-0948-45b5-a4d5-eed05e2ef99a", "comment": "Malware payload (SnakeKeylogger)", "value": "bd52eeb24a1b5db9be708041a1987003141543040d75da7a113585110539495fa4f914727e97b2fe0cb8c33ecbf9ee52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909250, "uuid": "9df84147-d1f2-42c9-9003-8a734b804688", "value": "T150053B394D2682F787EEC66CD08C1BCEDEA6A4837B919F1EC496D7D2025770BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909250, "uuid": "bb1890c5-293a-4b3a-aaed-ec15cd172f5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909250, "uuid": "549465fb-f69f-4768-b3be-088370691a4b", "value": "6144:Uf0T+UGrOaq3hB9qtvF7iNnEzvoDWIKa93MRjcogdSv0A/Pj1nqrvdUD:2IOOBqXanEzvoDW098NNhJnWv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909250, "uuid": "2c4ed859-843a-4837-b17a-7866690ed66d", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909250, "uuid": "29febf67-569d-43ae-982b-48ff00afa901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909250, "uuid": "dd3da544-5fa9-4e4d-8e41-9e992830bbc3", "value": "0835d9097fa861ee3d27494fa5455d96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb60b1bf-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632909159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909159, "uuid": "4099762b-062f-41ea-a194-daf2c2f0b2ab", "comment": "Malware payload (GuLoader)", "value": "7502a82156bca60a8aadd2b3cc1ccfbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909159, "uuid": "8a51c162-6b62-45be-9a84-cb95321bc667", "comment": "Malware payload (GuLoader)", "value": "5e0716efef9b86fed46cec2da9116f481add142b65aeb45be6d16666ac583404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909159, "uuid": "572977db-20a5-4548-9828-5cd5fd204e17", "comment": "Malware payload (GuLoader)", "value": "2f0fe3beb1d88074283c2234600edf6f37d43e5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909159, "uuid": "4efe858f-a4c7-49d7-8135-41c8bf5da4b7", "comment": "Malware payload (GuLoader)", "value": "530cf6803755717ca78f7a4bdb3ddd2db5d2074212745d3a64f67e035ab61fc966fba13e1c0266807a8777a785c7051c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909159, "uuid": "889e5b12-9a88-4e21-89b4-b34dbb04c130", "value": "T16D04C6496E78AC2DF1CA3DB4A865649913C63C03FB8452AE10D5F3FC76309EE6852B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909159, "uuid": "c755c59a-26f5-4fc4-84c0-2ec6ecb3c46e", "value": "831c9926df4754b736e1ca092f4fb7e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909159, "uuid": "99b73dc0-b5fc-470a-af22-9ab3da00b213", "value": "3072:5T6TxJ486kf7WcznwUJEpL8jF0qUCK662nYyQjg+Yi:5TCBtzV0qtK6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909159, "uuid": "540f258b-2461-49e1-bea7-6d98d5547eb3", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909159, "uuid": "2b1d2b62-9394-469a-a213-19e23d62f3c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909159, "uuid": "6898fd23-2f13-4fb6-ac02-3dedaa91f47f", "value": "7502a82156bca60a8aadd2b3cc1ccfbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b72245-210c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632909849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909849, "uuid": "cb3b07d0-1736-4560-ae47-56945d6cc161", "comment": "Malware payload (Mirai)", "value": "4007f52ff98a4da86dffc63c78deac26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909849, "uuid": "8c985c39-6b70-42cf-90ec-c7fed607dfd2", "comment": "Malware payload (Mirai)", "value": "5e16b5cadf6ccac73a57d623a1df00cb67d9318c5cedae4bc54b303095c1b336", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909849, "uuid": "b7c7415c-e0f7-44d6-bec8-b18e95aeafc1", "comment": "Malware payload (Mirai)", "value": "e571334504edbdae11b2da85518c9e587653c6fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909849, "uuid": "8fb038b0-8997-4b3a-b64c-b26089fd6184", "comment": "Malware payload (Mirai)", "value": "acf9c7fb93edc9921d289b693c505f304274ea95ae9235a11f823c8f96f9f47735e1aadbd5214589cb08fad50a29af0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909849, "uuid": "91d24d9a-6202-46a5-967a-25264785a258", "value": "T1CCE35C46FA818A13C4D5137ABAAF414A3322D794E3DB73079D185FB43F86A5F0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909849, "uuid": "628399d6-8593-4a1e-8b0e-7a6fc5ba4a41", "value": "3072:za/v7n0i1moIFcu/mypaEEFZAHqz9wo+0BimDM/95U2jZk:z8v7N1rUcNypaEEQKX+bGM/9rZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909849, "uuid": "23fa7dc1-c63e-4c31-9ff3-b08ba1724058", "value": 150579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909849, "uuid": "d6290ca4-9da1-485d-9042-049f615d5290", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909849, "uuid": "cd7a6abd-e6f4-4e01-abd9-21f454bf3dd5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43694b94-2119-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632915293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915293, "uuid": "9205cda5-966c-4dfd-a301-17bdb0c83928", "comment": "Malware payload (RedLineStealer)", "value": "bb3ca7fb20846e85f1325aa2b3c8a51f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915293, "uuid": "c7c1302b-7160-493a-b92e-5b4a1bf9a9d4", "comment": "Malware payload (RedLineStealer)", "value": "5e4d5246c1a9a051321fefef3bc3b37e4388712a6b090acf0bd61aacd23a1f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915293, "uuid": "3d0988e2-c94d-4d13-a3c2-1b071b7b2989", "comment": "Malware payload (RedLineStealer)", "value": "be8ec3635b7756187b00e05050697e043617ef73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915293, "uuid": "01d6ad5b-b0f6-4942-b76a-41e2f7050f8f", "comment": "Malware payload (RedLineStealer)", "value": "6db9dd5a2b2f4dc6d568953fa3b085e0a34b1054aae2c2efed530fca2a5c2f3f433e2c2dc1ac2fe40a4418bf0dd8362b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915293, "uuid": "f408a4c6-77e0-4510-8b78-9b941f52eea5", "value": "T165C5231077F0A211E4F79B395DB38AC16EB5BE816D32C35EB619A50E4A71A10EB37331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915293, "uuid": "2715c4c6-3ed9-47e3-a4b9-d0e1ce799033", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915293, "uuid": "323e8f44-d74a-4247-a3b6-d56c619b19e8", "value": "49152:QyIjegleg3dc/UHHU54llsRGmubN7/qxk7Tp2m1EatoGSERbYSJ6VG+Rx26:QRDcAGuHX3sX0ND7XEcXmDVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915293, "uuid": "1aefc765-d24d-4cd9-8bad-0a4c6c15987e", "value": 2691584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915293, "uuid": "6ff6ca60-dc46-49ba-9812-78ab9fb8dd1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915293, "uuid": "4cbbc219-9511-4558-b60a-28b676963a3f", "value": "bb3ca7fb20846e85f1325aa2b3c8a51f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcc027a-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632898422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898422, "uuid": "86757a82-1e6d-4b40-a467-f9864f739cb5", "comment": "Malware payload", "value": "20ba5ae260a8d1ba41a1c28cb25cdcdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898422, "uuid": "e79134bc-f663-46c9-865a-740c9880084a", "comment": "Malware payload", "value": "5e7015f18de9efb6aeaec4fc4a4991031d7a03dd7530391858ea8379db544483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898422, "uuid": "6427531b-0713-42a1-8bdb-634e9b98bcb0", "comment": "Malware payload", "value": "f6713480a3a3a8c224bd355a6ebd74b3646872da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898422, "uuid": "893a5716-205a-4d2b-b0d2-d555d39aeec4", "comment": "Malware payload", "value": "72659644edf15e23e19ed1c8aeab8bc2507440206747beb9f43707d3806715f5c0f2ce964748ea2bde6ab4c52646f1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898422, "uuid": "f167997c-7b9d-4e3c-94a1-98b6160ede31", "value": "T19906901163F90996F6F32F30AEB481545B36BDA99EF6C62D3144428D0DB6A50FE70B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898422, "uuid": "580f9926-423e-43d7-bc10-fdbc3dfb07be", "value": "29c4c5f8766667965cf6248336ce2ba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898422, "uuid": "140d65bc-3c6f-4c5c-bc7e-c5e9794cb348", "value": "24576:00FLx8hSA/6oTNTRh3Qh3OXFZr6Er+M3NsoBAYdlKl9i8L5DBMY:00px8UYTN36sZv+4BAulKl9JtaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898422, "uuid": "64ae7872-5407-4406-9a5c-304bbadf5f5a", "value": 3934720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898422, "uuid": "a452ca8d-504d-47dd-91af-500f223ef007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898422, "uuid": "71436e44-15ec-4a03-a85c-4232c9a3c5ca", "value": "5e7015f18de9efb6aeaec4fc4a4991031d7a03dd7530391858ea8379db544483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a849386-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632908755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908755, "uuid": "d768e3c1-8e16-4e34-9e88-d76f200b6d20", "comment": "Malware payload (SnakeKeylogger)", "value": "16416309086597a37b9e5f5ab42ee943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908755, "uuid": "95b7b9e3-8fd8-46f5-9694-97f24f9c8a8a", "comment": "Malware payload (SnakeKeylogger)", "value": "5e985f202b60c0d5bbb1f813f0aa03c1accf5a3e8be5975380569cd8ccac25e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908755, "uuid": "19858e62-95b0-4715-91a3-0c87ecd17bcb", "comment": "Malware payload (SnakeKeylogger)", "value": "038ded3323b4235188989f60634f15eefe1fdc3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908755, "uuid": "9cd8015c-3ee3-42fd-9d1c-0dcac1b51063", "comment": "Malware payload (SnakeKeylogger)", "value": "ff0ced21b76a8e0f01f7e4b61a729d82a01ae4b906008c78a7421d014ce6eea8f93140674bbde1c3acf2d67d31ec535e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908755, "uuid": "86011546-ba7a-44bb-acb0-1ead48154ce3", "value": "T1BFD46C6DF61CE29EFC0903B021257CD425E81CAD197CFA27BEA6B1E230AED7551F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908755, "uuid": "8486a87e-8215-49c3-b5fa-576242ea3077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908755, "uuid": "00c3df47-ae07-444f-97b2-09f9d0ee0388", "value": "12288:WD4VHfQe6ZyWshg+qbZxTZZWunAWvHd48icqY9idAKGJyo11vfjLMXg8sW0c:WD4VHfQe6ZyWshg+qbZxTZZWunAWv68F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908755, "uuid": "c2454012-2733-4f02-9bf4-beefbb9c010c", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908755, "uuid": "eb4d482c-236f-43b9-abad-85204888690a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908755, "uuid": "f9cf3cac-156b-452a-a52d-a5bad4bae212", "value": "PURCHASE ORDER QRIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ae2c11-20ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632883034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883034, "uuid": "d3f1f8c4-ea13-4dae-8a35-54c91e93605f", "comment": "Malware payload (Mirai)", "value": "2938746602cb2fee41f9df790ee6d777", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883034, "uuid": "1a4096cb-3349-461c-9693-3c60fa466067", "comment": "Malware payload (Mirai)", "value": "5ecb0d2032cd53f6e85d25f610e1aa8710196e3ba1725c4a8d459ecd2ec6ca78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883034, "uuid": "9d137eca-0e51-4070-947b-4ed7571eb896", "comment": "Malware payload (Mirai)", "value": "57aa4ad9bc8cc91fc186bad338b3134a1454cac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883034, "uuid": "8d1b4aee-0e52-42cc-a43a-ee7a030c7083", "comment": "Malware payload (Mirai)", "value": "6c2b694a5fc8df2928fdb8d8387572d40dade2b5ee3210827a388846ee4a24ca18a3568c344942b3ef0bb9ec796af4e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883034, "uuid": "511eec42-2bb9-4a10-9553-e1cfed551d88", "value": "T1EE2302AA5500740FEB79797B227C0EB9999DBAE270CD4729D203688CB65FC1EF41C620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883034, "uuid": "ceef1dd8-9397-4424-a280-34256f60583d", "value": "768:BzVZHXaqz2NTQI7ULNKQ7nXkmE7O23k0y57IBOfsQN2CTRa3W7:BjKqaNcIAL0uXk7D3kH7IBOEQNpRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632883034, "uuid": "af58ee7b-316f-436f-9920-2e6a637bb5a6", "value": 46716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632883034, "uuid": "4fbb1434-b5d3-4457-859c-22837e8ecfd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883034, "uuid": "94c3a272-c1cc-49ef-9c0f-0c2f2a814c48", "value": "2938746602cb2fee41f9df790ee6d777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3502437d-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901095, "uuid": "34a8405d-5888-4203-9059-740a4fcf92e5", "comment": "Malware payload (Dridex)", "value": "0cd894189879d65dc6081d7076f13b7d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901095, "uuid": "4183a935-4487-47a6-ae36-fb6f2af4530c", "comment": "Malware payload (Dridex)", "value": "5ef0fac7ca6022e845b37b052731facee4d005be0077d7379e95e2d6a38c1551", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901095, "uuid": "13108447-406a-4892-ac37-c843a2a4798e", "comment": "Malware payload (Dridex)", "value": "c8c72ba60556566f11e3ee017d2d2e8f5ea472d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901095, "uuid": "7efc089f-6ece-4fce-8faf-123eede15572", "comment": "Malware payload (Dridex)", "value": "daa9518a4ba6ec7f5600524743aa804a7c1227fce9b2505c6038d683fbdd41765daa8cd3da4404f96da62f9e6a8fc51e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901095, "uuid": "1cc293de-a213-4dff-8be6-99706a22343d", "value": "T15195D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901095, "uuid": "0146a76a-4413-44d3-a1b5-d68b09e3dd8f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901095, "uuid": "5c03d446-aa07-4912-ade8-ae4faff14a57", "value": "12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901095, "uuid": "60b998db-a759-4072-91a8-f179c752ed87", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901095, "uuid": "438c871a-5b5e-4072-8db8-a380ff533081", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901095, "uuid": "17860472-b115-4691-b1cc-1acb088db240", "value": "5ef0fac7ca6022e845b37b052731facee4d005be0077d7379e95e2d6a38c1551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678f8af3-213b-11ec-843c-42010a9c0014", "comment": "Malware payload (ServHelper)", "timestamp": 1632929956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929956, "uuid": "34f65078-07ee-4392-aa09-19f851466119", "comment": "Malware payload (ServHelper)", "value": "74f029d2fd587f9e25091f7832bea2f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929956, "uuid": "5c318297-1488-474f-9912-7ce39c81e1d2", "comment": "Malware payload (ServHelper)", "value": "5f0c0223d10468b9130a240432342f4056c6d7c2f6f89469c9d971bcea31255a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929956, "uuid": "6cb06cc0-2a6c-40a9-ae92-14611c110fa3", "comment": "Malware payload (ServHelper)", "value": "76fb2d051d6dc938ba2b7131ef1b21c0fe2ad60c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929956, "uuid": "84d5ee32-b824-4d29-a1d6-9b5375fb186a", "comment": "Malware payload (ServHelper)", "value": "d4db25bfc1bff6818910b7d7a6b10abd539e651333ca50a727de12179177bb0fb22c437e2014f52b8f6f598dcb14c858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929956, "uuid": "400ef3c7-758c-4012-ac05-c6a7039f4172", "value": "T16F56F103BCA164B9C9E9C23189B592913731B849073577D32F55A6FA2FB77C01E393A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929956, "uuid": "07107fe7-0dd8-45da-8cc0-59bce06629b3", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929956, "uuid": "5dc62a1f-9f7d-4950-a5a6-0dcb92d45bba", "value": "49152:aEs7HCrb/T/vO90dL3BmAFd4A64nsfJdBOGm5K6UVJ9eLZNVj/lHoRQ1wYr9MYE4:aEQjgGHmAQQQQQQQQQQQQQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929956, "uuid": "be6cffef-0bef-4007-ae84-1793af620993", "value": 6024192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929956, "uuid": "2e342cb1-a24e-4ce2-a423-766fc4f5e430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929956, "uuid": "bf39a980-ab39-4f5a-b865-9966d6841188", "value": "74f029d2fd587f9e25091f7832bea2f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9e29f2-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901589, "uuid": "cffd6bec-d460-4bee-b9a9-beb2bd666f5d", "comment": "Malware payload (Stop)", "value": "eaf7871769ce66ba1c864aa5cc02eba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901589, "uuid": "76ba1138-a0c7-40e4-9d92-1c52c8fad428", "comment": "Malware payload (Stop)", "value": "5f1d4edb0181437d5c6e270977eec68d3daf4bd63edbc4c29e691573ca2ed9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901589, "uuid": "cc672e27-76d4-4beb-8c20-09415f67d2ec", "comment": "Malware payload (Stop)", "value": "9e77fe61ddeecd0dc26a77c3b20f72a03f9cfef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901589, "uuid": "4a756847-5856-4c49-9d32-74e7ab5f2607", "comment": "Malware payload (Stop)", "value": "25a617d5180a7bc247bea341e2174c7783858a4770803196ce367b7cbcb97a44ff5454bed277d224dd36951230ab4039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901589, "uuid": "01e11e1a-f9ed-4406-8c5d-7840d7fd4658", "value": "T15905022073D0C035F8FB52BA59BED378692DBAB1A72841CF92D016EA5674AF49C30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901589, "uuid": "a212a1ff-433c-4f24-82b0-4620d82f1341", "value": "cc55eae86408874fd9cf40c59e028154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901589, "uuid": "58dd9e0a-113a-43d3-923e-b99960244034", "value": "24576:9HRyi64CMcm8cLVbJ3bQluI4il6vDL1x:9HOfm11lbQailiXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901589, "uuid": "c6652cd0-8fed-47d0-a741-acc7ea1c7528", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901589, "uuid": "2a837218-5073-4dc5-922c-314aa4a0c88d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901589, "uuid": "882530cb-34d0-44aa-8578-d6f864b9ac30", "value": "5f1d4edb0181437d5c6e270977eec68d3daf4bd63edbc4c29e691573ca2ed9e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd0af32-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632902992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902992, "uuid": "d8e848e6-deac-4ff0-9f0d-d38b75a211dd", "comment": "Malware payload (Tinba)", "value": "0a46d6e59723f6dc248fc735c71af264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902992, "uuid": "c0accb96-e165-4da6-9b76-7d514c7658fb", "comment": "Malware payload (Tinba)", "value": "5f306d704bbc3758a1f951b9cd2701a5ae75a972e7864531d297955893fd122f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902992, "uuid": "792119f7-60f7-44bd-b044-912461588c0d", "comment": "Malware payload (Tinba)", "value": "b7245f2fcbbd4bce3b9323832f064eca4754a259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902992, "uuid": "6f41071d-442d-4e34-b28d-811b0de2b09f", "comment": "Malware payload (Tinba)", "value": "f222304fe0267c14f7454819e69668cbb176bc9e509a76c99408cc0a793cb618394fc2b01941927306624e6ad543fda6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902992, "uuid": "1673e1f8-240c-42cb-baa6-9e04deb6cfc8", "value": "T13073F812A3A6A11FF4B75AB96A78813216237D709F34D1CB32C84E9D56B3DD28D31723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902992, "uuid": "1c955b1f-c0c9-45f6-9425-eea2ce477d51", "value": "a0c97e54c7cc84aa5e0a7c186f29e1d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902992, "uuid": "9de7fc00-e45d-4318-b2c1-dfaae127f034", "value": "768:0HAl7xH0U2VFb8OaYS0a6L+nznGOevsCWg9nrC3Xybi9HW+C5c9JT:/l7ln2HLPL+znGOe0CWgleHosHGm9JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902992, "uuid": "3321a2f6-ed8c-4d8a-99d4-a25109c601fa", "value": 77828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902992, "uuid": "fc4e6229-744e-4ea7-9574-1a8222761ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902992, "uuid": "04bf8767-f81e-4d3e-87be-1001a6dee455", "value": "5f306d704bbc3758a1f951b9cd2701a5ae75a972e7864531d297955893fd122f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e289bcf9-213b-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1632930162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930162, "uuid": "aa7f341a-a1eb-46ff-861e-8f713d981270", "comment": "Malware payload (DCRat)", "value": "c54bb40430b637a6e13dec40edc5dcd8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930162, "uuid": "fb059bae-d225-4290-b577-a5293802f1f6", "comment": "Malware payload (DCRat)", "value": "5f438e1f5aff7a43c29a8d1f3b2f1cc9b6f464b30548c0683918e7d7694de668", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930162, "uuid": "ea43204d-3820-410c-abba-f052cf175684", "comment": "Malware payload (DCRat)", "value": "a53a90de34beb071719d1410e6fe0c936df1af07", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930162, "uuid": "37fd9138-6784-4ed6-abb6-4211a61a1852", "comment": "Malware payload (DCRat)", "value": "cb7bfd3481d4208a7bd76c5d7321e985b3899024a931ba1204dca5cfe2d145f1411e133ae0e398e1d1a6a6f66004c108", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930162, "uuid": "f797a8e7-3421-4f71-aa4a-1bf92b2fed88", "value": "T15DE22E4372A6E955CBA8D3424F89BE649A7D388992336D4CD0B526C02C70FD3A78437F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930162, "uuid": "7422c2a0-540f-4f8c-8dc2-cc634e1dc19c", "value": "48:oWCVsr5Ls1s6l7LP4V55Ams1s9OXPA5CVqIl:o1Vsr5LKhl7LP4V7AmK+OXPAYVqIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632930162, "uuid": "3a43ba42-d89f-41b4-bef7-c660ded6d4c4", "value": 31854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632930162, "uuid": "ed8bca98-86d0-433e-af26-aaca3ea35020", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930162, "uuid": "6f9a2d11-3ce0-4a81-9949-2b84e7fb6ace", "value": "1ZHTCAF81MN.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290cb887-213f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632931569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931569, "uuid": "3cc6d2e1-e594-4f99-a049-2a00c0ca60e5", "comment": "Malware payload (Formbook)", "value": "b9c97800cf3e146a5ab333672363db14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931569, "uuid": "1a6ef07b-6641-46b1-b068-31f8535c631d", "comment": "Malware payload (Formbook)", "value": "5f849b2eff2280adf1041388bbad6fc2e4f047c36b6d942ecd4e07946352049c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931569, "uuid": "74abe82e-5d73-4d99-89a6-e4834a50a46a", "comment": "Malware payload (Formbook)", "value": "545da9f150fcdf0994b87d09b26963c3a2788665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931569, "uuid": "d7eebc39-025a-4995-a81e-545d5f74e1eb", "comment": "Malware payload (Formbook)", "value": "bcc1f32f4f9d6ae180f88ac59f0715f3206fef072406c3c81d7a1bdf3a38d65a0ae8ebb74cf977ca1c8cf6fce6b2b082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632931569, "uuid": "f4ebf5e0-2ef1-4dcc-9a81-d2257a654b34", "value": "T132157C5AB50CF6CAFC25B3F02124BCC411EC1D581A6EAA27B97171D6B0B9D27DCB604E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632931569, "uuid": "367d3ed9-9bea-4148-931f-3a370595187a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632931569, "uuid": "fdac596b-baf4-4492-8945-cd0dd04ad8b4", "value": "24576:tD4VHfQe6ZyWshg+qbZxTZZWunAWvp3M3vzRD6/Kf3grZB:/N4vz9UKfwlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632931569, "uuid": "8ca6039f-c6df-4899-9766-311fa7738a8e", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632931569, "uuid": "30c01056-c7f8-40dc-b59f-fa5bfdba0b3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632931569, "uuid": "35da4527-740b-4b64-a982-ed138d1a1e60", "value": "1ZA109T4043832978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab572253-2142-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632933076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933076, "uuid": "c1256d88-9f93-4b8b-b372-2faf78667d59", "comment": "Malware payload (RaccoonStealer)", "value": "ecbfb374d96c2b96a3ba10c9e6008365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933076, "uuid": "0e7e3e05-a2ad-4059-9936-b6fdb47cbc5d", "comment": "Malware payload (RaccoonStealer)", "value": "5f8eed708ff4f1b2071f894be789093ca2c0211e430c746e762742a28df57d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933076, "uuid": "ea3df569-85a0-4d46-8d59-1d4cad57e057", "comment": "Malware payload (RaccoonStealer)", "value": "a3558d71ec76e39a797fbbd6c04a8761911893f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933076, "uuid": "8c23eab2-2cf8-40f9-b0f0-6307801682b2", "comment": "Malware payload (RaccoonStealer)", "value": "0534517f8bfa6e7430da388729c074c44a73d59692d1b59cb9405edbe7ccf62dd36b2604e50cef90f02d470c8080dd6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933076, "uuid": "3849c9b3-c35d-404a-8158-34f62cc6ba20", "value": "T167B40100F471D572E36991B65CF6C7A0C82D7C6CAF3066B72B8456FF6E392D18B26202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933076, "uuid": "4a022d3a-bbd1-487c-8b99-ccc01559d195", "value": "ca5041463b2dd933d009ca1aebe1423c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933076, "uuid": "38a0a7d4-f2ef-492d-b4b5-88159613b65f", "value": "12288:eIvZgvQ7HFrhfudzqcFTFpdJ8DBI17qeW:ewgIlhWscxX6I177", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632933076, "uuid": "5b6b8140-f9d2-4b64-8082-133e37d6725a", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632933076, "uuid": "1b432c25-1eb6-44a8-bb0e-cd62a4d7781c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933076, "uuid": "25f256be-acc7-48b7-8fed-e96ce865f311", "value": "5f8eed708ff4f1b2071f894be789093ca2c0211e430c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de888fb-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632901888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901888, "uuid": "f15d482c-2e05-47b4-aac2-bb7c8f02ee6f", "comment": "Malware payload (RemcosRAT)", "value": "f557e7c3e472fd3811add9f66d4a9c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901888, "uuid": "9be39a3f-af2c-40cd-adf3-2f532ae0cc42", "comment": "Malware payload (RemcosRAT)", "value": "600b2251ae4efebfc6e8c882a546ec7f6d86ebebe1e359c88793a83dc778fe01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901888, "uuid": "e431832b-88fa-40b3-a80a-5901aa6fa49f", "comment": "Malware payload (RemcosRAT)", "value": "076044ea63201de459dc1a760f78fdc685c8f24b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901888, "uuid": "4b32d83e-38d1-4967-bf52-f2cd915da42a", "comment": "Malware payload (RemcosRAT)", "value": "25b0431d25e8d6dfc3507641dfa4567b3795dbf0fd9d331639416e72273128eaede0a057a4abbca611ed70bb3d07553e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901888, "uuid": "f7e0bf3d-5ff6-4111-a473-f5dab24af488", "value": "T177924A17FBA8A321DAE40AF3D8F7D48043B1E7820517D61EE5BA2306380775A1F5372A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901888, "uuid": "62c78562-6e41-4a40-a8c9-745c05a89f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901888, "uuid": "1ae039d1-9de0-411b-8269-8934019cac9d", "value": "384:p2MqncH2H2nL/hIoTuRVb/TANsNjhBA+KAd4J7y03H+w4bS:4n2nThIZrBjs+Sypwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901888, "uuid": "b440eee3-d856-4704-8007-74f83063db65", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901888, "uuid": "390264d0-1f92-4f9e-bbbe-54c490472d56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901888, "uuid": "7283a5c6-79ff-43b2-850e-bcd2c59cf72c", "value": "Please Confirm Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fe68fa-216a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632950081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950081, "uuid": "a76da24a-06aa-4919-9f4e-761db40d075f", "comment": "Malware payload", "value": "a45dc99d0d146524d608691f86d00d63", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950081, "uuid": "7a77d72a-02f3-4074-bad4-925b4c573e07", "comment": "Malware payload", "value": "607ceb008d54328c885339fc2d793286834e887b2a328129455343bb8867698b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950081, "uuid": "16725a1d-fe74-45aa-a60c-e7b5222a70d8", "comment": "Malware payload", "value": "563551eeb18bd5c2889d3ce98462912148189d0f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950081, "uuid": "a643e58f-ac90-4317-ac6e-950dbbc74180", "comment": "Malware payload", "value": "2c858721c8d23c9038a7ed70fd6744782e983b0aa775623f56290892590a862549c734e24c1124820f5b30bf4fb2e775", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950081, "uuid": "acd0359b-e3c7-49f5-9fcc-7c5e46034856", "value": "T13D2623D6FE9FD41AE007E1B5D064D887481808AC4909F97B9A29929C1DFADC0EB47FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950081, "uuid": "4f1bfa99-b69e-42df-8926-0066976a5cec", "value": "98304:r/KW9aS2qftu6uCFY/9RhP3ueI6EQGTgKnOHTlUETyh5JJ:r/zjiY49RR3DJRKOzGEA5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632950081, "uuid": "68e8fdf7-83a3-4cce-9cd9-fdcdbd48186a", "value": 4469696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632950081, "uuid": "f663d54d-bec7-4db7-b405-8b006159a8cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950081, "uuid": "0374537c-143e-4b72-93c4-bf76b82d71d9", "value": "DHL11.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ae6699-20d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632887538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887538, "uuid": "8ae83f9b-3d87-4126-8637-c10271ab9b45", "comment": "Malware payload (AgentTesla)", "value": "8fab15879e2c24b9c24a7a8b79ea6356", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887538, "uuid": "ac2116ba-9d31-4d05-add8-b5494312af07", "comment": "Malware payload (AgentTesla)", "value": "60b79dc70c0d21348e857a09934a5f4f498669a173f005be9872a534aa1ce5be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887538, "uuid": "1dcbb03d-8da2-44d7-a772-02e5305ebd4f", "comment": "Malware payload (AgentTesla)", "value": "ad7b1c5a137727520ef6e074289e42c393181f14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887538, "uuid": "224ff16e-e39a-48d4-945c-59af30d5e071", "comment": "Malware payload (AgentTesla)", "value": "ad96ef99ebde345922fcd41979bec0257adf014b8a444b5b36f387cb9bda323953299b7d52ea26c956d4b59b2cbedaaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887538, "uuid": "e37fe2e1-64d8-48a5-9b8b-cdf2ef991ad1", "value": "T10B158D2AB60CD65AFD1433F02524BCC411F81C981C6CAA17BA7672EAB4F9D27DCB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887538, "uuid": "2fad0047-fad2-4445-9812-5b2eeb692b41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887538, "uuid": "f44f809d-f96a-4756-ade3-202c077c48f3", "value": "24576:2rD4VHfQe6ZyWshg+qbZxTZZWunAWvC3M3VyR+VTTWnt8fyWs0:25y4VycFWtVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632887538, "uuid": "c27e21c7-4f91-45ce-99fd-2dd486d481a4", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632887538, "uuid": "93e44370-39c3-47c7-86d6-a7d1d78e73a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887538, "uuid": "9e0593c7-e9bb-4996-87f7-1720fb8b8e41", "value": "09 29 2021 P PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896850b6-215c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632944186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632944186, "uuid": "d58de714-5f40-4dea-bcd5-0d9227243256", "comment": "Malware payload (RedLineStealer)", "value": "19c426473e2ccf321d83b296f9938ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632944186, "uuid": "455a4dac-692d-489f-9951-1973d1992037", "comment": "Malware payload (RedLineStealer)", "value": "6113f79ba874b45102d51b51d8c8ef6fcc06b454449dacc1b17ae478942dd353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632944186, "uuid": "2a3e382b-e4a9-4b46-80b5-4b4e4ec1889f", "comment": "Malware payload (RedLineStealer)", "value": "1b9a327b81080c571d5599a6a74dbaf9e9ea43ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632944186, "uuid": "29fbc115-f593-4cba-aae2-8173cd709675", "comment": "Malware payload (RedLineStealer)", "value": "af7f019d291389270be83f60ed3c8af05a7058411c4b6a601a983d4d872fdd53a45cfcd07a9b8bbc9e78156333b1d3c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632944186, "uuid": "088900ae-0856-4026-bb64-28aeef79024f", "value": "T1E4941428647FC01985E3EEA62DDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632944186, "uuid": "2d0efffc-7cd3-4433-920c-68ffcf1b8fe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632944186, "uuid": "7f301044-d844-43a3-abaa-a4a8a8ab5745", "value": "12288:oklT97izdCHlUjhc/PNHe6b+CGmG8DrRsssssssssssssssssssss+ssssssssso:PcjhORsssssssssssssssssssss+sssG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632944186, "uuid": "9826a6b3-75a7-4f73-a4ec-21ba4969c539", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632944186, "uuid": "bb793cb5-051d-429c-9b3d-ede72b75e5da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632944186, "uuid": "b4fdd9fa-8ddd-4776-9040-4954116c5fda", "value": "19c426473e2ccf321d83b296f9938ce2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470e4ad4-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632899837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899837, "uuid": "e03a5687-8844-43b6-8fb7-18ed54059c79", "comment": "Malware payload (SakulaRAT)", "value": "49428b7c31b8903999ae7cae8d2796ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899837, "uuid": "7942f85f-4aa9-465c-b00a-62026544cb97", "comment": "Malware payload (SakulaRAT)", "value": "61cbed5c9d3b9d8181cd0b069c6008cf4df5b76d92786fd8e902130d8c4a0f22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899837, "uuid": "69c7c736-35c6-4c5a-b709-e92d377f3b54", "comment": "Malware payload (SakulaRAT)", "value": "5c1c189d5bf5de08aff127207ad5d779b28ef440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899837, "uuid": "ed826a03-d5c6-4ac4-8b0c-f520d2430834", "comment": "Malware payload (SakulaRAT)", "value": "6ea1ba0748d46c5af3dc61c77b4edd93f48e03932e2d6cb78160db663d9fefa74a4de6aca75fc39379350e6983ae7e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899837, "uuid": "903ecb2c-a63e-4c32-a847-42a0deea8a75", "value": "T19006D51173F94985F2F3AB30ADB081555B36BDA99EF6C62E3144428D1E72A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899837, "uuid": "0afa10d4-9011-4074-a9ac-21943c4c925d", "value": "4511896d043677e4ab4578dc5bcab5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899837, "uuid": "b632d81a-ce12-40f2-8bac-e3370828f1da", "value": "49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTIp:oU6eUNZZJHsHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899837, "uuid": "a96cea7c-5331-44ac-a926-9ef46b7a745d", "value": 3801088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899837, "uuid": "06f9795b-3da1-4bac-b3f4-58f875d338f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899837, "uuid": "4736b34d-6ce2-4107-94a9-daa5cf2be991", "value": "61cbed5c9d3b9d8181cd0b069c6008cf4df5b76d92786fd8e902130d8c4a0f22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b78770-2118-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632915154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915154, "uuid": "a1832705-d2c9-4e25-9919-6a20e08a6c5f", "comment": "Malware payload (RedLineStealer)", "value": "7b293cfc029b027303627f5dc2681042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915154, "uuid": "708285fe-3277-4f3f-9d38-2258a855914a", "comment": "Malware payload (RedLineStealer)", "value": "625a1907167b51693a66f7e400e2dfd8b8c1e94c6b0e365bd31c4d013babb553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915154, "uuid": "67287eef-0dbb-4ba6-824e-be87ac0d0a4f", "comment": "Malware payload (RedLineStealer)", "value": "2a2916d14c407fb0b86b3a859245a9039c3f90ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915154, "uuid": "a357c395-237f-4108-9e54-238bd1bb17e7", "comment": "Malware payload (RedLineStealer)", "value": "94717e297da75fc552597dab535310bee5a1e8115b21df436af0f53273173d637d4cd05b980c285b76623cc545d701ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915154, "uuid": "962558a5-d1fe-472d-835d-aa75bca93b65", "value": "T11FD512A0A6DC5845F4F68A3879B1CE51353BBA29CA30855F662A911CCE37BC0DF78790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915154, "uuid": "8e44e5cd-fcde-4aec-8c68-c6eff0ef17a4", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915154, "uuid": "460e8ae9-0651-4ec9-863d-9c8ed71c99ee", "value": "49152:dQ70klWXNhYSsfN4nh8yeQvRTN/7cbDahpTYnbj1WHOYtBf:dM3A3aN4nh8yeeTcbWpSbj1WHPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915154, "uuid": "a069f906-14c7-43b4-8c2e-ee4cce4c5c44", "value": 2815488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915154, "uuid": "5d3938c9-532e-4096-92e9-d809f14d9da1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915154, "uuid": "576d8db7-1403-4cd1-b6ed-e445b392585d", "value": "7b293cfc029b027303627f5dc2681042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ffb596-2133-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632926598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926598, "uuid": "54cbfb3d-9a35-478e-b7cf-c5f79ef9c7b1", "comment": "Malware payload (AgentTesla)", "value": "37eca766b49e8dc3cd7092bbc18f57f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926598, "uuid": "65deca50-e31c-40e6-a593-62c1d3c09d8c", "comment": "Malware payload (AgentTesla)", "value": "629a2c4f34fca651c9b9a2fab70b2e9aa78fe1e5d87a6839ba7b2658c60d6321", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926598, "uuid": "07a113cb-b9bd-402b-952e-a726bff93d56", "comment": "Malware payload (AgentTesla)", "value": "5fd03640b68efe4c617672d22cb90c4fe5d99c2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926598, "uuid": "3967a2a7-38fd-422f-be7a-2ec74627a040", "comment": "Malware payload (AgentTesla)", "value": "14faaa45ae408ecb0c31b30998d895b8262b6707b45fe8aa42b05f004f5b4e7d93f2254b96de8c73277b91eda5abd743", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926598, "uuid": "7a177892-d407-4d65-9182-7af3888762f0", "value": "T1C4F49D1DF21CE29EFD1903B021297CC425E81CAD197CFA27BEA6B1E230AED7551F0196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926598, "uuid": "be9c1f3e-3a28-4532-9167-e1711cba1573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926598, "uuid": "95781d4d-1ced-49a2-8919-2276e5fc6d87", "value": "12288:JD4VHfQe6ZyWshg+qbZxTZZWunAWvtEAPhsaeGHUIL7pfW53bYgQ9hzWNiis9EAt:JD4VHfQe6ZyWshg+qbZxTZZWunAWvmVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632926598, "uuid": "7fc41ee7-1e1e-4b38-aac8-80de3829350b", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632926598, "uuid": "16f32d94-6eb4-4fdd-900d-db4345a79348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926598, "uuid": "5e144df9-91a3-4917-8a31-682144073ef0", "value": "Order NO 002888845 dated 29092021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035fabfc-2178-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632955987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955987, "uuid": "fedd7471-1d7b-4a14-aa51-05dba8cb96e3", "comment": "Malware payload (Mirai)", "value": "0279a285fc55eaeae8478ca475f9e235", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955987, "uuid": "12e9cdfb-f9da-4b93-b4e5-44a908089a54", "comment": "Malware payload (Mirai)", "value": "63712b4321c046ffb972732bbb1a3525021a6da10eeb9b2871a35e71563b974c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955987, "uuid": "255e9f34-636d-46d0-b124-106729cc7388", "comment": "Malware payload (Mirai)", "value": "a22d46324fab540c4d66557be0a2b53130fb95de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955987, "uuid": "ee1eaf16-8104-48f8-afec-d2ca4e80f341", "comment": "Malware payload (Mirai)", "value": "5f0f52b83da5811cb79256c7e7ef1b36ea88618c15d2fb8114f5db9a541a635fcae592deba008110b95ee9a31fea10d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955987, "uuid": "c25ad4b4-d416-44b0-9516-3dd0935406c5", "value": "T19B53C91A2E218FFCFB9C863487B78E219659339527E1C684E15CEA015F7034E345FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955987, "uuid": "64fa29d4-76f1-47bc-a0e4-10245557943d", "value": "1536:33XyAGENG4OGpuQUaBbkqG/ZZ62U1lCP+gw8:33CA6bQUaBknZZ62U1lCP+n8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632955987, "uuid": "071419d6-c217-4b5b-80d4-961bfbcca47e", "value": 61120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632955987, "uuid": "1d115ce6-5ac6-4b01-97ff-12031c32fdf8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955987, "uuid": "cecb0f40-ecb9-4b52-8811-cfe43bc93920", "value": "0279a285fc55eaeae8478ca475f9e235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b782c4f1-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884993, "uuid": "68747a33-80b4-426e-9e0d-fdbd0845b292", "comment": "Malware payload (Gafgyt)", "value": "db3d49e23aa301d53afe898ada2a1027", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884993, "uuid": "5b5b2d52-f20f-49fa-b679-9f0a86729a71", "comment": "Malware payload (Gafgyt)", "value": "63a974747291f3fd84244c878f730ed9afe14c5e68d235cdb40a4a97fc66d8da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884993, "uuid": "e98e7852-dad8-48e9-a607-40e01cab26f2", "comment": "Malware payload (Gafgyt)", "value": "f6dcc549162e50fcacc6c7ca7bbba4de4cb7e93a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884993, "uuid": "2a9c189b-b059-41c9-a7c2-aa78265e0e5d", "comment": "Malware payload (Gafgyt)", "value": "c3e030947a249ec2f05c1450944eb609fc2ccace35ca177593b850a449f49361894740b5a798d9aeac56fe3b39c23866", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884993, "uuid": "fca697ff-15f2-4776-abda-edf55f0e5814", "value": "T18DF3A566AB61DEB7D81FCEB3069A4506108CE95A42D92FABB3B4C51CE74BD0F04E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884993, "uuid": "6c58da43-84ae-4321-86e0-4aaa23616a13", "value": "3072:wQlA8kB2zO8gJvTwE25zSqjfmOTcuaWVw62VNO:wKyvTwR5zSqzmOTcuaWVw62VNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884993, "uuid": "5919200f-7802-49df-aeaa-5f3c17283bfe", "value": 164451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884993, "uuid": "2434ed95-75e1-4a4d-b815-5946a17b40f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884993, "uuid": "c29843f8-8e57-423a-b928-b7c27121536b", "value": "db3d49e23aa301d53afe898ada2a1027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2109af-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902904, "uuid": "bfe975ba-3b21-4db7-b4f7-76c7f1058799", "comment": "Malware payload", "value": "3bcdf4f257c9b494065a2eaf3e8cd637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902904, "uuid": "7bb16ac5-662b-4e39-8c22-00b0cf993a05", "comment": "Malware payload", "value": "64042ef0ed90b5f9e174a32c75d3e7d3dc5875dfeb324ff9b3ca360cd74809ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902904, "uuid": "4596a61e-9bb2-43f2-8f7c-4d7cbd9fa0ce", "comment": "Malware payload", "value": "ad6bbaa27a2fc63b8a8ae13ff7222035d593621d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902904, "uuid": "657c4bb7-58fe-4c29-be4b-a6e9d7ddd403", "comment": "Malware payload", "value": "bdbea99d012dba7bfa8f2742844cd7ede84e39484ed3b7644187b6ab40d4886ee712d72ea655c30a9bcbaad7b94cf0e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902904, "uuid": "f4842132-8848-41ec-9ed6-98583b8d0797", "value": "T14773C0257F920C48E7F94B3369EC51CA06BFBB8DA93146CE296E9AD80F37AC055D0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902904, "uuid": "ece8577f-34d0-4e40-ab9c-3b4421804046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902904, "uuid": "19786c9f-70b9-4471-92bf-cbc626681280", "value": "1536:Ku58uAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6z9/21xb:p58uAtWDDILJLovbicqOq3o+nb9/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902904, "uuid": "f970e1f4-7404-4d90-a078-26d6fa64e804", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902904, "uuid": "8bb57841-2c90-4a64-8ad9-a991877a6a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902904, "uuid": "4230d66f-9b50-44bf-9d14-1726931225b6", "value": "64042ef0ed90b5f9e174a32c75d3e7d3dc5875dfeb324ff9b3ca360cd74809ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a8a11f-214a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632936503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936503, "uuid": "362df3ea-8f2d-43a3-93d6-8f144eab9f98", "comment": "Malware payload (Gafgyt)", "value": "6e93751daf046b150aa871bc44313b77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936503, "uuid": "5ff4718e-a377-4630-8342-84e24578ef40", "comment": "Malware payload (Gafgyt)", "value": "6452df031b3bb9108dd0045bbfe1ed61fbb11d6419114d78e7ca04ee467bf87f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936503, "uuid": "06d3190f-d70e-4ed8-99bb-997bbf70a7b8", "comment": "Malware payload (Gafgyt)", "value": "9b8445412e7da3fa61bc31276c0399eb6236f904", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936503, "uuid": "5899488e-3800-4b2e-8ee9-04b7149dc31a", "comment": "Malware payload (Gafgyt)", "value": "e2c388bc44b20494ee0589c9c4d35825ebdf5da903cff3fd244e51681a6fc208ba3de2561d07770e4565822ac9fecdb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936503, "uuid": "2735f4ef-2a89-4159-a09a-5e6c524e91ae", "value": "T1E7F3F705FD04976BC2D327FBEB9903CD373616A967DB33169A34AEB02BC17982D25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936503, "uuid": "197eaf52-96fc-4d75-aa40-9278f8ced4dd", "value": "3072:GAnKDucU30IDxt275hUbipe3rjX5VC2mUTrQMbLfWBj/9q:pOucU30IDG75hUb7rjJM2mUTrQMbLOBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632936503, "uuid": "1a3350cd-cbf3-4bfa-be0c-c7a40b3a8f85", "value": 162635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632936503, "uuid": "c209608e-66b7-43bd-b17b-7f7eba7d8b2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936503, "uuid": "afd3479e-5ebe-4b03-a6e6-3508f7ddc951", "value": "6e93751daf046b150aa871bc44313b77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dd3e02-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632899139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899139, "uuid": "432cd31a-49fa-4790-af86-c28594814218", "comment": "Malware payload (AgentTesla)", "value": "0127f9d957f5992d5aa237bb58afef0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899139, "uuid": "dd88f45f-2677-4b55-b7f9-2af04807efcd", "comment": "Malware payload (AgentTesla)", "value": "648438e57e34a1413598ee8cba3c697f183d8afa3dbf691507b3e3feb1c00fa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899139, "uuid": "6a04920c-35b5-420d-a045-3c9dfbb16538", "comment": "Malware payload (AgentTesla)", "value": "4f8e5dddc58e0b731028318794a55beacc466bc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899139, "uuid": "3c59e4b3-185c-418e-8666-22821586f92a", "comment": "Malware payload (AgentTesla)", "value": "3b005711a8388e67b539ce87ea5cc4bc333aef002a68ba73eefce94b48a85211530daceddffc5ac1ca4e40d9a4abafc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899139, "uuid": "ed958f1c-e628-4fd2-bedc-fb1fccf5ece3", "value": "T1F5158D2AB60CE65AFD1433F02524BCC410E81C981C6CEA17B97675EAB4F9E27DCB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899139, "uuid": "2b076425-77c0-4c38-86b7-9ffbf8783d42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899139, "uuid": "9737b327-655d-4e3c-b251-e8f0dcf2f2ec", "value": "24576:fG3M3XhiXGSen66HmZD4VHfQe6ZyWshg+qbZxTZZWunAWv:fG4Xh3SeLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899139, "uuid": "69e1968b-cceb-4789-b218-227992e7a6b1", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899139, "uuid": "bb42eda8-74d4-4287-96a8-36b0112ad693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899139, "uuid": "14f24385-1b6c-4fcc-b05f-84f02757ae0b", "value": "revised quotation..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c05b565-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902395, "uuid": "985d7361-710d-40fd-8dbc-65f91a78aab8", "comment": "Malware payload", "value": "5977e7126097db853864e9e8d5ffef6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902395, "uuid": "3d356f24-ee28-4918-a6f0-81886a99ca93", "comment": "Malware payload", "value": "648fbd063fa744447a2dd4e8db5416677eecbf822be5db0e20989210615f4d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902395, "uuid": "98e622b5-ba98-420d-9497-34438db46fee", "comment": "Malware payload", "value": "4d11403dc9e452dc8fd7742b9b6a2011893d8dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902395, "uuid": "7a38eb3d-bc32-45ad-978c-6f307d091fa2", "comment": "Malware payload", "value": "4a021dfcc3d95831479c4d86530c59cf9a26af37c5f39a1485fdf5ec2e0cdcccc1a2349982dbdbec622243b1fddf73a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902395, "uuid": "c7da9af1-8d64-4f72-826e-e3ac1350f6a7", "value": "T1FE73CF113E502D1CEBF94A371AEC20DA0A7FB78DD97083CE685E69C80B37E9649D1758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902395, "uuid": "f8ee674f-fdf4-44d4-bab4-864bd5f446b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902395, "uuid": "64fdd589-91c4-4e6d-af3b-3d4bac612bc8", "value": "1536:UV4V58NpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQti6H9/Im1XB:44V587JywQjDgTLopLwdCFJz/9/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902395, "uuid": "d92181a9-2fad-4668-870d-bf7553cf4382", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902395, "uuid": "865c8c9b-5d84-4c70-8167-472bd67fa175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902395, "uuid": "20040cbc-6f5f-4502-81a9-40c3db0a5860", "value": "648fbd063fa744447a2dd4e8db5416677eecbf822be5db0e20989210615f4d83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bb4902-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632899383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899383, "uuid": "511ab175-d933-41e1-a1d0-f9955e620bed", "comment": "Malware payload (Formbook)", "value": "f9d0f03aba5378393fe83fa8e473b89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899383, "uuid": "09964850-7b70-4dc7-9ff7-4c0f9c2c580f", "comment": "Malware payload (Formbook)", "value": "64e3a0f2298f21833eb7a9c51aa0b2b8d3354bdcefb0156bb34371e3163d8b3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899383, "uuid": "96e5230e-5875-40d4-9e02-f171fe62b06c", "comment": "Malware payload (Formbook)", "value": "174def16b7a286eeb3f97f68817ab393414ac5fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899383, "uuid": "b6e5843b-9c3d-4dec-8838-a92c151ddf68", "comment": "Malware payload (Formbook)", "value": "cf53b612e114fc5d6eb964d9ac2b57d5dd195a25242f8678caa028db8b86d5678d94732d9f006fe1b668981bb8ff5ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899383, "uuid": "d4a4fe75-b760-4c9a-8659-2cfe83f1f3b0", "value": "T122B4E0159881D99FD15232F805B4F1B5D3BDAE893D908ECDD73C3CA49A358D82826CBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899383, "uuid": "d04f0ef4-388f-4d48-8ede-f0c3ccd83fb8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899383, "uuid": "52e52c49-1f47-46eb-9642-cef0710850a6", "value": "12288:HIP/a94oigRu1/WxHlZ+L83Gt7IsgJs/gE2kM8y:SIAi/y7PvgEB3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899383, "uuid": "de704dcb-463e-4503-95f3-438c88c3c4d8", "value": 505575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899383, "uuid": "810f4a7f-8c50-48a9-b5c0-61aeea9a257e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899383, "uuid": "d4be4a14-74c3-41d0-a181-e36e0b2dc64f", "value": "f9d0f03aba5378393fe83fa8e473b89a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fde18b-2148-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632935379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935379, "uuid": "d962412b-1dc2-429c-953d-01f06685d6d4", "comment": "Malware payload (AgentTesla)", "value": "8708f67d28cd871432588b4e84f490e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935379, "uuid": "f182caa7-364f-45ca-a938-3b12ee88e2cc", "comment": "Malware payload (AgentTesla)", "value": "659bbf49527e2834a2e4d28a97e29315a5a2cf9ec9780ffd76fd51df607e5759", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935379, "uuid": "d636c5a9-4e9a-4619-be7c-b2555ffb265a", "comment": "Malware payload (AgentTesla)", "value": "4dfdfa585e0deb81597add0508531b8d42129e07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935379, "uuid": "b3402cfb-b2ee-4ff9-a512-3960bd940d94", "comment": "Malware payload (AgentTesla)", "value": "26eac1bd0e6240aaa2bd20bb603971c06f1c06a24344d647a797a4817c35826371d4a56a8c306794235a889c7fdb6a73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935379, "uuid": "eef0d924-ead7-43f2-bfb3-210d7c3df7d9", "value": "T1CC6423DA67F29CB3FAC16D3203F5A6F9F3BAE054A2A151074BD45DFB48225090E0B253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935379, "uuid": "98801a5b-cf3a-4560-aa15-27f4b30520e0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935379, "uuid": "566bd2a3-92cd-42ae-ae80-3cd5fba67fe8", "value": "6144:F8LxBsZLIYrElXaKFJvlOQlKVeFBuEymjASRbcTXFaltgxzeik2Cj:/ZLItlqKFJQNGuEyGuKEeiktj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632935379, "uuid": "59846dc9-d7ed-4985-9539-bf8bdf9e5604", "value": 309820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632935379, "uuid": "18a5516d-8e34-439d-8bf5-77d47113cd71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935379, "uuid": "95d1e31a-089b-426d-8874-d72cc6d7664e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9eb3ea-20db-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632888626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888626, "uuid": "30c66c4f-4fae-4c3d-b47d-d2daf7039615", "comment": "Malware payload (Mirai)", "value": "0567ab224c3b9c9f45ca6b0319a7d22f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888626, "uuid": "1bac0059-878f-4c01-a078-3f48e7ee147c", "comment": "Malware payload (Mirai)", "value": "65affb314d3e575fa94e983fb04a38dfcf2f8789eb38462e8971888c02bcccba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888626, "uuid": "cad084e1-a105-433d-88cd-8d73a6a66b41", "comment": "Malware payload (Mirai)", "value": "4e76960170350eafeab50af879ccb7d245d80d73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888626, "uuid": "d6ae71f1-d921-42c6-903b-afa00a8ce796", "comment": "Malware payload (Mirai)", "value": "5910c2ac709d0fa71b22e7bfd9327fb0ed9e9b19bf162f17f138c83c70808332f6c3b2ea340fb948a4b54d976a8903a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888626, "uuid": "f49c8f40-74ea-486d-b969-a6b17d31fe4c", "value": "T118C2E1AE55FC1454C004967BAB3848ABB4FF1604ADEEF783A348D94C4516632F279BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888626, "uuid": "876e3eae-116f-4019-a9c3-eb5d34359c0c", "value": "768:yPkGSpow6JvLQfh319oHVRNMqS+2cFnIo5RnOlBg/fwd:aw6J8RDo1RNMdcFIW1OlC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632888626, "uuid": "35e8a932-5a28-4925-b0b9-8578bf8f3973", "value": 26276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632888626, "uuid": "6ee35364-a289-481e-be86-d84862fe0792", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888626, "uuid": "f23fb843-7b2a-4489-8101-02440e7b44a8", "value": "0567ab224c3b9c9f45ca6b0319a7d22f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c63e2f2-2119-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632915308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915308, "uuid": "8edd74fe-9c73-4f8f-80be-e3f6f033e671", "comment": "Malware payload", "value": "174633c99b52d42cfcbbfaf5f81f0f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915308, "uuid": "8a5a45b5-e746-4e11-a18d-f7a401e56f49", "comment": "Malware payload", "value": "668434940877f747a5d3adc745548bcfdcc881418f02e705204df2ad54a311cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915308, "uuid": "8c442dbd-5caa-40f9-b78d-40973a2b6420", "comment": "Malware payload", "value": "ad8fb5301c5a526f7a1c7d4d0e2c67671f7fbf9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915308, "uuid": "debacf3b-86b6-4da0-936a-bd6c6d17d407", "comment": "Malware payload", "value": "5ab8fa439447116213765d835c31894799ef790ecb26788bd4fad362f995595f722eebc4e5ea721c7120a1eb5fd843c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915308, "uuid": "b458194e-7271-4bfb-b3ef-e874cd13fa4a", "value": "T1FB36123FF268A53EC46A173245B39350997BBE64A81A8C1B07FC380DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915308, "uuid": "dccda6c3-9d08-46fd-bdd5-bc1af560482c", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915308, "uuid": "b9ba8007-1409-444d-b258-c863f1c2759d", "value": "98304:8Sir2GLhfKDyTuwdbvLMv4JROOLYG0WU7TKhhd1gonPcMH:LGRKDyTjDMvwOavbQWL1/ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915308, "uuid": "ceb05ad0-1649-4f51-b06d-72f2b49b79db", "value": 5227366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915308, "uuid": "4ef465be-a1b2-4ee6-9f6d-d38bcdd8482d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915308, "uuid": "817a3922-f09f-49eb-bdcf-73bac99ef259", "value": "174633c99b52d42cfcbbfaf5f81f0f13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae18227-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632901883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901883, "uuid": "60053d53-c9e9-4161-9302-b9cc43e0e26c", "comment": "Malware payload (AsyncRAT)", "value": "b19525c6610f15e40f0404a4b0d23187", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901883, "uuid": "b5e87591-5edd-4378-bb87-9cc61c3b5e02", "comment": "Malware payload (AsyncRAT)", "value": "66908b88f14927076d89349a19c0aec3d840a5ce0d6d139ff95ce7f27c35c4f1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901883, "uuid": "1414dab3-00ca-4476-bfec-b0b1a35a9c21", "comment": "Malware payload (AsyncRAT)", "value": "6b01b5d50c0d3c6c45f0c944066ef8d17857ce0e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901883, "uuid": "8a30a528-7e76-4170-8b99-e9b5a035e096", "comment": "Malware payload (AsyncRAT)", "value": "d82dda4250f52283f1d5d8959a08de46fd64e95cb2ecd959b995bdd87d9d606e422cac50998b233faf50a5aa85b61e7f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901883, "uuid": "5ae8eda1-7f96-460b-a4a9-4b77baebb3ff", "value": "T121B4D02E3BD8EA13CEDC07B598570A8687B1AD337193E7CB612032B817B6761DD07616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901883, "uuid": "ecf24be2-e251-4e70-9b1e-9ac3fb06edbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901883, "uuid": "b7b4617b-26d2-47ef-ab40-ceb87e1b2fbe", "value": "6144:GxfarJF60FMP2lLiPshIP4rqgNpYOUfgC6Y6YXee6uO2rZ0wgX6L:bJVFMOlKsCPSXsO6i65dRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901883, "uuid": "0d7ff824-b291-4a8c-907d-a47a6bd0ad35", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901883, "uuid": "ba7c6205-46ff-4c28-aee0-df5dbe31f36a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901883, "uuid": "8c2d804e-e3da-4a69-bbb9-99bf80dc56fc", "value": "66908b88f14927076d89349a19c0aec3d840a5ce0d6d139ff95ce7f27c35c4f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187b9a1a-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902336, "uuid": "0561cee1-a632-458b-8807-2956a7b93510", "comment": "Malware payload", "value": "7f9fe9196e92c97704b93f48b8ce9b34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902336, "uuid": "9739c99b-2c28-4349-b184-beb5d69e6b43", "comment": "Malware payload", "value": "66f90447f9ebe1f613131557ccee6a84cd76b12028dde7fdf757cbeef05568dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902336, "uuid": "a810a8be-1e43-49b3-b5d4-f0309e74ad52", "comment": "Malware payload", "value": "6b520ea0e98f093d3b5bedd45644c37a12c50605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902336, "uuid": "bec45567-b70c-424b-994b-35674da52da7", "comment": "Malware payload", "value": "e70864345f943350f995c39d29513ed3b6bebd935e69ac6e8a8dc69e2ccd8812deed7208d111dde7bc1fc1c97fa9d92d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902336, "uuid": "6cb6023f-5191-4dfd-affb-a1106894f00b", "value": "T12873CF11BF811D58E7BA0B3356EC31C606BFBB89AC3193CB642E69C85F37A5095D0B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902336, "uuid": "51dad49e-8e44-4898-b9c0-bcc5d5c836b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902336, "uuid": "10d2eba1-15bf-45f5-8e6f-cf44477a5a53", "value": "1536:KRCHF3M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQteK09/01OJ:KRCHF8hASyRxvhTzXPvCbW2UeK09/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902336, "uuid": "dd2339d5-29c1-4df1-886f-48f93fac2194", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902336, "uuid": "e190fea9-b02e-492c-a604-4ec1689d0129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902336, "uuid": "e920a101-1681-4648-a5b1-ccaae81c019e", "value": "66f90447f9ebe1f613131557ccee6a84cd76b12028dde7fdf757cbeef05568dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38f6192-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632898355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898355, "uuid": "4709bc6c-1746-45cd-aaa2-832095a03482", "comment": "Malware payload (SakulaRAT)", "value": "87ef48d510e2df991bcc5c22a22bfb7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898355, "uuid": "315b61c4-9f69-49f7-887a-137f70c98d87", "comment": "Malware payload (SakulaRAT)", "value": "671811ae5ef1c8b9cd44cfae11c57c4007a2bd858462a13f1393f9c190088545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898355, "uuid": "7bb2eae5-56f5-456a-bde6-5cb9b18f665b", "comment": "Malware payload (SakulaRAT)", "value": "4565707775a2a94b11cbff450024eb34d008fda9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898355, "uuid": "9cf34aff-8e49-4006-b159-40d87676cd9c", "comment": "Malware payload (SakulaRAT)", "value": "78e1eb45f695102b81cf7c71aac8190102ffa0a8a579e9aa5b2eb94c9d3a63706e3f0782dc28eb680c6c50cb5f5762d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898355, "uuid": "d9774c2d-f0fc-458c-887f-bc3eb7e56d3f", "value": "T14026B20173F94995F6F36F30AEB5C1145B3ABCA59EF6C62E3144428E0976A50EE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898355, "uuid": "fa3942ec-91d7-4dc8-98fb-4d6c9f05b5b6", "value": "539502771da573641ecc7f6497e39f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898355, "uuid": "572b7474-5fcd-48de-895e-e6f0b600c987", "value": "24576:cCe8yh3Qh3OXuaq4gTkZrnEu8CkBn5KvRFMDZa/ny5XfK5DBk:cZ8o6dZ4gTkZJ8JavRFMDZiny1fUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898355, "uuid": "c03a447c-953b-4652-a5f1-0360a3cb5cdf", "value": 4523008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898355, "uuid": "8c1f5dd2-e785-46f6-a3bd-566e365ae9cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898355, "uuid": "66a0df7b-5e52-425a-8065-520106c737ae", "value": "671811ae5ef1c8b9cd44cfae11c57c4007a2bd858462a13f1393f9c190088545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f251cec1-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632901842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901842, "uuid": "4a2efc4b-4a4a-4430-97ce-5f4cdfe1fc32", "comment": "Malware payload (AsyncRAT)", "value": "46eeafdc0803ee8e7d5d8dd5b29978a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901842, "uuid": "cdffc1e4-5441-47d6-9778-05d36f94b569", "comment": "Malware payload (AsyncRAT)", "value": "6776c42da9ff39df7f76649d5ad287ff628790e84c7bebf325cb9b8c2e74aeb2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901842, "uuid": "c6e3f945-5f61-44df-9aea-0ae7f1621c18", "comment": "Malware payload (AsyncRAT)", "value": "19b6f346adfc984fe95ab530ec83bf0b3363e4b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901842, "uuid": "0e3d2bb4-2cd7-45d0-92f2-9a24d7682046", "comment": "Malware payload (AsyncRAT)", "value": "e7b30cdd56ab0316b320debf62f7fbdb6b14d367981ff50f5a8bb2f7156fdf8250b0fff4c50afd74321376a318f57916", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901842, "uuid": "07e713ca-c1cb-402c-95e8-e4f2d9fe673c", "value": "T128D4BA1C378D5BFAEFDDA8B18D0E36066B220E179250A992678B39C7DF7F3951D04884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901842, "uuid": "9d89125e-9503-480e-a744-b6db75be5fef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901842, "uuid": "465df71c-6eb5-4d2c-85fb-a8d70d166149", "value": "3072:GNXzbNLBZ9IlIiq/UIfAwUFlZ2/4kHhrZIjjz++2XyjkPJNo5CS9Ew9bNg+Ldf/a:4bNZAo/9mzocEw9bN1N/5UkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901842, "uuid": "ddefec9d-8319-4633-be9e-ab8792c7b8b7", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901842, "uuid": "94bfde7f-5985-4b8c-8fae-8828e75efd60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901842, "uuid": "e9efb7da-fcec-48fb-8a03-6b013f4add84", "value": "6776c42da9ff39df7f76649d5ad287ff628790e84c7bebf325cb9b8c2e74aeb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514a67de-212c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632923476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923476, "uuid": "e0050bce-1dd6-4fed-b4f7-88c7a0e5d204", "comment": "Malware payload (Formbook)", "value": "ce20bd8f40f78da603dd17d756745b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923476, "uuid": "223f4d2d-bc09-4282-84db-bc5156b194aa", "comment": "Malware payload (Formbook)", "value": "680993e1220c8d918f192ae23c5c01b6357c58ad68b7cc59fa122c09b7b85cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923476, "uuid": "cc574456-42e7-4e63-9306-b159581982d9", "comment": "Malware payload (Formbook)", "value": "2538f96fad951489cd9bb84f9b76b107ea70eaa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923476, "uuid": "da087962-b70d-47b1-8031-8c4912a13598", "comment": "Malware payload (Formbook)", "value": "5d168bbb1e6e772948fb4313e4d4bbb0aa429779c34a73fa81a0d7ab7a337435b8317c1063b418ba19c0eedfd72400c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923476, "uuid": "705fddb8-3b6c-4af8-b6fa-b866ee264ced", "value": "T1D3D4ADDE1EB457CBFB4E01F8F678278813BA9024E65BF2C6DA45B0B351327584920ED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923476, "uuid": "a4266514-b8cc-456c-8c5a-b8b4da3a0c65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923476, "uuid": "4a90faa9-bdea-41aa-861b-08f7227a65a2", "value": "12288:kzqzgNi+hBr7IUAYpHOSpUeR7/UbuxaWsbkUb+3tkvfY:kvNi+hBr8UAGFBVUbuoWsbkUmgfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632923476, "uuid": "410a0676-97b6-426b-9bb3-d05f4dd4ddd1", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632923476, "uuid": "714b3c3c-7f15-484b-bfb6-14f380fba2f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923476, "uuid": "bd315a12-f2b1-4595-bbc2-b471820acd40", "value": "ibefrankszx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7f1926-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902401, "uuid": "269db96d-5309-4bd8-9e28-b85d8eefc015", "comment": "Malware payload", "value": "4ed99d74132b62725df1551191b355ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902401, "uuid": "76adb945-34b2-4039-b29a-5eca5e04c180", "comment": "Malware payload", "value": "681c8b08a32a6939018fa4fb91558b38d42ac197fc4d917fce9fa0890c0fbc89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902401, "uuid": "c0df77c8-e665-4c4d-93c8-84a5011dce0c", "comment": "Malware payload", "value": "87c9df7e1c3b128c6883c0d7b88ee90d82b0a098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902401, "uuid": "843f9630-5887-44ec-8fed-971311125415", "comment": "Malware payload", "value": "c88c3251ee9315bfa1e7f835a6454000b3171e2adcf0028a4a9daade3ff9effef9032c552dc07279c83471df2cbe6683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902401, "uuid": "116db1c0-bf26-440c-ba13-e3a51b6c367d", "value": "T15D73BF117F821D18D7F80F321ACC35DA0ABFB74E9A705BCA1D1E99980F37A9459E0B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902401, "uuid": "c4798b33-5bb1-45b6-b6f6-e8e74624ed2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902401, "uuid": "8f4af6ab-676e-4e7d-a564-c67a9f1aaf56", "value": "1536:ftHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtkc9/B1bA:ftHFo8dSE2EwR4uY41HyvYkc9/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902401, "uuid": "36db3416-c806-4425-b395-3457915e83f1", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902401, "uuid": "abf413d4-23f9-42df-afc8-418162dd3623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902401, "uuid": "abae88fc-6576-462e-8a76-079d86b4564c", "value": "681c8b08a32a6939018fa4fb91558b38d42ac197fc4d917fce9fa0890c0fbc89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105354b9-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632909194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909194, "uuid": "458a7845-2e3c-458b-b735-5a5a7031c690", "comment": "Malware payload (RemcosRAT)", "value": "cd4c42ef2f345e7319ed95c4a1432c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909194, "uuid": "df9426ab-e23b-4205-a753-ace5b6d8c918", "comment": "Malware payload (RemcosRAT)", "value": "694b6c17b725903cf563928c0e6d0857900dfd1773a2e12c9acc8fd30a2f16ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909194, "uuid": "9040f1d6-1237-4126-943a-b5d2871087dd", "comment": "Malware payload (RemcosRAT)", "value": "999c7e022b9144376cbff594510f3cdec3315821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909194, "uuid": "2bdb2153-3aca-4938-9e18-4b5901a602bb", "comment": "Malware payload (RemcosRAT)", "value": "ee910ad50cc62fd679f0971ecedc8d9701513a177a9c81b3bd38cf045657ff148cfd0f34e0acf200fbc2e42cc256ad10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909194, "uuid": "5b2b0024-bd05-40e1-b2c0-0106a6dc6cd8", "value": "T1A704C4496EB8AC2DF1953DB4B831A49513C93C03EB8552AE2095F7FC77348ED6852B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909194, "uuid": "a902c6a0-512b-4be9-8fb0-98e2f2430862", "value": "831c9926df4754b736e1ca092f4fb7e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909194, "uuid": "b0358598-97de-4a17-a579-d194969bab2b", "value": "3072:rTi/J486kf1Wczn3qscQ0lwebiYy92PvNPAPSntSMjjir3:rTixtOsc/ldWYy9KNPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909194, "uuid": "e7fe9344-d29a-412e-9c09-ab6567622626", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909194, "uuid": "b4cd08a0-6aed-4af1-b814-bcef0c40c451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909194, "uuid": "cfc9fcc7-566d-44fb-b89f-067f28ade797", "value": "cd4c42ef2f345e7319ed95c4a1432c9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a99dc0-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902406, "uuid": "644f7477-36e4-4f13-b0be-32b7f3994b13", "comment": "Malware payload", "value": "06f46e6935f3476b08ad672f4b5a8fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902406, "uuid": "7d4ba53a-ea40-41a7-8946-ba75570aebb4", "comment": "Malware payload", "value": "694ec4ca6a033d8b7b5f392d5235d2f235ff80373525cb4aa2b7d33894b72383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902406, "uuid": "8c211999-cb4f-47ff-872a-2d52864c5c96", "comment": "Malware payload", "value": "9afd033096c4228cbb3e385ae25a7e85e2494ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902406, "uuid": "ea5a72de-f478-4730-8c56-c836cb695dc7", "comment": "Malware payload", "value": "f634761bc46b940b6b3b5e0f3a68a7c6721f3d53c4eda7f7dc7860a224a0fce851ab83cbe179ab0f984b431cd34830c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902406, "uuid": "fd478f28-0289-44e2-b974-f7aff3a719cf", "value": "T10873BF117F412D1CEBB90A371AEC20DA0A7FF759D97083CE685F29C80B37A9649D1758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902406, "uuid": "9b2a8f6e-0c82-4151-a90e-9a7de2436bb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902406, "uuid": "1ca628f0-8aa8-46d3-bd81-5af6c9044bbc", "value": "1536:ssHY6uaJtVpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQtkit9/Q1xe:ssHYI3DJywQjDgTLopLwdCFJzkit9/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902406, "uuid": "5b9a4667-75bc-4dff-9c3a-5a80ac754f25", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902406, "uuid": "8c748f08-4506-4dc4-98c1-d767e1dff928", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902406, "uuid": "f378a3d9-0fe1-4724-8e2b-cf3956806e2d", "value": "694ec4ca6a033d8b7b5f392d5235d2f235ff80373525cb4aa2b7d33894b72383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4fa1a2-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632899901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899901, "uuid": "55da89f5-3147-4d5b-8383-4cfeff2ca1ea", "comment": "Malware payload (SakulaRAT)", "value": "0b3629fa520945b76b85322636141ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899901, "uuid": "a64a0f5d-460b-404c-96e5-e6cabdc918c7", "comment": "Malware payload (SakulaRAT)", "value": "6950ad8542fb913249c555b425722500f0933aeddef4fa8df1483368abd5b6fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899901, "uuid": "db7fe187-9ff8-4ecd-9f6b-78cc8e3be741", "comment": "Malware payload (SakulaRAT)", "value": "1b661f24645df1d5839001c9ef0d52074beb0805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899901, "uuid": "1126ebcd-e1a0-4924-898e-e1b7c9cb2f0f", "comment": "Malware payload (SakulaRAT)", "value": "bdcc7d1c74c54d1694b51c92b731f18f5eb70bfd86f9bd9b6fba948e8920ba102355d20311a3f2e9583df9477d877e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899901, "uuid": "a0a7eaf5-fbbf-410a-b7ad-2a6b961da6c4", "value": "T16506D51173F94985F2F3AB30ADB081555B36BDA99EF6C62E3144428D1E72A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899901, "uuid": "46a52d38-cd29-4c8a-bf96-5d153427898f", "value": "4511896d043677e4ab4578dc5bcab5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899901, "uuid": "ea3bd39c-ce55-49f4-bbfb-3f009543d664", "value": "49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTIq:oU6eUNZZJHsHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899901, "uuid": "248d8446-22c2-4534-a037-83f902a9f102", "value": 3801088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899901, "uuid": "4d9b3ab3-bf52-4537-8dc2-19a403911d88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899901, "uuid": "cb04d9c4-c22d-4ba6-998c-3b504a97ab9b", "value": "6950ad8542fb913249c555b425722500f0933aeddef4fa8df1483368abd5b6fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554015dd-2150-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632938945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938945, "uuid": "a8a93b76-c4ae-4a3e-a44f-e61b9be9efec", "comment": "Malware payload (Mirai)", "value": "83bb5bdeaa06c5932fd396cf45498b73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938945, "uuid": "4038b7ca-e1bf-4904-ad1f-17280a465912", "comment": "Malware payload (Mirai)", "value": "6984ad730f7778170530f0dd86f051ffe38674065b41ad8657ef32492706e621", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938945, "uuid": "998469e2-6885-4008-b7d1-dd46938ae4f8", "comment": "Malware payload (Mirai)", "value": "5205acc2f57713b7c74ebf671454e807fef82a55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938945, "uuid": "312fa2de-4ad7-4a08-af91-8e19cb388ca2", "comment": "Malware payload (Mirai)", "value": "193e6058b8de1d8f5b480c7e9fea48949fcc2cfef30dda6c81ca17de276a54e318a621b6bd211a5671feb0cb2b167215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938945, "uuid": "9c2078a0-3ec7-49fb-a22e-043723c23b56", "value": "T1E213F1B8DC811F67C863CA715A85D7E13B421A1F066B8F443A9EB720198346FF6C1DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938945, "uuid": "7b3060e4-4b8c-4450-a290-30cb221d1860", "value": "768:U0VHgDN2BWENWCkPP7NNfBZIqlvTy+KLzqF9XB4uVcqgw09P:U0VTBs7NNgqlvTjK+D4u+qgw09P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632938945, "uuid": "487af0c5-8bb1-46fd-97a7-f9dec906c619", "value": 43172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632938945, "uuid": "1f1361bc-e4d6-4ca7-a866-93473347df0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938945, "uuid": "0b8e91c5-15e8-4da2-97f4-c583c0107556", "value": "83bb5bdeaa06c5932fd396cf45498b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9070610d-20e2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632891799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891799, "uuid": "3a8ec484-0ee5-4aa7-bde4-2f3bcab133d8", "comment": "Malware payload (AgentTesla)", "value": "a2b336c5433d7d13e40a27b644ed2984", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891799, "uuid": "936d66e9-3f6d-469a-b688-c7ddf75c7de8", "comment": "Malware payload (AgentTesla)", "value": "6a6e9e3502235bafa58cdfb0967114d3f442235017df80b71a933eaedd6b5aaa", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891799, "uuid": "91fcb80c-3d18-4d74-b5a9-b015e8262a02", "comment": "Malware payload (AgentTesla)", "value": "2463ed8948726808749577f37fe7819204fa370d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891799, "uuid": "e8d9db99-a3d8-4c9e-8201-e5e293b9d27c", "comment": "Malware payload (AgentTesla)", "value": "5dcc76a1d23dd5f5acdab9cea76be5cb63f63e3b1fcd221eb93f25ba00d19e84e7973d01d8a0b51ef00efd35c6c2720c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891799, "uuid": "f2eb038b-9c3f-46b8-a71d-fdc6346003d5", "value": "T1EAC42325DF31395EF2D9B12AAB9C4331285AADB6843F1FEB4816C9B94F341885F4D270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891799, "uuid": "efd42986-7745-47d0-b6de-88d6f0781513", "value": "12288:0u+xfcaBBIPyZfHZzE4h6AFZxe3WUPT+j796q3czFigRyfPMVCE:uxjqPkf5zE8Zg3VY6FsnfPqCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632891799, "uuid": "1d16f23d-93e1-4216-b1c4-2dfdf1e6b794", "value": 590645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632891799, "uuid": "dc65d581-5e1c-450d-8433-d5252c18509b", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891799, "uuid": "d22e1f63-8861-4101-acca-c4ac81200b68", "value": "AUG.& SEPT. SOA.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e28fc3-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902301, "uuid": "bcac6a22-8e47-4939-a12e-e8497d6ad6f0", "comment": "Malware payload", "value": "3e9c2442716371f2ce03f0b6e4091403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902301, "uuid": "d9c1bbd1-9fd1-471e-9234-8f08612f64f0", "comment": "Malware payload", "value": "6c54c566a13a81110082c5a6d660a1f83d5740471fb60bfe8446049b2eba0aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902301, "uuid": "fcedcf5d-ee55-4a3f-b429-6fbe3333934e", "comment": "Malware payload", "value": "86e6c73510e59fe673d87b45bf0906321728dceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902301, "uuid": "cfea7ef1-1b74-4bea-8d71-7a37ba9a7928", "comment": "Malware payload", "value": "c3e59c4d23068fa712398bf1f95c58b9d55f67a4ad916fb5f0ef419a88548dff4ec811d1eaa5423042aed5499ae320b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902301, "uuid": "f6a0c194-74d5-4a1c-93b0-aabf62a50af0", "value": "T1EF73C012BF811D08E7BA4B3726EC31C606BFBB89AD3193CB642E59D85F37A5095D0718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902301, "uuid": "fc9ddf34-9278-4d9f-867f-2e9a3744681f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902301, "uuid": "339cc88f-a90b-4693-82ba-ee92221fdd04", "value": "1536:Cy58AXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC609/h1Dv:Cy584SyRxvhTzXPvCbW2U89/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902301, "uuid": "dc382d38-a673-43ae-9641-0869e69b6176", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902301, "uuid": "1658ce1c-0064-4cb0-a1bc-b608b13b4581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902301, "uuid": "d3308d43-a97d-483d-98e3-e74ed1955d95", "value": "6c54c566a13a81110082c5a6d660a1f83d5740471fb60bfe8446049b2eba0aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c382013b-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901334, "uuid": "01d84173-3372-4e47-a787-7403ac70affb", "comment": "Malware payload (Dridex)", "value": "4bef3db3c1b5cd11761a097099de2d5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901334, "uuid": "862cac46-56bd-4ff6-acec-a99bafeea05e", "comment": "Malware payload (Dridex)", "value": "6c76c549dd18c3390b297f6dc63ceed801c6fccba2a1dac1e0ed58125166644c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901334, "uuid": "535c54a4-bf71-4efc-9361-db92ca4ccb61", "comment": "Malware payload (Dridex)", "value": "a68e01084e5e7dce22a83fe784fed6a478ad33aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901334, "uuid": "c4f61864-dc8c-4350-91da-2879f865385e", "comment": "Malware payload (Dridex)", "value": "1361840d67f75ca6a573997d6e019e18d3915e3d647b92d602b23866a9a549185abae4a7ccf57386a8664aacae3b4957", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901334, "uuid": "2deb099c-ae18-42e3-acd4-03ed43915db6", "value": "T14E75D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901334, "uuid": "8e55aac1-88e3-404b-8bdc-f89f65d51e16", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901334, "uuid": "42a29310-cfb7-4201-b0f7-94b89c749168", "value": "12288:0VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:xfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901334, "uuid": "64d0b3bc-f3b4-4435-9f1d-5403c5e3b993", "value": 1687552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901334, "uuid": "cdd1c986-ce41-44af-9552-49f12bb0379c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901334, "uuid": "f25ed1b5-c6c8-4d0b-9907-710eff9a6b06", "value": "6c76c549dd18c3390b297f6dc63ceed801c6fccba2a1dac1e0ed58125166644c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9d1561-20c9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632880918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880918, "uuid": "63a03df9-97f0-4a2f-815c-9ec92d3fa414", "comment": "Malware payload (Loki)", "value": "ddbf9655fa3e197be8eeef1624e20d87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880918, "uuid": "6d36aec8-c650-4c75-af83-e1842423b8d7", "comment": "Malware payload (Loki)", "value": "6cc3d22a641945f3f2af9a672421b58fabd9571aabded8d2607d3b3bdd44d989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880918, "uuid": "a2ca3e65-d11b-4def-b139-692405d3a7ee", "comment": "Malware payload (Loki)", "value": "d1e51507367a0490e9f649b54ea157ccca45e8ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880918, "uuid": "46fabad7-a3e3-4fe1-b442-1c61a9a2123b", "comment": "Malware payload (Loki)", "value": "d1294b52f40c2a28953d890fbee276617c699d152d68e81461d75d63e04b8bb53223c35f310060de23c56db143666e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880918, "uuid": "c4006f22-d08e-4db3-a7e2-eff6d4617acd", "value": "T1BE057D2AB60CE65AFD1433F02124BCC415B81C981C6CAA17BA7671EAB4F9D27DCF505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880918, "uuid": "ff469ac0-d1d2-4b2b-8a43-2c7aa6dc6a35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880918, "uuid": "c0a048e7-a730-4c33-aee0-88629be00b07", "value": "24576:UD4VHfQe6ZyWshg+qbZxTZZWunAWv03M3BDAS9OWdZjg2Md6qm:kQ4dRdg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632880918, "uuid": "774fee60-9718-4726-b341-5c9e02551b73", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632880918, "uuid": "7de26cc9-2068-4167-b745-818c011fb92d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880918, "uuid": "22a88e60-40e2-4b6e-afc1-4cc97bbfaf1d", "value": "PO 290921-021A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70705005-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632896470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896470, "uuid": "c1661e66-4022-402c-b932-d60c2b029e95", "comment": "Malware payload (SnakeKeylogger)", "value": "b62305332313db1464f64e3d57d68be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896470, "uuid": "6f6eabdb-b008-4525-85c6-ef6be544ad29", "comment": "Malware payload (SnakeKeylogger)", "value": "6d0230717a15a1a5a5577af49a40d20be852f9e122672790f64f3733456be252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896470, "uuid": "3cecc969-0920-4b48-a933-c56582d61396", "comment": "Malware payload (SnakeKeylogger)", "value": "a02dd886316c731588b48ba03c98dfe351b5717a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896470, "uuid": "f1e60455-6e0b-4e83-b41d-c99d99f7f78f", "comment": "Malware payload (SnakeKeylogger)", "value": "0f9101371809675e78fdc718e18031b5f493b7baa69f3e27b33a220be3d7f7b7984b1fc0486732baea3d159e56161f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896470, "uuid": "bc755e93-1d1e-4783-bdcb-77dd60898146", "value": "T19F057C1AB60CEA5AFD1433F02124BCC415E81C981C6CAA17B97672E6B4F9E27DCF505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896470, "uuid": "4814abbb-ce26-4cc8-9463-924357cd32ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896470, "uuid": "11e9b85d-302a-4577-9245-5d2354b8bebd", "value": "24576:dD4VHfQe6ZyWshg+qbZxTZZWunAWv23M3Vvi2WkBve7eGfbZh3:P24VvdHBeFfbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896470, "uuid": "06480bd9-5ebb-4c44-920f-c3163e924629", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896470, "uuid": "9aaad7e8-62a2-48c2-b0d5-ea67f40bf207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896470, "uuid": "5989a4d7-f455-4ece-8360-f03b84042875", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cb0df7-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632898524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898524, "uuid": "0db9c541-e21a-47c3-9a3b-2528239e19d2", "comment": "Malware payload (Loki)", "value": "f9195efb018cd6f0d2651f119d79451e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898524, "uuid": "5e36bee3-3035-40aa-af1b-e2f72b452f85", "comment": "Malware payload (Loki)", "value": "6d90c6599617815d0404c2e9c500f68978639b1e2cf7338e512304257bb6a9c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898524, "uuid": "5932ba03-d634-4b96-a86c-d431c09ef667", "comment": "Malware payload (Loki)", "value": "e6064c2dadfc436b63de8f5336ee7e685b889918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898524, "uuid": "4b0d6c33-9ea1-4667-bca7-63f55ab3891e", "comment": "Malware payload (Loki)", "value": "0342a1e444fdda59becb8e59279c9cc7862c6c7183af4b677647158af95d99a81e6be4fee6cd1b2b8a812fa9f8c35b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898524, "uuid": "cff81c4d-2c54-45e6-9c4f-5d72079ab5fa", "value": "T165056D69B60CE64AFD1433F02124BCC411F81C981C6CAA17B97672EAB4F9E27DDB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898524, "uuid": "833868fc-532e-4533-9672-41e9c00e096f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898524, "uuid": "84818167-afdc-45fe-89d8-bd769f6eb33d", "value": "24576:gD4VHfQe6ZyWshg+qbZxTZZWunAWvw3M3qAcRbiZ56UHTky0dEPS:Is4qLbq64P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898524, "uuid": "2dfcae21-57c1-4467-9291-b7444bf470b0", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898524, "uuid": "1a4d87b4-6e50-4209-a595-8c8d5c2c51ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898524, "uuid": "722d1d8d-f654-46ca-8fa3-254ea1c7ba28", "value": "Original shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed988fb-2114-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632913352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913352, "uuid": "ae22b0a1-a0b8-40f8-8da0-00725981f563", "comment": "Malware payload", "value": "2fb19e7e14e4adb6c338dbe3f8a91f13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913352, "uuid": "9648f016-68b2-49c3-83e8-b83dae5f0ba0", "comment": "Malware payload", "value": "6e34dcb9961e3e77b611d86dfd67c5c692e273d9a2d7ff619f9b2004dd918389", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913352, "uuid": "c99729dc-3953-4a78-84b0-f2939f1bbdab", "comment": "Malware payload", "value": "765c765e44f7f168be268209bbf50394ff4e8d90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913352, "uuid": "353abc8c-8095-41b5-b1df-6f433e3ac883", "comment": "Malware payload", "value": "ac2258bb0df12b20f1894dff1adb134231b2fe9bd8238c259301e085c5467bb001df4af54f33d2136a6af5536ca1cc53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913352, "uuid": "7b355fce-924b-48fc-820c-5436267335ae", "value": "T1D3C35B95B68CCFA9DE9804BD887A9BF700177C3988D08647B6D6BE4D3739280A431F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913352, "uuid": "03c6974e-19d9-4134-be1a-4b54bbdbd128", "value": "59f9582f251e861f2c149d17f4ba80d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913352, "uuid": "61d1b4b1-5ee0-43d9-8dea-23af3cf81ecf", "value": "1536:iKbMbYibslYbllZ+VFzT8G70qfU/5tqGZh9V/fNpM9n:1MDwYbzZUFEFjZhPFpM9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632913352, "uuid": "c1952b83-0d66-443b-a3aa-d71b7c7f09ca", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632913352, "uuid": "ef30fcd1-379b-4f53-a1b0-0fa1a78df9ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913352, "uuid": "5ca9adca-d576-44ad-9dd6-43994f9af92e", "value": "2fb19e7e14e4adb6c338dbe3f8a91f13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6fd5c0-2118-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632915017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915017, "uuid": "a4d6e978-2339-4f20-aee0-5f9d18733950", "comment": "Malware payload (AsyncRAT)", "value": "655f3cf0085868f2affc32d213da50d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915017, "uuid": "eb761c9a-4afe-4857-8327-a61900990d05", "comment": "Malware payload (AsyncRAT)", "value": "6e5bc57767ea314f50262e10884e592ac5e833165d85db41e2033baaa7c5682d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915017, "uuid": "ca605671-4b68-4770-b538-cc324d316dc7", "comment": "Malware payload (AsyncRAT)", "value": "2c82478df1425ee624fdac8033ad5e70e9cc1cfb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915017, "uuid": "71c8273a-2aad-49f9-a500-1b20a7398b9f", "comment": "Malware payload (AsyncRAT)", "value": "a575ebc800b3f80e4e6e60323311e8dcaffa9e8d13a0752c02064b3eb282ceedebf8015c854606d9bb55ce43b8f437f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915017, "uuid": "d2bec9c8-e64a-4552-8bb7-43eb9fcaddf0", "value": "T15EE23E437262E951CBA8D3424F89BE649A3D389992336D4CD0B566C02C70FD3A74437F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915017, "uuid": "9c5e0407-0044-4943-a928-577e8fcd6e81", "value": "48:oW4xVsr5Ls1s6l7LP4V55Ams1s9OXPA5CVqIl:o7xVsr5LKhl7LP4V7AmK+OXPAYVqIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915017, "uuid": "208489c7-b88b-45b6-8778-826f72804797", "value": 31860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915017, "uuid": "21ae55d9-107c-4f32-94f8-d509a945bfd4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915017, "uuid": "4436bf9e-1f2d-4177-8796-8587ad3c6729", "value": "PAID.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076dd168-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902307, "uuid": "f2d1945e-2215-43a4-8f84-b0d2fe0e9885", "comment": "Malware payload", "value": "d6f0acf54c14677cdd616386fc1ba8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902307, "uuid": "28af51ee-abc5-4ea0-ae8e-c25b5d88d6fd", "comment": "Malware payload", "value": "6f3508b449d6515999f5a05d6f61bbcb583dcd5cafc16d5f4480621d08c8750f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902307, "uuid": "1e8e7424-d2df-4faf-a6be-85f2eda9e58c", "comment": "Malware payload", "value": "d847c0272dbe595ee0691e49d17954c08d1935af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902307, "uuid": "29114c3d-f78b-4fed-84a5-4fb0926466f2", "comment": "Malware payload", "value": "9225d952b8d24eb6f1f7ae53bfe54527bb9f8fa74c56afc08bcc2170ad26511b789dc629ba3a744ba1be66d702baf466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902307, "uuid": "458db038-e103-4e0b-92cd-2c865c144cdd", "value": "T14573CF15AF410D08E7F80B3205DC76DA06BFFB4EE67053CA5D1E69A82B37B9095E0768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902307, "uuid": "1a3ff6c3-bf58-44fa-aabf-a3894ef96cb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902307, "uuid": "28d3ab1f-331c-484e-94b4-0ba34cf3a100", "value": "1536:pWtHFo6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt1V9/I1d+:pWtHFo53Ln7N041Qqhg1V9/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902307, "uuid": "ee64174a-3cf6-4808-b616-63bf7c0ee7b4", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902307, "uuid": "490f41b5-f31b-47ab-b1fb-67fcd44c6d68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902307, "uuid": "36f64b0f-74e9-4caf-8bff-19a38d17a4fa", "value": "6f3508b449d6515999f5a05d6f61bbcb583dcd5cafc16d5f4480621d08c8750f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e743811-2137-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632928330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928330, "uuid": "4279115a-c261-4f48-93f2-2c788e184729", "comment": "Malware payload (RaccoonStealer)", "value": "bd8eff81d5cf19daa3d7e3faa6b50034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928330, "uuid": "df9e34d9-92d1-4999-b87c-38e8166d32b6", "comment": "Malware payload (RaccoonStealer)", "value": "70c9a50508878a796816729106789b3d58451adaf76d7dc77e2a29eba07c3706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928330, "uuid": "abfb2393-844e-411a-a00a-f605bb6013a9", "comment": "Malware payload (RaccoonStealer)", "value": "d9d05ae9a36f309e4459f9dd4706f930df19343c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928330, "uuid": "acafd520-3acd-410f-be2e-c621ff3f0ec0", "comment": "Malware payload (RaccoonStealer)", "value": "847587c0d055dd8db42fadc0a9be361d84531b033e5f7ba08b2812975edfa7564cc57a9ae7765f34b27518d57680ebe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928330, "uuid": "0ac4e862-ef73-4e0f-b0ce-fbf2c179087c", "value": "T13994121134B0C2BAE41716707C62CAA41ABCB9AC1F2196C77B154BEFAF7D3D24A25385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928330, "uuid": "ead6793b-4c82-41be-bff0-d50dfc184258", "value": "2966ac92acef7bd43000e50be4b3a82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928330, "uuid": "dfb78752-b6b1-463d-a11a-9706b8d1381d", "value": "12288:JSGy7lt3Xg5jqJYiKFDXHmZV2j1I1LA8:UR3eiK6V2j1I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632928330, "uuid": "063abfda-6fa0-4796-92f8-441891d8f5b7", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632928330, "uuid": "0e953b6b-c7ce-4a01-8920-389ef50aff62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928330, "uuid": "1380c5c1-529d-46ff-be27-61c11059ae54", "value": "70c9a50508878a796816729106789b3d58451adaf76d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91345384-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900391, "uuid": "35dd4640-4a5e-48aa-8591-2b708bb5d633", "comment": "Malware payload (Dridex)", "value": "e3e28965b6015c115443b9b24364bee7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900391, "uuid": "b329080e-1e29-4d73-832f-54e16773cc97", "comment": "Malware payload (Dridex)", "value": "7131a69d924068d81af263e5d9b4b48f7076a85c1de8cf9bc4f3fd33ffa779e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900391, "uuid": "57e27205-a2c6-44e8-a9bf-3cf91af5b47d", "comment": "Malware payload (Dridex)", "value": "b3dda4c89364fc49a0c9e5dd2e1ae111e84c42eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900391, "uuid": "e2367307-fab0-4de1-bcd7-39ced0d3b891", "comment": "Malware payload (Dridex)", "value": "8a80bfde62cb1659e09c2030a0e42ef5a9029f68afafba287370af2b8c7d4c85ee6e5ee93cec31521f048d05e0a93a1c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900391, "uuid": "5467e66c-6cc4-4290-9e8a-74ee9c0b4beb", "value": "T17DA5D020EF69E1E6C6B89F3E9408352327B93D75110D618CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900391, "uuid": "10108fb3-0813-483f-80ca-ea4dbb0a2f75", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900391, "uuid": "075ab05c-2be3-4705-901b-e3504c8301bd", "value": "12288:dVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:EfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900391, "uuid": "17d0eadc-82fc-4b43-956b-0c7e2e54ce8d", "value": 2220032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900391, "uuid": "4f95bca1-dff4-47b2-97e6-b4d1d49ad7d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900391, "uuid": "9965db7b-fb05-4bdf-b363-c319de5726c9", "value": "7131a69d924068d81af263e5d9b4b48f7076a85c1de8cf9bc4f3fd33ffa779e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c3e2b9-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632898328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898328, "uuid": "37e835c4-939f-477d-913e-cc3e729d3080", "comment": "Malware payload (SakulaRAT)", "value": "902df55959d41db8e20027e49f1aac56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898328, "uuid": "497b7302-8e1a-4ed6-a7a6-07e1724a5ceb", "comment": "Malware payload (SakulaRAT)", "value": "71ad01b3800843dcea5938bf503c416125e8ed7e31277cb962bbcc82b288ad07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898328, "uuid": "35e2278b-a4ba-452d-a279-a53c2d04df9b", "comment": "Malware payload (SakulaRAT)", "value": "36398ed548a49b068ca41359e9830a553827da48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898328, "uuid": "82a98203-9b00-46c1-8c8a-5e959608daee", "comment": "Malware payload (SakulaRAT)", "value": "e93415412354afec81d7b2014836eeac1c7a29d2c9811a3841743079f3d60d1e26519a328d2e4a9c50c9cbf073b0782f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898328, "uuid": "4bf9b402-c9e6-4153-877e-a1197fe15008", "value": "T16126A21173F90895F2F3AB30AEB181555B36BDA59EF6C62E3144428E0D76A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898328, "uuid": "357abe64-3a1d-4c94-bf03-ac67cc46741b", "value": "539502771da573641ecc7f6497e39f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898328, "uuid": "971b21a3-7064-41b6-990b-5d6f3d3f11cc", "value": "24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYA:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898328, "uuid": "8ba494b7-b9ac-4196-a824-24eadcce01bf", "value": 4694016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898328, "uuid": "247a42be-5f23-4465-9709-bada5855985f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898328, "uuid": "49817aae-5fc5-413a-9816-89a9fb7e98fd", "value": "71ad01b3800843dcea5938bf503c416125e8ed7e31277cb962bbcc82b288ad07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb479751-216e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632952028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952028, "uuid": "7058f680-00c9-480e-b46b-2b84d02ca9de", "comment": "Malware payload", "value": "e5ab524fdfd1fbf0854c89e65defd2df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952028, "uuid": "8cb1d5ce-a267-478b-9898-8355e292a25f", "comment": "Malware payload", "value": "726f6b9cf0d4c07612cdd6960a0aa89838baaaed46e8470b6f0ae2422fee325b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952028, "uuid": "b220fbc8-bdcc-4687-b8b2-d8a52c8a85c8", "comment": "Malware payload", "value": "aed2cf600468d9bd63696eb310b9ebbbe3e5b052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952028, "uuid": "644cbb47-80d5-45fd-927d-c6ca44becf50", "comment": "Malware payload", "value": "261e02d1d38e9abafd4a473c7cfe9f6a3c2252feab99a77bc506378520d0e9b0fc80358c45f5d56988356e0e447bbf84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952028, "uuid": "d87d2ba7-f954-40c0-b5d0-c7430498e81c", "value": "T1CFC402D0A5A0D5F2C31545BF48A2C6BCD5ED7C6CAFA066B32F8056EE6E34183A713217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952028, "uuid": "70960444-f8b3-403e-a780-4c2a54f0f160", "value": "80a508c8657a344b6b8e2e6999ecb92a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952028, "uuid": "641d7454-abe9-44db-a8a8-1837863e51bd", "value": "12288:ZgJ5wvgcyO/Exi/+IE80OorWj1pdCsFI17PG+:85wv6O/ci/+IE80OMWj1/CsFI1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632952028, "uuid": "daa68827-9fbb-4342-8c07-25efb9644db3", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632952028, "uuid": "f2df2564-1a2f-425f-af2d-feeaf8b70989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952028, "uuid": "7c58a8d6-ea23-4a78-ae8b-9fb38990f3ea", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.8024.266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372b1ee0-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632909259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909259, "uuid": "fbeff87e-de95-4c45-ae76-c949ea106be3", "comment": "Malware payload (AveMariaRAT)", "value": "234845cfbdd1def148bc0e57904df499", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909259, "uuid": "afee7029-17c3-47e8-92a2-736190d8287b", "comment": "Malware payload (AveMariaRAT)", "value": "7272fdc3facbd587946b1fd31d836dfd4ec5bbeb4b157d93c70611e854c70c89", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909259, "uuid": "a843d010-1744-45b1-bbf2-3ed86be3f218", "comment": "Malware payload (AveMariaRAT)", "value": "29c961d3308bb72b8f91de034a7c5500a6e1a034", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909259, "uuid": "f2f5ae02-2fe8-4db2-a5c0-8bb0848354f1", "comment": "Malware payload (AveMariaRAT)", "value": "e6ef75278e01a1ac9c31011407a8e543718d771ec5ad6808d2ae8a5f5be2dfb026713d14796f0056d8a9c5312ce49c9f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909259, "uuid": "f3bf21dd-2d6e-42c5-95c2-a0756b0cd975", "value": "T1EF157C394D2682F787EEC66CD08C0BCEDEA6A4837B919F1AC496D7D2025770FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909259, "uuid": "e5ac58f7-5e89-438f-be33-19b231012543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909259, "uuid": "b5898948-ab17-4a3d-9a49-d856389eaaba", "value": "6144:wUmWk+SWrtbcjZ2hahc21yPpWmulhR3QYHqOUga/yh3lZvIzii6qXCS20WSLl9fl:3mdetbaZ6ahc/nWhR3ndzh3olv1jDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909259, "uuid": "bb6b048d-6ed3-4dc7-bdbe-1b29c7a365d9", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909259, "uuid": "8c8227a5-dd29-4424-ac86-641e5fbab8b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909259, "uuid": "08d9d130-31fa-40d9-97bb-11733910ea26", "value": "234845cfbdd1def148bc0e57904df499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad9bc65-2121-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632918768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918768, "uuid": "b02e73d9-0bcc-48b1-90fb-20c52b075611", "comment": "Malware payload (Formbook)", "value": "cf92b80bd587ac1498dd3e37fee96af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918768, "uuid": "fb717bca-33fd-491e-8c46-bf3aff4218dc", "comment": "Malware payload (Formbook)", "value": "727d99fbf5a7d58b50ea62f289cf59b251ffe3e6f5d9487f7716127654e6e32a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918768, "uuid": "27b59e2d-85d0-464f-8708-2e19d6d643b7", "comment": "Malware payload (Formbook)", "value": "ecaef1532016cc58333ddff64ace07d2a51bde72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918768, "uuid": "3c6f9c78-a66b-40a9-9410-3e8145a97883", "comment": "Malware payload (Formbook)", "value": "cafc347a40d95cae6ca49aad93d349fb194b1989ac3de27531aff7533b369df324d77676aeb0f690e2c8f06e6e2a06d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918768, "uuid": "fb867fb6-72cf-4322-a23e-7d8035ab1bea", "value": "T1D2F48D6DF60CE29EFD0903B021297CD425EC1CAD197CBA17BE96B5E230AED7651F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918768, "uuid": "db88b770-49ce-415b-9cd0-9287128b32ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918768, "uuid": "fe3a9c6a-9198-4ccd-a808-7cf9d4731ac1", "value": "12288:yD4VHfQe6ZyWshg+qbZxTZZWunAWvhZ/uMAqZd209FMEwdXvKn3sdOeu2UwV0c:yD4VHfQe6ZyWshg+qbZxTZZWunAWvhrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918768, "uuid": "36a7919b-b998-4f87-ba18-c9e434a6a46f", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918768, "uuid": "e3eececf-f456-48ea-a066-9001df462bad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918768, "uuid": "93ac5f0c-16d3-4913-a588-ded6f72ce92e", "value": "PURCHASE ORDER 29kva.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc8d218-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903099, "uuid": "f2360b7a-abfb-4497-bb48-e67c0ec02ffa", "comment": "Malware payload (njrat)", "value": "5f8e3dd89a3b5f1b1ec1f110b493ccea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903099, "uuid": "003ad6cb-666e-4f9a-8ea9-0bd078244602", "comment": "Malware payload (njrat)", "value": "735d10d570d76ffea72ab0685dbc80bdd3982ab34407870cb912aac8e524dffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903099, "uuid": "30a53cb0-3ff4-4544-a6e3-043467f259a2", "comment": "Malware payload (njrat)", "value": "96dd188414c409126e8487f57fca3f9621339f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903099, "uuid": "2d732e57-692f-439c-a6d1-0daf9c124619", "comment": "Malware payload (njrat)", "value": "42d8c9cdff048f24693dfde9c800449d9f9485618051dc496fcf14c73e8f42687c6887a592aad69ff4f83aed6741f298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903099, "uuid": "de88be0d-6fec-44a5-9817-6d1d796539f9", "value": "T1F203E13007F8CDB9D6969E32089AE4002BB7C70099ABFB3ED984516B5D9AF62C570617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903099, "uuid": "0d7d806c-f6f8-4807-94f3-4fb278aa2226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903099, "uuid": "b26ac2f7-2e25-44bf-bf16-82815cfd5b36", "value": "768:vazjpDcyDhgINHLM0Li4QYfhNLf7sdF+wHxRI:CzayNLQ0Li1cLf4RI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903099, "uuid": "f4a858ad-853c-4d80-a683-a9f6d035a0ac", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903099, "uuid": "b577d395-3e9c-4c9e-8464-c284af4a5009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903099, "uuid": "416a3ffe-ce61-4a30-a409-08a723afb431", "value": "735d10d570d76ffea72ab0685dbc80bdd3982ab34407870cb912aac8e524dffa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6422bd9-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927565, "uuid": "03b3fdef-37e6-478a-8fb5-90e0f14e103f", "comment": "Malware payload", "value": "2af66dcb0b022dde5be20760b04c1d77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927565, "uuid": "f5a1df0e-fbf1-4761-855e-41a0a3efaf14", "comment": "Malware payload", "value": "73e2b453d6425d695cb73be04ca25a5ecf14c86cb513fbe10004da0a2e922aff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927565, "uuid": "7e00aa75-0fe3-4702-92cc-0e48a00d9f96", "comment": "Malware payload", "value": "a512cb2b73441fc635da9934a86fc1d530bb928c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927565, "uuid": "d8431b04-c3bf-4d43-b351-2f7b50542124", "comment": "Malware payload", "value": "1b25ffd679f42c1be5722843168d74f7c2d2db25d96d28f6626b0727c42d60d9175985e1e2d2c74b9a4e932739e2f7c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927565, "uuid": "19d9b485-9eed-4c24-a5f6-5219a1ab7e09", "value": "T1BCB2F90A9651F1ABD98352B2544F52F362008B166BF99ECF2DD81CF0BF191D576BC123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927565, "uuid": "34d8bd6a-73f1-4c48-a8ef-337939acf8e8", "value": "197c7db27e52a8912c7aa5ffd4e76b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927565, "uuid": "fefc3831-015a-4d06-861d-1e0a97c59014", "value": "384:Nt+65SU5r0uoC/74hV6dAbxnRX2Hm2RDGIuLirU6ZnOag95xxM4w916YN:Nt+65SU5rPoC/7w1pLirGaCxMRaYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927565, "uuid": "c74bf36c-a2f9-485b-8870-7cf0df8c8c44", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927565, "uuid": "3890a45b-cf4a-4915-be1f-0c1c69908f60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927565, "uuid": "e21ad495-bf50-49db-9642-14747b8d67ca", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.1763.9507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e27e0e8-20ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632883071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883071, "uuid": "66428a79-368b-486b-af31-97dffa95f6a0", "comment": "Malware payload (Formbook)", "value": "48043c9a21d0547478331c1613660595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883071, "uuid": "be0483e0-43e2-4868-8fb7-cd46f894ad5f", "comment": "Malware payload (Formbook)", "value": "75772375acbcfb6cb668fc2449671a6a83afe1434184ac7c01fd895825fcf5e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883071, "uuid": "55b01ee6-c665-476b-a602-d0b1e4ef72bb", "comment": "Malware payload (Formbook)", "value": "9985a65e0aa690308454632223393d8d18a1c744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883071, "uuid": "3d046e4c-95ca-4676-8c7f-f6074125a1d5", "comment": "Malware payload (Formbook)", "value": "b41961fb48b2e616d5fc70eaef42ef907c18e3da65169b70bc025c951d381e0e4ff5c424fac358eaed91cb9f4cdeb775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883071, "uuid": "918467fa-b598-43d9-9acb-9e7dafb955d5", "value": "T17F4423556982CDF3CAE366301571ABBAFE77C01421357A0B2FB85E330D7294A5B2335A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883071, "uuid": "cf0ef070-0ba0-477b-8fdf-7fbacdf789c3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883071, "uuid": "d89d7773-c25e-4f1b-8740-6c9ee5d0c414", "value": "6144:F8LxBsQpdS5YvokAIez44IpuctJDq2xs3FIN5fo25WHZEhnsxV:/86YvokAIez4xpltJi25Q20HZW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632883071, "uuid": "0c520946-a8cf-4056-98fd-84c34b5060ff", "value": 258720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632883071, "uuid": "b855525b-3b25-40fb-aa60-b327db1358ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883071, "uuid": "1f08dd98-9056-40db-b699-24f56495d4a3", "value": "QUOTE_PRICE_REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d69d58d-211d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632917162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917162, "uuid": "677da187-95cc-43d1-a698-95b01c5af87f", "comment": "Malware payload (AgentTesla)", "value": "bba44b9e65a8dbe2faf972824a5368bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917162, "uuid": "e1f820fb-635b-4367-b2c8-5bba17c25096", "comment": "Malware payload (AgentTesla)", "value": "760b7ac1358b65c0c450b8ba8bbd0649d2b3ad3499b2b88c84c40fbb4f6c680a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917162, "uuid": "43119883-bac6-4d50-b565-39b31c3dbec7", "comment": "Malware payload (AgentTesla)", "value": "e9c1772d93587f637dcd8d329607ec1232048f8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917162, "uuid": "237c11a1-66ca-41e6-8d73-b7881fde52b1", "comment": "Malware payload (AgentTesla)", "value": "c43c0788953c902992b292a31c088db2e27c9e71c96094bf4f4f0e068db908ec308f79bcaa85134ae11d5ff258f2ad2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917162, "uuid": "f83aff63-6671-4f20-9afa-2154db3c4fbf", "value": "T182D4135E3564513BDC5D47B59802CD8643F84D239E91FB8FAC8876CB0DB23E96A0E386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917162, "uuid": "1f212e7c-232a-4a14-8adb-47f8448da62c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917162, "uuid": "3d90cf2e-5be8-4635-8526-d261529a729f", "value": "12288:i78/XCCGfzJsnAOFwNlRAtmmUYzZtlaxVT7czDVeMGD8q+Ri0cyhWdo:c6XCCGfunAOFw3KU6HaxVT7c4JSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632917162, "uuid": "0ef24d0c-90de-4ccd-a5ac-2d8751d62d9a", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632917162, "uuid": "4c14b03c-c45e-4088-9f37-b6603f5436d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917162, "uuid": "65dc3659-578e-4ba9-8618-e410c6ce2b31", "value": "NEW_ORDER_LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a9e02d-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901477, "uuid": "9eb2733d-5dc2-4f73-9c12-a2db73dcaaf5", "comment": "Malware payload (Dridex)", "value": "c3ab807b3600d62bb49c3410fe3fbba6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901477, "uuid": "e5be8153-6223-4c76-8728-fb4392196602", "comment": "Malware payload (Dridex)", "value": "7630eb99cd2f4a7013bb742dc2b4619ec632924cd3d1a2bdc078b946b7c3efa7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901477, "uuid": "d34b335c-dd7d-4ac9-8316-e805cd68854f", "comment": "Malware payload (Dridex)", "value": "616110c1b21e1922361ea02eba30115abae45b12", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901477, "uuid": "62affb4e-9f6d-4101-ba99-221db102ab5e", "comment": "Malware payload (Dridex)", "value": "238ab9264fd9412e6582d282c5dea67aa473175c5aa1e4ee3c79793a88a93077355780597a2608f19839368eb0120aad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901477, "uuid": "74591849-d2a1-4f2f-b4ff-4d0ed5091e77", "value": "T191356C10F3F30A83C0DEF6797CED1814F1939A86C56F8B1D490F13166496B922EEAA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901477, "uuid": "b1ad9dfc-d6a9-4101-b654-cfcb13c26916", "value": "c6b4c2eec8a93016c63563421e15f011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901477, "uuid": "a74b70b5-a506-4de9-b9fc-78c3e4ffa50c", "value": "12288:/dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0TbLKH:lMIJxSDX3bqjhcfHk7MzH6z3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901477, "uuid": "d911aa38-d036-4011-849e-0d600aa1cbe4", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901477, "uuid": "783cbc66-060b-4323-9ff9-dad063030b22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901477, "uuid": "7590d73a-f00f-4964-9d2d-39eba4381f37", "value": "7630eb99cd2f4a7013bb742dc2b4619ec632924cd3d1a2bdc078b946b7c3efa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad384e9-2124-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632920137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920137, "uuid": "3772ecdd-9844-4d5a-acfe-b1f2b217644a", "comment": "Malware payload (GuLoader)", "value": "eccfb67a7f6a829dd70ae1501132a664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920137, "uuid": "40b8710d-47a9-4572-aedb-dbae79cfdff6", "comment": "Malware payload (GuLoader)", "value": "767852ed362267b8b12d3aff70c4950db43072773423a3853953c7c45356014a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920137, "uuid": "48cacca7-554d-4242-8aac-7c9463aefa52", "comment": "Malware payload (GuLoader)", "value": "1a33d5da4c3423fb956868a3812899134714775e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920137, "uuid": "74cbe96c-6855-40cc-9e75-0f06a146b8f5", "comment": "Malware payload (GuLoader)", "value": "9d673ad6b25e5fbaa83c79f996633ab571ec72db45e777ddcabb8313ada545110531f51fa855fd6c941da1c0b2b0dcf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920137, "uuid": "d207561b-9395-4768-ab48-5cf665e1b02e", "value": "T158A3E635F694EFE5EC0A86FEF762F1F6A4EA9C50C9429A4322007F1474F62C314A4669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920137, "uuid": "ad1e7c21-7489-46bf-854f-d6969434e1f5", "value": "c8e60e2fb4b6c06af2ec95b1f57156a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920137, "uuid": "9c4a9fa4-7a1e-4ecc-be7b-86a0dae5ee0f", "value": "768:t2Q2OuUjPw5g5te2Ug9c+UOZJ7jURuG7THbJ2kbKQfg65AhjoPc25qUH/c8TGQ:t2Qr7w5itUg9cujUZHt7GoPRDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632920137, "uuid": "615c7897-da25-4ad4-a150-539a5c05de96", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632920137, "uuid": "c1ac6b00-f25f-4fdb-a916-3262beb80a0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920137, "uuid": "c7f7db92-0847-4d21-9fa2-9aa965c723f5", "value": "SALES CONTRACT GH498789SMC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a753a9-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901123, "uuid": "5438426c-6621-4774-ac2f-7136f07a4a51", "comment": "Malware payload (Dridex)", "value": "05895a9a51666b349018181c47a225dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901123, "uuid": "b6517b15-7dfd-4c6c-8b5a-977a4b4e362e", "comment": "Malware payload (Dridex)", "value": "7686f055f8b252f4896523a8991be23fdd27da4cd1c71e012c6f9643c3ba587a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901123, "uuid": "600cecb6-d18b-4a8d-b84b-d6e5cdc1ceb4", "comment": "Malware payload (Dridex)", "value": "b668dcf35e678feb89d80132bd2caed305b00c4d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901123, "uuid": "473925f8-c927-4cf0-ba62-fc049219d1bc", "comment": "Malware payload (Dridex)", "value": "73a88523086dc96079cb9b13d7d580b88bd3c28ac169d4ad5cdbf116a0e649d78ab935ddc70e1427d00d28020f4fb71f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901123, "uuid": "b70f564f-223b-455b-a575-afa45cbcacca", "value": "T17985D010FE69EDE6C6B59F3E9408352317B93D74030DA18CC392604F5EF86546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901123, "uuid": "5b9c9322-b062-4f46-9475-1d6f18fdf35b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901123, "uuid": "0b0305d9-1b2f-4218-8466-93dac07ede98", "value": "12288:oVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1icN:9fP7fWsK5z9A+WGAW+V5SB6Ct4bnbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901123, "uuid": "3b69e1af-f516-4473-9c78-ed6d732d7717", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901123, "uuid": "ad359f41-2a88-4147-926e-a2d441af8f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901123, "uuid": "a992741b-6a28-44d5-9e8f-3eba8e57b42b", "value": "7686f055f8b252f4896523a8991be23fdd27da4cd1c71e012c6f9643c3ba587a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47b699b-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632885042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885042, "uuid": "cd9297c9-c0b4-42b6-b0a5-656deacb11d8", "comment": "Malware payload (ArkeiStealer)", "value": "642095b6952177a920e21195a0ae52ba", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885042, "uuid": "82461a0a-7bce-4406-a47b-c7a8ab414444", "comment": "Malware payload (ArkeiStealer)", "value": "774753d2a216a134c971df97df73b7c8efb0f1207e7948dbacff5e2e30f85456", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885042, "uuid": "713d1b5f-8587-42d3-a5f7-3be035ede6e0", "comment": "Malware payload (ArkeiStealer)", "value": "135d1bffc0f725149a70aed23cf3289ded881367", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885042, "uuid": "86576ed1-2264-4ac7-93d5-c36046baea48", "comment": "Malware payload (ArkeiStealer)", "value": "f6c68363735bef3ef090bfa406ff52a6bdbfd0f9ae9061730260c0f4b497131a14c4119fdf3813f609be533b1e9aa925", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885042, "uuid": "3e309cea-578f-40de-8e16-ad43769d7bb1", "value": "T12DD41200B542DBF1C362017E6826C7EDA43DB98CFBE172B5775916CF9B390A7BA21244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885042, "uuid": "f9aead5d-be38-44da-ae68-5a9ffcb0a074", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885042, "uuid": "9d7ec2e3-c3d6-4306-8411-828592f86e6d", "value": "12288:aM8qQgwBNHtixWf2bvKLlvalSfy5XcwGVjao8nzsI16IkHC:r8qQ2WeTKRvaAa+wGVjxIAI1Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885042, "uuid": "e197556b-348b-460a-a67b-e6aeb346076e", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885042, "uuid": "ce3b69a7-e63c-4d17-a54f-c60e517a3e46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885042, "uuid": "c207ec1b-7589-4737-9383-3acd39595e41", "value": "642095b6952177a920e21195a0ae52ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf39e4e-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900436, "uuid": "5902cc53-1d19-456c-a62b-e9b4fcbcffd6", "comment": "Malware payload (Dridex)", "value": "19447b16b765238fe5a810661d83b820", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900436, "uuid": "ded78142-2e37-487d-9948-1d0c31f1d84e", "comment": "Malware payload (Dridex)", "value": "7750aba76f900f7844c75baf4ba647219dff8f5fb937533714f2d0bf5be6df12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900436, "uuid": "e8a693a5-faa8-4473-a237-14e8db97793a", "comment": "Malware payload (Dridex)", "value": "872bb0dc7e1a774dc993119696f51577bd472eae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900436, "uuid": "922f5e72-dfe8-4a61-b3ea-022fd3def6b1", "comment": "Malware payload (Dridex)", "value": "3bc888d7e0e0d914af5dea9be7486f5fb4f562b185126928bb2651fc145b84edb040435cc4dfdd6a9e73ebd5c7708d73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900436, "uuid": "801792ce-cd15-49d7-bb59-625b3459744c", "value": "T17DA5E020EE69E1E6C6B89F3ED408352717F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900436, "uuid": "54f57026-39bf-4b25-8669-39b93f72bb47", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900436, "uuid": "162ff71a-302a-49b1-8d12-9f425edc8c64", "value": "12288:cVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1S:pfP7fWsK5z9A+WGAW+V5SB6Ct4bnbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900436, "uuid": "8ef9cf08-ab73-4a67-b446-c9b39bc6e11e", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900436, "uuid": "2ac1309f-d86b-486f-b76a-20c8b7132c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900436, "uuid": "68920ad2-1722-4acf-8024-678334af450e", "value": "7750aba76f900f7844c75baf4ba647219dff8f5fb937533714f2d0bf5be6df12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affb7c83-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900442, "uuid": "ddb331c1-a8d6-4364-8023-9ab3d4014964", "comment": "Malware payload (Dridex)", "value": "6e0b5f61e95fbd9fc03df56821d0cbd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900442, "uuid": "31554ede-fb95-4c77-b444-6986dfc2255f", "comment": "Malware payload (Dridex)", "value": "78160c3a7053714f4335c5f3773543532c78402f60e5b213a4af5740e4335485", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900442, "uuid": "95cc9562-b377-4373-ad3e-e800a114bb73", "comment": "Malware payload (Dridex)", "value": "fa206a767f74987f4b3a45ad15e5a1161af73e9a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900442, "uuid": "fe740d7c-eeb5-4a99-80ed-e08358e8a136", "comment": "Malware payload (Dridex)", "value": "b40c0afb082db279820d372c75e39f2ebfe9e62df04ae54e419979e9fc0d926402c45d1c188a084d2a7a653556efb027", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900442, "uuid": "ef808edd-c5d5-490b-9c28-8dd07b7811ee", "value": "T1D5A5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900442, "uuid": "88507384-b2e5-4f50-9f75-5c796f5d96e2", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900442, "uuid": "dba4e61f-c785-4e7c-966f-45034cc82398", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900442, "uuid": "5a8e920a-2382-465c-b166-ca6de08c6344", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900442, "uuid": "7f9beb8c-6f0d-440a-a087-3488f5d42b08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900442, "uuid": "f79a4fe0-fef0-431f-b1f9-18c77731cf35", "value": "78160c3a7053714f4335c5f3773543532c78402f60e5b213a4af5740e4335485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4537cb0f-20e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632890814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890814, "uuid": "666fb019-d840-4678-aa9d-a9e3249defe7", "comment": "Malware payload (AgentTesla)", "value": "1ee4db3775fc84fe4635712eae57df35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890814, "uuid": "0678816e-615e-4d25-a34b-06f85f7011ce", "comment": "Malware payload (AgentTesla)", "value": "782ae45c40870824f8be3ef51a5e4a673095f2b022d3e8252adc8dd4212d679c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890814, "uuid": "2818c422-ac18-44e8-b3ce-7647fd2978f1", "comment": "Malware payload (AgentTesla)", "value": "d3b57bfe532c354c1bbbf48202175249351e3070", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632890814, "uuid": "13591870-bd73-48a2-99b0-a74c405bea24", "comment": "Malware payload (AgentTesla)", "value": "3462336baeed1d9db2b7e5132ba9f5ede7d2bef2a65d8e78eb08db2c0ae9a6a4d290238058049685f1055ca618777a7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890814, "uuid": "010e7f4a-306a-4a64-94ee-a47c921a2d4c", "value": "T1F5158D1AB60CE65AFD1433F02124BCC411F81C981C6CBA17B97672EAB4B9E27DDB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890814, "uuid": "9cca1234-7e43-46cb-985a-96c94f696bb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890814, "uuid": "b5c52987-b257-4e7e-b22b-0303164b3623", "value": "24576:wD4VHfQe6ZyWshg+qbZxTZZWunAWvO3M38zRVYnemT7/eW:4+4WROnpnmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632890814, "uuid": "0b0b2ac3-2dca-4a31-b822-a8736809ca79", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632890814, "uuid": "7a61b013-690a-463a-bc49-8b1dea4987ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632890814, "uuid": "ee556c53-7ee7-4b13-8e6e-d80a517fc711", "value": "Scan001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb81f7e-20ff-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632904034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904034, "uuid": "339d4d2e-e0bb-49c7-9f53-5c77329670a5", "comment": "Malware payload (AgentTesla)", "value": "11c4ac824054b76793e17d64cc7f105b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904034, "uuid": "03ad0b40-662f-42b8-b1e5-3f154a92fc91", "comment": "Malware payload (AgentTesla)", "value": "7842f462715d7c16d7f4449439ffd9a975412b03ea77d4d8e260880b8017cc5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904034, "uuid": "2b48e213-f73c-4d6e-a273-60e61f6599d6", "comment": "Malware payload (AgentTesla)", "value": "53ceb5c4ee4733e9b3374a6e1d30a75f42cfdb0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904034, "uuid": "f120e4d3-e31f-4629-9404-150a6681afa6", "comment": "Malware payload (AgentTesla)", "value": "925d5c879c94ba666ec8fa45aecaedabb23595887f59036bfb890ca71fdb7cd8e77ad4b88119b0c91f3882a9c469ccc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904034, "uuid": "83869d57-a4b5-430c-9d48-5e7250ac4968", "value": "T1C7F49E6DF61CE29EFD0903F121257CD421E80CAD1D7CBA27BEA6B5E230AAD7551F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904034, "uuid": "b33a6686-f287-4fc3-8396-7504e100f713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904034, "uuid": "b3c0e15c-d60e-4814-8dd9-05675940b18b", "value": "12288:mD4VHfQe6ZyWshg+qbZxTZZWunAWvVBDanGebPXNB2IGsViMeKyFByTkbw/p6XAS:mD4VHfQe6ZyWshg+qbZxTZZWunAWvnaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904034, "uuid": "500382f4-664c-4553-92b9-2ac70f02f4bc", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904034, "uuid": "135d0d5f-5cc3-4cd7-b635-526d797370ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904034, "uuid": "21952605-9463-4c7e-8f0a-c9e6144cee66", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98cc826-2118-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632915142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915142, "uuid": "f28a2b09-eecc-45cd-bf04-e15bb56edf04", "comment": "Malware payload (RedLineStealer)", "value": "9b2140a3933053e386980d8ce7f2f00d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915142, "uuid": "9c0cb8d3-d389-4e8f-860e-00c36b7df7df", "comment": "Malware payload (RedLineStealer)", "value": "7851d7fd4c5478cb05083284efea41927171df454338898e3a46ab1ddc68eed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915142, "uuid": "28c2c459-c878-4045-bf6c-e73f51e51b2e", "comment": "Malware payload (RedLineStealer)", "value": "d3d7ee9cf2c39b0ad9a4749e7bf3e6f1aa5b5d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915142, "uuid": "e0357b48-0bab-4204-be20-dd803da93edb", "comment": "Malware payload (RedLineStealer)", "value": "a3282a572dcb6291796b652b6aaf07747ac050aabda367411a55b673f29784e695bb87d0eeeeb08794f876a96cade94e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915142, "uuid": "60b6a292-0b22-4487-a7ac-25ceb9c3176f", "value": "T13AC502A157DC6849F4F7863878B2CE81763B7A398730814E6526A22CCD37BD0DB78791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915142, "uuid": "d01f4993-fbc2-44b4-8385-2da2807cf5ad", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915142, "uuid": "062a4964-42ca-4f14-b60d-68fcc0dae13b", "value": "49152:lNKEZ2RMAw6pF/xwyygspEKXLxUy9A47rqtz0GwTtNirtAwhRJ9zUtBf:ljIFj/xV8pEe9A47rqtY7TjUAIzUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915142, "uuid": "19d0d5c9-d44b-473b-9107-a264e6a88ed0", "value": 2680832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915142, "uuid": "c7cedf18-10fa-4fc7-8190-989544a93c2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915142, "uuid": "389f89ad-853e-4293-bdbd-3c83a3d36ab0", "value": "9b2140a3933053e386980d8ce7f2f00d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54f0611-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632903055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903055, "uuid": "6938027c-1f4c-4de3-9a6b-730897a38810", "comment": "Malware payload (Tinba)", "value": "76a1f399d6b42f74d23e8cbcccf7903c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903055, "uuid": "3410f3de-d059-47c4-a0ba-2d980285c9b1", "comment": "Malware payload (Tinba)", "value": "7886b105671b8c911bf6a1a97ae8aa9b2794d03f7a7c50127a8e1324d368ecdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903055, "uuid": "84369f0f-c260-4a8d-9551-d3465932387d", "comment": "Malware payload (Tinba)", "value": "b38fed8473b16797000fe307c0ebda5c73149a0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903055, "uuid": "215a199e-20c2-4f36-a2e9-a887b85287b3", "comment": "Malware payload (Tinba)", "value": "45839949302e65b897c1eef675cad6239acc06e3d176fd927a76245998e9f27c4115cc4836f6df07ee9c0d8aa5bbae7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903055, "uuid": "7a7c7dbf-8c28-4530-baec-f0cdd5e4e0e9", "value": "T12133192093A6E00BF4B36AF41E7985524E777D34A835865A73CC8F9D66B3DC1C921B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903055, "uuid": "579bc622-a6fb-4b35-9781-b746c6f5169c", "value": "e0f61286c6396ccf28fed994d6a49819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903055, "uuid": "76221318-0ab0-4841-b90c-96851725a124", "value": "768:dCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9Jw:Fbw/6plBTFBYNNR9Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903055, "uuid": "6d099c9e-63d8-4f71-901b-52f18af45696", "value": 50180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903055, "uuid": "b6ffb9ed-ba14-4b1e-a074-80d7f92e3a25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903055, "uuid": "e7c85e1e-ae1c-4ec1-9046-8cc7e8a0afe3", "value": "7886b105671b8c911bf6a1a97ae8aa9b2794d03f7a7c50127a8e1324d368ecdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47835ec6-214d-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1632937633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937633, "uuid": "f018051e-1e1c-46ad-b36c-809dfa3b3543", "comment": "Malware payload (TrickBot)", "value": "4ae6aa84d6fd250e514f1ecdc8084757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937633, "uuid": "f2d58b10-a161-4b20-8e10-b92b96a93d28", "comment": "Malware payload (TrickBot)", "value": "7905c507eb3eec76cae44b13de78a70dc045eda20f2bbfb2f83f9ce50b0a9ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937633, "uuid": "1030fc38-e745-418f-93f7-bf3371a27b48", "comment": "Malware payload (TrickBot)", "value": "a0de096b7693c4e66a993b1f41f574172aaa0f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937633, "uuid": "2682230d-9bea-4a26-b1e6-32f71007fce6", "comment": "Malware payload (TrickBot)", "value": "c19c970baa0e64d35a309c84d148020e912e7c98b9404c569439db37bf593ae4321ac146c759535c0965ddbe505fc985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937633, "uuid": "53bf80c9-738f-41d0-9bc5-4330d3484634", "value": "T11FB4E0213181C031E5A310758EFAE7BA9E6EBD30175164DB7BD43A2F4F25AD1BA3424E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937633, "uuid": "4c505294-5e4b-47da-b677-1c155b53deb7", "value": "edc289e000b8972f5dc69ab59ef219f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937633, "uuid": "7255e66e-2c84-4485-8c42-92042d8d0e0c", "value": "6144:V6ZlxMlN8qVY0rlGdW5boVMd3AqEiAqqhYOtRF5498DF06YjnU9ZEF:k94vY0rMd4boQAqPGRRFK9e06BHEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632937633, "uuid": "9f8ef2cd-68d5-4f09-b639-b1015e2e4e67", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632937633, "uuid": "83faa9fc-fb8f-4d0d-b14c-05a87ea304df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937633, "uuid": "02773533-e58d-4d45-8ee2-a03bbb385384", "value": "4ae6aa84d6fd250e514f1ecdc8084757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee65e81-2177-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632955980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955980, "uuid": "53986df8-9093-4ca4-98d2-01d603ddc00b", "comment": "Malware payload (Mirai)", "value": "357d1cbe13f395fc89a871e1c6147405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955980, "uuid": "2abaf2bf-8ec7-481f-8596-a23db25adf2a", "comment": "Malware payload (Mirai)", "value": "79129fe3ed1dc0c3e7791a9630db2b69bfad2a7edf2c4128163588dc237d234f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955980, "uuid": "385b8325-8913-4eef-b064-2200f676a4cd", "comment": "Malware payload (Mirai)", "value": "990dfe9872854247f0a3e6e95e1d60245530f780", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955980, "uuid": "dec31965-f387-4cdb-8ad0-0b9eab90a989", "comment": "Malware payload (Mirai)", "value": "8bb59a87885bea4b8d2e4b81388b4f4a8d35d19b5982fc61c4312a61ffc1df6ad9294c075c5bbb18dbd1d7d211857903", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955980, "uuid": "3c74648e-6f09-4d1d-88ed-dcf358c3d894", "value": "T181231796B801DD3CF91BE6BE8427080DFA60735141930B3763B7FD93AD721A86E26D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955980, "uuid": "938f6723-d872-499f-a4df-c1d8caf0f728", "value": "768:Di+eRsWpPJMehVZT9seLgXa3q3jLYDeDYXFrvY5u38Wh5xCzqqnt9lS6u5Nuk:DjSuEqUnrY438WhOzqqDlS6ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632955980, "uuid": "3efcdd1d-25cf-4b2d-8dc3-0cfc6a473eef", "value": 48044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632955980, "uuid": "f303ed7a-90c6-4769-9418-57ddae914640", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955980, "uuid": "d24bc3ab-5392-43b5-9c3a-c65aab284b83", "value": "357d1cbe13f395fc89a871e1c6147405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f821b37-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Matiex)", "timestamp": 1632896469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896469, "uuid": "518a1673-4d51-492d-a987-fce2aca2c1fa", "comment": "Malware payload (Matiex)", "value": "ec30bc66cef63f29080c284fe9f66583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896469, "uuid": "a63d788f-3814-4580-8c08-c68b13a1ec25", "comment": "Malware payload (Matiex)", "value": "793d3532c805e1e2406fa8d9da0c2dc23dae090a2b7c52ba322abbd864e627a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896469, "uuid": "df46592e-009b-4bbd-b443-b8cfe134c07b", "comment": "Malware payload (Matiex)", "value": "8387b00478606de6cfdd1484fe72dae09c1b4758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896469, "uuid": "cd1bc5e2-056b-4d0c-84dc-081137f3006c", "comment": "Malware payload (Matiex)", "value": "c121c973ba475468f3877b62c7b14309f57a24a1b272ed4d1659a7c4c229309c9daf5b6b8de0df8e7900cbc61870c7dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896469, "uuid": "3b8220d8-a57f-4d0c-8c82-24e0271695f1", "value": "T16574129B7FD1C8A3CB41967414B7873AFAB9A07C80102FC39B661F5A39596CF5C2E046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896469, "uuid": "7e920168-a970-4566-8065-0580249dfa11", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896469, "uuid": "c0a9b74f-8485-48e9-8446-c8548878014d", "value": "6144:b8LxBBXsxzzxq3YgkqzS7M3TJcEghkLd199Tx5KN/Dv+JffuK1IDBgdugw:ysRzxq3wqzSmTJ9L5KNCfWK1cBxgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896469, "uuid": "23cbedb7-f04b-4bd7-91be-37fe2a8775c9", "value": 351145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896469, "uuid": "8f9519c0-f7db-4b8a-8d71-d5a954857967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896469, "uuid": "7e07921f-3889-46ab-afc9-360091b90740", "value": "NK974589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e682853-2177-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632955711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955711, "uuid": "39492890-eea9-4991-a48c-2eb6f22fb957", "comment": "Malware payload (Mirai)", "value": "f5c9dd0dea2f47d6b4a757d2ae974c7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955711, "uuid": "2cbab608-866b-489a-9784-4893ad014aa8", "comment": "Malware payload (Mirai)", "value": "799ff5fb48f7ae14b52e8acfbd55a47ebf46ec8413ef5242aab45f3b58015322", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955711, "uuid": "18e13500-a2c4-4311-b8d1-6d40b15a236f", "comment": "Malware payload (Mirai)", "value": "f2dd1b9395cd325b32e20d3b3277a822b1ba091a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955711, "uuid": "cf41c02c-5b2e-48ff-a405-6d034a21c285", "comment": "Malware payload (Mirai)", "value": "34420172b877775b150ca897da805317c21ab1ed6f821d562937061d46354f0b857cd6de26a2ef8b598fad95edbe7e1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955711, "uuid": "86feaf64-9693-4405-9db9-8022ff1ff8a6", "value": "T1F9132AC49983ECF5DD1506B531B7EF728676F47B2159EAC3C398D432EC42A02A60B28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955711, "uuid": "ff5952d1-c194-406f-837c-6edf9f897b89", "value": "768:ztlsnYOMd4C2U0spoobSc7oHTbdxrETeRSDYk8fihIfWGLcxQr/Cuws9b:ztlsnYOMdx2U03O7ofkcGlefWGLwQr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632955711, "uuid": "4ba72d96-785a-4f03-b830-d081a1c5376b", "value": 41936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632955711, "uuid": "4ae083f7-5a21-4aed-a369-29e14ec2a0b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955711, "uuid": "a3aafdb5-4117-47b0-a2f6-0db6369b44fb", "value": "f5c9dd0dea2f47d6b4a757d2ae974c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ad9dc0-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632909171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909171, "uuid": "14cca7cc-2d7c-4974-b8f0-8ecb81cc1e32", "comment": "Malware payload (Smoke Loader)", "value": "d039016102cca238b8c2afcf7cb1f250", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909171, "uuid": "bd7b2992-97d3-45c6-93a9-15aa643e1074", "comment": "Malware payload (Smoke Loader)", "value": "79dc17855e41c95a144280cff99422932721209dd97cd28dcd985746e339397c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909171, "uuid": "833174e3-75b0-477e-a7a6-020d92aa75a5", "comment": "Malware payload (Smoke Loader)", "value": "4deee6a671c6d769c43a1a2230165e9ae754622d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909171, "uuid": "e49fd251-d658-45e1-ac4d-17fc3e82527b", "comment": "Malware payload (Smoke Loader)", "value": "f50725a42837643c5a9cd25440623765735fb3d61883d69c8c652aea2910066d60fa8c532dc52cfe2853d35b215f0171", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909171, "uuid": "ba101379-0ae6-4546-befa-f47842845631", "value": "T11D04BE00B590D2F1C715013FA825CAECE53EB96DEFE056372AE866DFAE382A37511351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909171, "uuid": "91a374ef-9f42-4376-ab52-97db20ac3c19", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909171, "uuid": "4152c82b-9a9e-42af-b9af-d6bd7bf2af1f", "value": "3072:V6KmRLZojmARNwK5ircPI1Zeifub78EuSzsz:VRUgROdcPI1TW9uSz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909171, "uuid": "54f095b9-1526-485e-95ef-f2a937d6a575", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909171, "uuid": "9ba4300d-a34d-4675-9330-24c55dcd8288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909171, "uuid": "0b88d1b2-1e33-4016-af0a-4ea9a98b32df", "value": "d039016102cca238b8c2afcf7cb1f250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7004b30-211d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632917178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917178, "uuid": "ecbae014-98ae-4528-aec3-7baa791af482", "comment": "Malware payload (Formbook)", "value": "618b0274c6ca8e3acb3412393e7bd522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917178, "uuid": "91bbfde4-5d11-42bb-9c48-29365d68aae4", "comment": "Malware payload (Formbook)", "value": "7a2dd77dd781503f0d6737259261fea859c67708f985661c779b1df5f7e49e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917178, "uuid": "9a84e057-e79e-4f3f-82a5-da4cb40bd51c", "comment": "Malware payload (Formbook)", "value": "1e6c699567bcb6d4a9ce7d12e12376fc1764a0a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917178, "uuid": "0e975b71-9444-4e2b-81b6-f6e33d386a23", "comment": "Malware payload (Formbook)", "value": "3758b178e7f3de8519d41ac30c3c1451d6480f4e6faf891e754309106cc863ba9f2d412d6f6e288d2e12ce67548c0fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917178, "uuid": "31e55a9c-91ae-413e-940d-cb2c3d34369f", "value": "T1D7053A61F3E0CCF2D36626758C27229121153F756A5CA84E69F93D7A3E7A180303BD6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917178, "uuid": "24f003bf-c322-420a-902e-1f764a3d4d28", "value": "f0c25cd198950ba1bc931e9bf4f4e5f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917178, "uuid": "0620756c-6f22-4aae-8cb3-f0cab7911f64", "value": "12288:02DA+ebuMqQ/5KIXmdLwWZsSOarJsU0QLS7TnUEV/XNkYEQPC:C7FJ/5KIXmNwWZsUraU0QqfN7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632917178, "uuid": "cdd810ba-37ad-4882-8979-93c43c86c878", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632917178, "uuid": "0e6a49e6-4cc1-48b5-9b5e-9495a5decb86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917178, "uuid": "09e98af5-66d1-4f41-afcf-ec8bbf924289", "value": "Original Scan_Doc Ref 28538013241899233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c229dba7-20ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632883293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883293, "uuid": "7a595a07-eea0-4224-ae4e-25b8496869e6", "comment": "Malware payload (Mirai)", "value": "36340811706592d5bd04b9d1cd822f33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883293, "uuid": "59aaa660-37e0-40e9-8443-9933fce98188", "comment": "Malware payload (Mirai)", "value": "7a6bb8a8a799dec10218dbdd2f3b48dedb74e9df8095cde4a6acbf86584329b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883293, "uuid": "11edf304-ef73-4854-bf54-093f4eca4242", "comment": "Malware payload (Mirai)", "value": "5dcef55461e4319525cc3872a0c40f19200e0178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632883293, "uuid": "65331b26-9a96-46d9-8e40-9c2d69aed6b0", "comment": "Malware payload (Mirai)", "value": "05a1b22992aaaea91425fb8e46916fef9ba7899dfdf6398b4beb8bc65428b946d1833fbbef8987273654f23d9f83f70a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883293, "uuid": "81a70a65-5f0a-4cb3-ad8d-ee2d1b510828", "value": "T16A23F128975505DDCBA4E2B24AFC17513D668F305182EE417B55E0CBBA864BA0C8BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883293, "uuid": "dcf32885-c832-40d2-8f16-2a707550d89a", "value": "768:yXLL88BFQrRKLzQMO1GI8ZaXFSCc7XhNningbRqBo40n+1V4/q4kzgqjxv1xyXJx:y7RFyELVkGIP1S3zhNninkRqBo46XTTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632883293, "uuid": "02a90c4b-a6db-4300-a32c-22bdf11ef575", "value": 46144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632883293, "uuid": "4e345c38-2023-4f6e-be23-bad4c842771a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632883293, "uuid": "a1223afc-4104-4fdb-985f-d1282971fd95", "value": "36340811706592d5bd04b9d1cd822f33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c719dd8a-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632898763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898763, "uuid": "a26eae33-1bb6-4bd3-a066-8c982a2418d0", "comment": "Malware payload (RaccoonStealer)", "value": "76533e90291414a8f90b8cba0b4dfdf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898763, "uuid": "886a84fc-c491-489f-b102-3c833ccd77a0", "comment": "Malware payload (RaccoonStealer)", "value": "7a8914a4f02248cbef70ae06057bd9cc96ae09385c2c23824775161c9adf948f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898763, "uuid": "6b7ddd07-7804-41ee-b3db-e9bb500ba2c1", "comment": "Malware payload (RaccoonStealer)", "value": "ab25d1402e77e23545461c85030cabd08ebe6226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898763, "uuid": "abb5e02a-7152-42f1-9b22-38b19b16fb65", "comment": "Malware payload (RaccoonStealer)", "value": "fe8675e6061d8f5db1b87c6c8cced7d18e97c1e63e3ba736e89c09fc22dd23231dd62243affe3e53d5f1be88c728941f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898763, "uuid": "2dd7d799-fca9-401c-a208-788a8ae0653e", "value": "T179B4E010A7D0C035F4BB16B649B5D3F9A53E7DB12B2491CB62D91AEA5B346E0EC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898763, "uuid": "3eb7af12-8077-4775-b97a-d011ce7d413a", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898763, "uuid": "a91df2a2-b1f9-4674-a1fe-847be8a36fa0", "value": "12288:hi/+kQfT5EIiyWxeDpLzKa010ZhzsF/XPLZ24Yb:hW+kI5jaeDBzKF0Zhz0/DZ2Tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898763, "uuid": "a6695127-e1a7-40a0-aa3f-d09c279cf2c7", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898763, "uuid": "226d0a9f-8aca-4198-b428-c0b1898eb54c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898763, "uuid": "c78558de-b422-4eb0-bf33-3e6939821a8b", "value": "76533e90291414a8f90b8cba0b4dfdf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94bd41b-20b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632873910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873910, "uuid": "111c36e4-1a60-419b-a635-989c685dfffc", "comment": "Malware payload (Mirai)", "value": "a5c31ec16e8a76ed2ed4763e278fea3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873910, "uuid": "8cdbaf7e-42c5-4441-94ce-3c7b1cf63dec", "comment": "Malware payload (Mirai)", "value": "7a8e2eb31e0603bad4754cff6a96f30b14579316496e31cffd9e8ae02456ede2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873910, "uuid": "5c72661d-9de0-4b38-82c1-f6d98b44381a", "comment": "Malware payload (Mirai)", "value": "de10106cfbfa68a3860fab10cf2ab9e6f2d73ca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873910, "uuid": "0f9c89fe-6370-4f24-9f75-cb199375307c", "comment": "Malware payload (Mirai)", "value": "339d423da48cae6f8f9cc336ee60a58c6f826cd5a4203b7e33cb56e429c227ae770ec0c1f33f72d54d27baa163ec0132", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873910, "uuid": "a2a7ef4f-0e58-4717-954b-1b2c0186b83f", "value": "T17B23F19BC24465B0DE509CBDAF9B87783C9D42FDB93A320326D149C457CA8B35AE2582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873910, "uuid": "bfa27adf-87cb-46d4-8257-0104353e61b7", "value": "768:G4Ko8N8VXGN07MdnoAdz/BFrZQKAAKJsDjdDIoZLCnRZX9YQB9q3UEL7z:GWvWSYogF93xpl8oZLCRuLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632873910, "uuid": "74deb9d4-5f64-4f5b-bab6-6babb57e4650", "value": 48388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632873910, "uuid": "4009ba97-8781-49f0-8ca2-5981bb64eb23", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873910, "uuid": "55ce4f9c-d653-4d94-a7ed-1e2d84eb393f", "value": "a5c31ec16e8a76ed2ed4763e278fea3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d546da-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901437, "uuid": "3a83610d-10f2-425e-adcc-cb3e946f14b6", "comment": "Malware payload (Dridex)", "value": "dcea9285e6da163d5a3409cb8b1abfa1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901437, "uuid": "14080a24-9fdb-4502-9bf9-4c33febf4936", "comment": "Malware payload (Dridex)", "value": "7a8f958118a130fa685f946a4331f963976db7690786eb5e4bdb450095d715b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901437, "uuid": "cf530911-ade7-451c-bc9d-8478e9f53bcc", "comment": "Malware payload (Dridex)", "value": "3fe6a43ab9e3c8d9ec0299dbf45548539fea6c7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901437, "uuid": "a029226c-7374-4630-a942-396942fed7e6", "comment": "Malware payload (Dridex)", "value": "112845844d65bc4983e8406872af357ebd3f863a6b17a9952893ece75769d218d24d8fe3358d2fffc45527dd54bfb62b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901437, "uuid": "f5054507-8875-49ea-b8e0-d248c308f813", "value": "T1FA35E054B677A1CAC4A76CF6EDF86D706A522CC3623047A1CE02D1871B751E4CDF2A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901437, "uuid": "1a560ef1-3fe1-4b1d-82f8-888217fd99b0", "value": "c6b4c2eec8a93016c63563421e15f011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901437, "uuid": "5607e4b6-bbbe-4625-a1ba-4b77302085b4", "value": "12288:xdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:fMIJxSDX3bqjhcfHk7MzH6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901437, "uuid": "f2612d26-af88-4b39-bb4e-506ed18a1d3d", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901437, "uuid": "22238ae4-9ae7-4401-b1bc-88b2d979720e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901437, "uuid": "c9f7b8a4-c88d-4a2f-8ddf-453389350526", "value": "7a8f958118a130fa685f946a4331f963976db7690786eb5e4bdb450095d715b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5e5a27-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901084, "uuid": "d1b7ae90-d8ae-46c9-b73e-bd2a38decc53", "comment": "Malware payload (Dridex)", "value": "03122b173e94bebb324466badda9a276", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901084, "uuid": "b2a1751c-a31f-488f-9ba6-e838726d7e3b", "comment": "Malware payload (Dridex)", "value": "7a9dfcb406978376dac20b78c1682f64b8adf1c917cb99195a638dc5a522c680", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901084, "uuid": "51ed9903-b3e7-485e-b4bf-fb9ea5564fca", "comment": "Malware payload (Dridex)", "value": "9e467007b08a1037696cf09928de22690e24e2e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901084, "uuid": "3d2ee861-8b8c-40f0-841c-442f6b09a4e1", "comment": "Malware payload (Dridex)", "value": "929bfe89951e9415ae8e2733b62f5cebff55193597044b0782f4b04e908ba6d26f83c471ed5e57f8e31ac60c9260bc52", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901084, "uuid": "76bee108-014a-41db-a3ce-2a5ed26121d4", "value": "T19C95D010EE69E1E6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901084, "uuid": "e0dffd6c-1ddb-4ed0-8a3f-7fcb52bbbb01", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901084, "uuid": "74c90679-bca9-4508-b25c-78c733305f31", "value": "12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901084, "uuid": "171686af-9301-441e-8e23-da45bf8a16af", "value": 1892352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901084, "uuid": "78505ec8-f09f-4231-893f-516042bad943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901084, "uuid": "5e7962f8-5956-43c7-9d77-4c6b5ce9f49f", "value": "7a9dfcb406978376dac20b78c1682f64b8adf1c917cb99195a638dc5a522c680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658ab9dd-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901176, "uuid": "3b460cf1-4533-43f9-a25d-58ff339e40ae", "comment": "Malware payload (Dridex)", "value": "c022fa8ae51a875e76ff878b0e5c19ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901176, "uuid": "2b7219b3-f57c-4b2e-b519-9732932239a6", "comment": "Malware payload (Dridex)", "value": "7b1d7e979ea75d2e1b39b3618e1cc784ebba753e406fe343d227aef056d4eece", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901176, "uuid": "5458d201-de4a-4cf1-9cb8-162bed348976", "comment": "Malware payload (Dridex)", "value": "986d5f6f5970c1482ca42b80e43c1727427a875c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901176, "uuid": "54ca857d-688e-4ffd-bd62-716552ca35aa", "comment": "Malware payload (Dridex)", "value": "8017642ba0ed303913bb8b9a020af72d9dae7ca5dc59f11d80b9bf60f1c683016d134a9292f425029fea4a022f5d2c53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901176, "uuid": "c5c7550e-f680-4741-bfb1-5b3566b2e19c", "value": "T142856A10FFF305C7C09DF739788D3415A2B3AA65811F8A1D824E131E6CE5B912E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901176, "uuid": "e20f4fa2-db1e-43f0-a7f4-3e7d489e13c1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901176, "uuid": "3a78e50a-883d-416e-ba2f-fdf57cb64e92", "value": "12288:OVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1xAo6h2:TfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901176, "uuid": "722d802c-bc7b-4df8-8133-05b44aec893c", "value": 1777664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901176, "uuid": "9c9875f2-b5e6-433a-8a2d-2d1a635990c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901176, "uuid": "7b515217-0da7-46e5-b6d4-a88b85e0fc4e", "value": "7b1d7e979ea75d2e1b39b3618e1cc784ebba753e406fe343d227aef056d4eece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f9acd6-2134-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632926808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926808, "uuid": "0430e02a-5f0d-4f33-91d5-462faa33b902", "comment": "Malware payload (RaccoonStealer)", "value": "cb566599a0870dbfc044de928ef03d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926808, "uuid": "f4362417-20b9-41b3-80b4-a6bc594217fe", "comment": "Malware payload (RaccoonStealer)", "value": "7b4950be4d148582cc679bf06706c1828aaeda0ee0f62005d6bbb78441326517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926808, "uuid": "ad826b3a-0735-41de-9a73-86379fc75aba", "comment": "Malware payload (RaccoonStealer)", "value": "941621766be5a943b27c246928cf93aa2f7fb765", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926808, "uuid": "dea33c85-ca41-408d-b73c-c473d4d68a3d", "comment": "Malware payload (RaccoonStealer)", "value": "1dc61b389d92e99c51bff48235f11e87c35ce72694a18c0eb202a13b669be7046371cb46e1380a133f7184d844b8e358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926808, "uuid": "8d52baf5-b64a-437d-b0dc-2f19d6f47c87", "value": "T1FD346D94B3845AF2CA28BF71267BA9B027B33CFDDD707915684CB62E4DBA3314412D85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926808, "uuid": "7dfceaf5-6e14-4099-90e5-0b40fbd5ced1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926808, "uuid": "2a0e6973-9f50-432c-b656-287d4554b11f", "value": "3072:2x52usA3aWOca22mwBBBBBBBBBwuBBBBBBBBBy4AMYajBJV3z+PZ4sZJ06GtzXj1:2KusA3aWOcX7Q/+hGZz4tXNp78d+kBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632926808, "uuid": "d6c9b9e7-ff8a-41b8-a838-09dfa566e3f2", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632926808, "uuid": "70424d7f-ed18-478b-ab31-ef61ec2b3e25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926808, "uuid": "35e08fba-6bad-44b2-8e13-fe5e79ec3dc9", "value": "USPS Delivery Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74adf3dd-20cb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632881874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632881874, "uuid": "eea11619-a7b7-4e26-b81a-94aa6e94258f", "comment": "Malware payload (Formbook)", "value": "9d27e60dc877f280ec4bc6b4c320741f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632881874, "uuid": "48907ed9-40c9-4ab4-a55a-4b07f0563a79", "comment": "Malware payload (Formbook)", "value": "7b858664b4283d8d0be155dc6bbe9f279e066b6cf2dd985eef95698e77333900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632881874, "uuid": "7f911d47-ce4d-4a0c-87c3-c211e930f825", "comment": "Malware payload (Formbook)", "value": "2e6290d850de69c57a1a73bae251d550e5223e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632881874, "uuid": "e957f9fd-13f7-498b-b536-f8f593f86680", "comment": "Malware payload (Formbook)", "value": "6ae366d70e2ff5c3d291793b43f94648c20041bebaa51ea75fa6f0b82636cfdbc038efce1d92b384ee365749a0beb6ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632881874, "uuid": "f3d0e43b-8f29-49a3-a560-74e3c8f05205", "value": "T156F4E0237B5DEC26C22832FC9990D5C90176AE806C45DB46B8703BADEAF4B57DC1E14E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632881874, "uuid": "9e6a9266-0e9c-4140-81b4-a8e40ac7dab7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632881874, "uuid": "be5be5d1-2c01-4d51-a5ac-f80882ef950c", "value": "12288:4Xz3M39OxpK6NLmqj8TEoJkf85+3gStafsWV9r56tJuxYrO:c3M398pqqI4Okk0QSMfsWvInux4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632881874, "uuid": "6bded624-849c-4fd5-aea1-4805260c0aca", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632881874, "uuid": "a86d84dd-6859-4075-921e-8d3fdc089e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632881874, "uuid": "c23574dd-b260-4946-9017-7d08ff794eef", "value": "BhVQ8rqxTUy5ijy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b84e7af-20ee-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632896784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896784, "uuid": "5b090077-0bda-4964-abc4-a7a3a26c3bc2", "comment": "Malware payload (RedLineStealer)", "value": "88c6e102bb28e16dae95e859b01377e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896784, "uuid": "5b5a7340-5663-4514-830f-7e55e85c5a66", "comment": "Malware payload (RedLineStealer)", "value": "7be91219c070a7fc70784daa8e7de2af75fdfb23719fa277d8135e7c2aa3872b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896784, "uuid": "e9db8473-3569-4c5b-8901-882794ff10d2", "comment": "Malware payload (RedLineStealer)", "value": "f2bb479138ab51ddc9889f5d6f035ac4d983318f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896784, "uuid": "f8ef71d5-cba2-4d37-8c3d-ee3a9b00ce57", "comment": "Malware payload (RedLineStealer)", "value": "831257302ac7894e31c6b79fdf8f0044429159af408bc7a4e1695222e76a3560814075335c95394da235ebf1907a87b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896784, "uuid": "1aa6b4da-9288-4d8b-8744-726a046f1536", "value": "T1D004AE00F190D3B1C717027FA815CAECD52EB95CFFE166372A6A25DFAA382A37511352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896784, "uuid": "5c97715a-bb56-4da4-9baf-57085c3e55e7", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896784, "uuid": "c3cb2e9d-1088-4866-9614-a6c05394f27e", "value": "3072:C6KmQqn0+RFX9M1i2dK5rrcPI1ZeYF9+A8EuSzsz:CR3qn0+G1ZScPI1BtuSz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896784, "uuid": "134d8ca2-c433-4a19-b457-860403c0c259", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896784, "uuid": "53a50bbd-aa1e-4170-bc1e-f1fd88564218", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896784, "uuid": "a4301f15-b5f5-403e-ac62-58c040a53f55", "value": "88c6e102bb28e16dae95e859b01377e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378a22ab-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "ab9db784-6898-49d6-a326-dfe00a7d2bf1", "comment": "Malware payload", "value": "deaa4fefe4c00a5cfc2a239aee78a042", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "a1515508-79bf-4652-9460-79ab0dad6f6c", "comment": "Malware payload", "value": "7cc1ececc6f7efa690d6c9d7ff36ef46d4fc452f39d134bcdf250ef8d0422f25", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "03819a9b-cec2-4240-bf17-3674860d8ecf", "comment": "Malware payload", "value": "f5a319442eda903dab49311954b9b19bfdd2c23d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "bd3bd3d4-7649-4200-be1f-42106b297d7b", "comment": "Malware payload", "value": "9a5e114d661f39632d85ba1de70e173a3cf8ed0755638eb79062d9e9ad3afbd7bf9faef95307ac33f1b7cc964fd4f32d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "4d359307-e305-40c9-8772-ca561142e3ed", "value": "T1B7A32B44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "bdb48081-7483-47e6-8c56-567eaf4b2c35", "value": "3072:VSx+i6mqaObhN0nPhVtIAmZuqQ4DPwXXtse:y6mRObn0nPCAmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949203, "uuid": "b567df95-fd92-4198-a592-ce3ba0adbe21", "value": 100877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949203, "uuid": "c037de30-d9b8-48ec-afc9-e75eb2eb7e85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "9d2347ed-56fb-4bcd-a074-4d1ed3381e2d", "value": "qtmzbn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab7dd92-2139-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632929237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929237, "uuid": "96a29bf6-6f1c-496f-8889-6ef628ff99c1", "comment": "Malware payload (RaccoonStealer)", "value": "51b9d08daf4f9445b28d9a8f89e58b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929237, "uuid": "6fb47748-a413-4496-a693-ac23d9e06a09", "comment": "Malware payload (RaccoonStealer)", "value": "7d3996b847281d300c06ea9b2cb76306ed14a73ea430e55e184c8c7f54620904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929237, "uuid": "c20ce77a-d763-4ffb-8e01-6add6d1e3233", "comment": "Malware payload (RaccoonStealer)", "value": "ac66441e3aa62c95c5fa0a0d9a4eba0a59a247eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929237, "uuid": "980201fa-5292-4976-976a-92b7038ff86d", "comment": "Malware payload (RaccoonStealer)", "value": "d60764c7db49bf8be641516b51338fe1481ea332f075e52ca3e4ed7ef84a7d1f3b83b98fa4f86e54e82d1925058a409e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929237, "uuid": "6a004b76-1f89-4073-b3c1-515ca6599c0f", "value": "T198E24B2173805BA7D7AD9B3A45A3841013F993032632CB6EFFD476D62AE27810B11F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929237, "uuid": "0835f905-fab4-41ee-99c4-1189a8f00739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929237, "uuid": "e25ac316-54c4-4d75-96cf-2085438e8327", "value": "384:jTVT+D/wCDb6j6fz3HOl5uyeTXfakPsqoAJgVndJN9vN1gWhNjoseADCcK9hf+bW:HVT+U0bIqHO/u/TvGTAJWZU1AlKPWlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929237, "uuid": "38a37558-05a1-40d3-8892-8f488ca585c6", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929237, "uuid": "a53f9cfe-8d51-4066-87d6-03717e798590", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929237, "uuid": "2367b0c1-828d-4907-90a0-4572b1a54cd7", "value": "Delivery Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e9ab8a-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632919560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919560, "uuid": "7c472cb1-1364-4fec-a1f2-3dabbe857ec0", "comment": "Malware payload (AveMariaRAT)", "value": "d2d53faf48212de94cafb44a164835a5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919560, "uuid": "1d68445b-e62c-4852-9543-a2ce871d1c9e", "comment": "Malware payload (AveMariaRAT)", "value": "7d7a575bb431ad0470256446b95419e75cad6c6c2c03622736600e25e1178fee", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919560, "uuid": "7af71e81-968d-4c52-86a1-88b05b9ef1d6", "comment": "Malware payload (AveMariaRAT)", "value": "861b01d099c80c1008a4592554f37f784811593b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919560, "uuid": "59aca2c8-f850-4983-b9ce-121ab084850b", "comment": "Malware payload (AveMariaRAT)", "value": "a276d66ba4618f9cc8e08d90268b3dcdb14e8ad031853f11081b27c80ada26f233667c94d73ba305009400b80000cd62", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919560, "uuid": "7d191b4b-a476-4107-be82-032fd2f0b510", "value": "T10AD46C6DF61CE29EFC0903B022297CD415E81CAD197CFA27BE96B5E230AED7551F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919560, "uuid": "6e8f29b6-9b56-4c84-a99b-7abb81bb7761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919560, "uuid": "827fbeed-5a24-4f26-ae31-9bbcc5e2ebca", "value": "12288:RD4VHfQe6ZyWshg+qbZxTZZWunAWvX2p8GYqGT8rYeDi/O74KjlS6p70c:RD4VHfQe6ZyWshg+qbZxTZZWunAWvX2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919560, "uuid": "76f60b08-762c-40c2-ae47-6c3f99608eb9", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919560, "uuid": "bcc758cc-6a64-4a78-966e-253ab18d45b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919560, "uuid": "4b60d022-aa47-4f04-aeaa-14e8cfc6f9b2", "value": "Quotation-29-09-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccca82f-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902880, "uuid": "c2c0ef7a-4699-4465-8969-40276fc257c7", "comment": "Malware payload", "value": "70b87d085c8cf65d6d278a03d666a3f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902880, "uuid": "4c338e9a-86c8-4868-9a72-d6cadb09cde9", "comment": "Malware payload", "value": "7dab4c40d9db3299f4ef5059679514a58d200faaf1913bde2b113a214b669b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902880, "uuid": "047025ea-e1f0-443e-b3ff-212887078232", "comment": "Malware payload", "value": "f5f06f8c1448098d168466f06f6058474a6e8532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902880, "uuid": "03b98924-5ea5-4724-a3f1-c5b9e0ca90aa", "comment": "Malware payload", "value": "3e7d93f9b8d90cf3808f2dcb135b94675dfdef6c514f0cd331b9f079022e0238654179e72a4fd307b626a42ba78cacef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902880, "uuid": "0957e78a-13b1-4ae6-b588-ab57438bf01c", "value": "T1F373CF25BF521D48E7F80B3369EC51DA06BFBB89993046CE296E9AD80F37BC056D0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902880, "uuid": "1eef30d6-395e-4888-b35e-c8dc40e61727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902880, "uuid": "d08a8360-b47e-4c70-8553-f5821ee3dbe7", "value": "1536:hosHY6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qth9/Z1GJ:msHYI3ZAtWDDILJLovbicqOq3o+nh9/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902880, "uuid": "abeda5e6-f0c8-4713-aa13-955f27af64b0", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902880, "uuid": "ae64f8f6-1bc1-41c8-a957-8981aa66b933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902880, "uuid": "8da5a18e-909a-4bdd-b3aa-a434dbc06d08", "value": "7dab4c40d9db3299f4ef5059679514a58d200faaf1913bde2b113a214b669b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58592090-2150-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632938950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938950, "uuid": "c99e56d1-ce28-4451-a2ac-811a42408766", "comment": "Malware payload (Mirai)", "value": "cf7d98339b84b31f61d4abbe17cf3116", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938950, "uuid": "9ef63204-aeac-456b-b893-ce6e17791d59", "comment": "Malware payload (Mirai)", "value": "7e160929f95b8d415352acab132f3dafae52d74cfffd6f93674f4bddbc6b3978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938950, "uuid": "416f3a5e-8d3c-417c-aa7f-a568ad72ce3f", "comment": "Malware payload (Mirai)", "value": "3e9c6d1efd815abd90ed50152caffade7df195e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938950, "uuid": "e895af53-2963-4b2f-8cea-83a0c1d40e0a", "comment": "Malware payload (Mirai)", "value": "381218aaa93af671cc68c3e40e242d089ae4a3079166c750b17fb63bdd4cca4e00642551df4a25a54ee72f529b3f22d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938950, "uuid": "a3f50684-ece0-47d8-a1e4-892088452f38", "value": "T12D2302AAC5292570EFFA2CBAEE1F9C40BB4F97F410B97387750D49907290CA154F0953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938950, "uuid": "de8dd5ba-8d71-4f18-b426-a3a1c43b8ea2", "value": "768:f4Ko8N8VXGN07Mdn0FPJ0ylDsm1e9wpt8RbQ7SA8PUwXmez6BXexDW+vkioEMXST:fWvWSY0RGSD49wpyRbQ7HEFWemMFZLoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632938950, "uuid": "3f2cdf2b-4a22-41cd-b6f6-b2fe0a4e2289", "value": 48396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632938950, "uuid": "79e39d05-066e-4a98-a101-db994cd9f51e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938950, "uuid": "80eae5ce-c6b0-48ed-ab63-e91168670b79", "value": "cf7d98339b84b31f61d4abbe17cf3116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f6fc0a-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901444, "uuid": "b07ea785-a41d-4a01-9354-7c494aedda14", "comment": "Malware payload (Dridex)", "value": "c8b9a3d3d9bdb27fa33b875f3f4dae42", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901444, "uuid": "f4ae06e4-274f-4912-93d1-d26ef9097624", "comment": "Malware payload (Dridex)", "value": "7fa2e01e67d5f0d706889bec58af82e3fd2be557c616a4fc9050ee628c7a3f6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901444, "uuid": "c98793f4-40df-4004-851f-3327f7826c78", "comment": "Malware payload (Dridex)", "value": "52b3cda2048df14bcf43bf5c186885a6475c47a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901444, "uuid": "4c1c9d3e-e41d-4a0c-a42d-0543d0109f64", "comment": "Malware payload (Dridex)", "value": "4b1a5eca2d6d1c5ffe75913384c59425fc7b80790cc161e845671f9d8197b12e84f072b11d294310fadf961629fb3a81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901444, "uuid": "c86139f8-5d03-4026-9a1a-bb77e9870782", "value": "T13935E094B677A1CAC4A76CF6EDF86D746A123CC3623047A1CE02E1461B751E4CDF2A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901444, "uuid": "39eed7e4-da6b-45ff-a7d2-554ad5fb8c92", "value": "c6b4c2eec8a93016c63563421e15f011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901444, "uuid": "61350b61-1e4b-4a1b-b2fd-2f0483e19970", "value": "12288:DdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:xMIJxSDX3bqjhcfHk7MzH6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901444, "uuid": "2f5a7f8d-affc-4589-9f9c-95f78fdeb84b", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901444, "uuid": "0604a346-cdbf-459a-b8c3-758b620a5947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901444, "uuid": "ba5361c5-21e4-44a1-b906-06f993c1f219", "value": "7fa2e01e67d5f0d706889bec58af82e3fd2be557c616a4fc9050ee628c7a3f6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1506c7-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632903144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903144, "uuid": "8ae884bd-4014-47a3-bb32-0e61811f7e99", "comment": "Malware payload (Tinba)", "value": "9f63fd3547b05125bdda90c37e5aed95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903144, "uuid": "be09a2cf-e0f1-4d5e-ac8f-31e3d3d5f3cc", "comment": "Malware payload (Tinba)", "value": "80090b0a08a890c21fca4111ed6990f48ffa121b3da4703172a37659e2178d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903144, "uuid": "18506e4a-d7f1-47e6-a448-443f8fde8a10", "comment": "Malware payload (Tinba)", "value": "0db1d8145b100235142771817d8ad64aa6af886a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903144, "uuid": "97756b7e-60cf-4ab5-8cbd-e0dd78a00902", "comment": "Malware payload (Tinba)", "value": "0afbbbb29db6297bc76750b9e182d8064efb990b0eb4bb0fa14f0e82ef300273130f8d1e4a945af22cfa91e0211cd1bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903144, "uuid": "9b960dcc-5f97-48e3-ad36-40f4af0c8e90", "value": "T11DF2E0923B59E122E0E7DC3319B5680B9632C9659F5E4F7B1AC825299C74390BC43B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903144, "uuid": "62d9f7f5-a0f7-43d5-9a96-3d44f6ed80b9", "value": "1f818038e9a7c00938fb82807a35fdca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903144, "uuid": "698cb196-d37b-4664-ad00-01e23ec2a4cd", "value": "768:1p22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:1pYoX58z1uirL98xMWnT0OQ9J2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903144, "uuid": "d3503508-a72b-459e-a818-ed5a4eec5186", "value": 35332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903144, "uuid": "97a7fc29-2c1d-4ce3-8fb5-79a68168f332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903144, "uuid": "96397c4c-86bc-4433-a08b-ff2216355645", "value": "80090b0a08a890c21fca4111ed6990f48ffa121b3da4703172a37659e2178d64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed9e051-213a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632929619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929619, "uuid": "2079cbbc-0024-410b-8c98-585d875cd46f", "comment": "Malware payload", "value": "6b567779bbc95b9e151c6a6132606dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929619, "uuid": "104d6625-fed7-42fa-9838-b83a9148dd6d", "comment": "Malware payload", "value": "80721e6b2d6168cf17b41d2f1ab0f1e6e3bf4db585754109f3b7ff9931ae9e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929619, "uuid": "9ca794d6-62a7-4d66-944a-fee3ea442c25", "comment": "Malware payload", "value": "a0de69ab52dc997ff19a18b7a6827e2beeac63bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929619, "uuid": "835637db-1032-4dbf-b854-e02d07b5adf3", "comment": "Malware payload", "value": "59075f1d9ea8eedb07d5fbae0101ba03f60e885703ff8ec0a965b40927e9a517d0e380fec2591cf92a0408d43d1ec205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929619, "uuid": "82d41071-611e-4b13-9672-ed5523a7d84c", "value": "T1AC667D02F8A624E9C6BEF13086A1E3227A71786443313BD35F94A67A1A75FD47E3D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929619, "uuid": "6471d929-6b00-4d35-96ac-cf6b1149ea24", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929619, "uuid": "2bc800fb-286b-4657-9bc7-1ed07c5f4f21", "value": "98304:r3707VXDwyL4+nBmAAzdjhKppPOAkgD3AfEg:r370BXDwyL4+YAAzdjhKvpBD3A8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929619, "uuid": "5b9a6ebc-880c-4d57-823d-15af4bfab795", "value": 7010304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929619, "uuid": "b1a42a4f-4aba-4a7f-b026-07ccd053ed53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929619, "uuid": "742de416-1c4c-4916-b7d0-03fafd3c0e21", "value": "80721e6b2d6168cf17b41d2f1ab0f1e6e3bf4db585754109f3b7ff9931ae9e5b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58de7038-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901585, "uuid": "57a0f283-1db3-4473-bfcc-40c030b74423", "comment": "Malware payload (Dridex)", "value": "f3a936183d790d82ae77402dbad857a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901585, "uuid": "8e6f4480-9fdf-4f1c-be47-18bad6ae85e6", "comment": "Malware payload (Dridex)", "value": "807f12238d1ff9667c31f44178796a63ce759c4ca78cd472f9975d0c753aebaf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901585, "uuid": "9ba743d5-23e6-44be-a6b5-ee075a337023", "comment": "Malware payload (Dridex)", "value": "c569987ea8787f4edd108218052fcc7b9d79d38d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901585, "uuid": "715aa014-8f20-4c79-ae2d-cdc05a406f9e", "comment": "Malware payload (Dridex)", "value": "77ba79bb29145d7d19847002724611bf6ae9e8a141dc916f3da03b44fc6b58e58eefac337ee5921c8bf00981d18ce004", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901585, "uuid": "fbe11c77-905a-47c8-8c68-3511ca439cbd", "value": "T15505E094B677A1CAC4A76CF6EDF86D706A522CC3623047A1CE02D1861B751F4CDF2A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901585, "uuid": "408ff4ec-09a3-4c53-978f-a3127eeaec98", "value": "c6b4c2eec8a93016c63563421e15f011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901585, "uuid": "66c2d0f6-b7df-4fa8-bec5-a71592cc7b21", "value": "12288:ndMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:dMIJxSDX3bqjhcfHk7MzH6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901585, "uuid": "05870e8f-c439-4faf-a703-cddb85bcb92a", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901585, "uuid": "e8b4b669-49d0-42c7-88e1-44ef85574fab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901585, "uuid": "06ab95f5-d349-4557-ba75-79aac875ba69", "value": "807f12238d1ff9667c31f44178796a63ce759c4ca78cd472f9975d0c753aebaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e865d241-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903114, "uuid": "d8fa97a9-e7be-4340-a45f-278b860e2398", "comment": "Malware payload (njrat)", "value": "9d9dd5033dfeb20814cb738d17ed1b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903114, "uuid": "e2ae6c04-0867-4bc1-a5c2-59790bfe3309", "comment": "Malware payload (njrat)", "value": "80825fdebadc26d37f24d30a301df8c4849a9139c7017cd6452ea2d3ae30b67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903114, "uuid": "4bafe456-5314-4273-8966-125cd3827968", "comment": "Malware payload (njrat)", "value": "3c7def2753cb3b6ff97359526860c1c4d35f32f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903114, "uuid": "6510e02b-c42d-41d9-816a-f2ffde8ad249", "comment": "Malware payload (njrat)", "value": "dc69712548464d9cbf1f7f08d2f78fe44612e636800ec74333fa20dac889fe3ace710c6ba91e13b780ec886d3e49b3b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903114, "uuid": "6133bfda-506c-41f8-8844-dbb15a3e7b5b", "value": "T13E03E03447FCC8B9D6929E33149AE4041BB7C3009DABFB3ED984916B5D9AF62C530626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903114, "uuid": "1c28a73b-ab79-4932-829c-550686e59eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903114, "uuid": "467d7c2e-37d9-4cec-80e5-0a4ea41200a2", "value": "768:pypyypDcyDhgINHLM0Li4QYfhNLf7sdF+wHxR4:spyzyNLQ0Li1cLf4R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903114, "uuid": "e05a42e2-79c5-45ab-aad6-7740361f6f22", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903114, "uuid": "9fde03e3-a4a2-4a21-84c4-59dcd1372639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903114, "uuid": "28ab5c50-721e-434d-beaf-59eb1ddd9cc4", "value": "80825fdebadc26d37f24d30a301df8c4849a9139c7017cd6452ea2d3ae30b67f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a78f4c-2144-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632933813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933813, "uuid": "5eed0b20-d0ca-4a6d-890a-d0341d332114", "comment": "Malware payload (AgentTesla)", "value": "e6926eb2248b8f4b35aa5c6d6b80e1a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933813, "uuid": "f24db81a-1f8b-4abb-8838-6f2a4561a02c", "comment": "Malware payload (AgentTesla)", "value": "80e4ee144a841626a711f1787f3cba86b5a7e635417215c6bdb722160804c7c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933813, "uuid": "4e36b53a-f014-4b37-80fd-2b75b6e44b26", "comment": "Malware payload (AgentTesla)", "value": "6e15ef0d9f2758573e6e097142192ceaf1fb61a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632933813, "uuid": "e2f27256-e314-438d-a7e5-3b1ad576c58f", "comment": "Malware payload (AgentTesla)", "value": "fef4fb31ad3648f04fc8b069db42f10e461182b1393e32ce5d5fd467a2c0bd59546344591d2fce54bffb3143a1585f34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933813, "uuid": "b339c2f1-d563-4107-a8d4-ded135355af4", "value": "T120F48D6DF60CE29EFD0503F021297CD425E81CAD197CFA17BEA6B1E234AAD7651F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933813, "uuid": "d883b967-86e6-418a-b697-4b2b9b4e275f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933813, "uuid": "cd15dde1-a1ae-460c-ac93-412c32d32ae9", "value": "12288:kD4VHfQe6ZyWshg+qbZxTZZWunAWv0tXyvj8dBfiLkSL5Jqhdc41PQiAyq/cU60c:kD4VHfQe6ZyWshg+qbZxTZZWunAWv0t7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632933813, "uuid": "d37b000b-19bb-4af8-bd06-413adab9173b", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632933813, "uuid": "195cc10d-4c3c-411f-8514-d748238c9736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632933813, "uuid": "d109ac3f-bf6b-4d77-bef3-2c3d40f74d5c", "value": "DHL-70202129003511.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd0c2ee-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632899070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899070, "uuid": "9d04502d-4d23-447e-8e54-f6bdccc6d258", "comment": "Malware payload (ArkeiStealer)", "value": "2c6025fca82aff7f120e5cf208113372", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899070, "uuid": "6e2e8b51-0358-4d98-982f-a8df356f8b8e", "comment": "Malware payload (ArkeiStealer)", "value": "8104ca049d63de80339bf38af00601a25405fcc84a7a1df39001d21f1c71f8eb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899070, "uuid": "d1174943-fdc1-47c5-9bc6-a43cb0f59182", "comment": "Malware payload (ArkeiStealer)", "value": "684888f059ddc273897d8bbd31dd5d48c411c754", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899070, "uuid": "74afcc98-d8af-49e5-a0d8-b6f4d012ea33", "comment": "Malware payload (ArkeiStealer)", "value": "4630b53560a8e23df8a7acca36c1e5c0d85bd5b6777e4b725ef25a8138217af8ee5deaf5f840aa7e48ed6ec16893d496", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899070, "uuid": "5dfec46d-86b2-44a2-8285-8cf52698419c", "value": "T125B43C78E241DE2BE47D2B78A6DB0E62556278C870008A4FD3A10EDF7F5E7E67C0A145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899070, "uuid": "9e66edaa-29ed-44f0-b70c-701c405be032", "value": "82a23cbb1daea9d25c08002280929c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899070, "uuid": "80d6470b-8555-4145-8135-8aaf01fd2cc6", "value": "3072:wGOTkZLxl8On9UUnArw+ZEUzZELeUoPxwAnjaPM76DBQ+E0RqfUE+kvHTz96K6SN:reY4kLvBlRqfR+2Tz96KncK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899070, "uuid": "f6a8f718-6735-4d86-ab1e-178ef0c789c7", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899070, "uuid": "82872366-4727-4172-aaf4-3ad0b7d2e83d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899070, "uuid": "2af3c98a-34cf-4624-a240-6519c7f8e686", "value": "2c6025fca82aff7f120e5cf208113372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03924cef-20f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900583, "uuid": "ac7320cb-98ba-495e-b384-e0d548d2bc12", "comment": "Malware payload (Dridex)", "value": "37b283393801d98fb331ac6fa445683f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900583, "uuid": "b7015f04-e1e5-4637-bab4-544a5a1c9dce", "comment": "Malware payload (Dridex)", "value": "816e676c84cfcd41d922e4b6946336da6fcc0044ef900c4475224ca27047adea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900583, "uuid": "65973175-08d9-43fd-8c4c-c400ccbd5f36", "comment": "Malware payload (Dridex)", "value": "8bb700831d83a72249927cbe6c3159d26bc6b02a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900583, "uuid": "37efd005-ad23-4c1c-a659-2c51a651663d", "comment": "Malware payload (Dridex)", "value": "cccb85795a1df346911b944bdcac072099d12c55cd3ca9d37a8396162a56f718f3094748aac4e7be42f7a24089cd6399", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900583, "uuid": "8f072aa7-d1eb-4013-b5f5-b5b572bd3df6", "value": "T19795E010FE69EDE6C6B99F3E9408352317B93D74030DA18CC391604F5EF86546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900583, "uuid": "b3996cfe-555d-4fa4-bbdd-0d61db998086", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900583, "uuid": "aeeec5b5-e63d-409a-bd4e-d39a70707542", "value": "12288:xVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1tws:AfP7fWsK5z9A+WGAW+V5SB6Ct4bnbtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900583, "uuid": "7632ac41-c215-4267-b34c-ab28e30d0db1", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900583, "uuid": "7f1ac1e5-0c93-401c-a78c-a7906401ed63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900583, "uuid": "c022c3d6-d25c-41d4-ba4e-da4e937840d5", "value": "816e676c84cfcd41d922e4b6946336da6fcc0044ef900c4475224ca27047adea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea7ff74-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632903044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903044, "uuid": "895619d1-79fa-4c42-a6d0-38c5ad508642", "comment": "Malware payload", "value": "8932784ae18dd1eede267ca046d9f772", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903044, "uuid": "ef03cee4-04ca-4b73-ba64-5a3bf4a5373a", "comment": "Malware payload", "value": "817d90ff8f1fbf645866a5dc803bc9681d31b5bd1bf1b2ca942301536c6c53b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903044, "uuid": "994c94ed-f37b-450d-9147-59230fb74903", "comment": "Malware payload", "value": "e13577b5de906a6723adacca82d5f637d35966a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903044, "uuid": "4d404ee4-e4bf-4d44-89d2-1da2124a4d88", "comment": "Malware payload", "value": "a2397748c3ff241272b04f12ad2f3d423b30fc036543a1f8b93574ef5de891b718fd2afa433ff1177c83bd34a42dca6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903044, "uuid": "2834ec81-04a2-4173-816f-80b36599767e", "value": "T1EB43A6017BFD0209F6FB7F75AEBB94A04676BAA69C32CB0D1584558E09F1B408921F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903044, "uuid": "fa392dfb-9e21-4a58-9c21-48d61a698f70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903044, "uuid": "d0d3c924-59ec-4229-8505-8761cc9f5dd0", "value": "1536:Bgf1ivMUdS1YcqLB4eQrVPb7aIZabc/cMRu9scT+1Uo:w1iv5dS1YFB4eQtJU0bu9scTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903044, "uuid": "8bacdb60-2fd5-4dae-9865-fef6da56351b", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903044, "uuid": "a70c8e1b-197a-4a1a-b059-1295e5723369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903044, "uuid": "09d678d2-1d96-4044-b55b-fd00572d21dc", "value": "817d90ff8f1fbf645866a5dc803bc9681d31b5bd1bf1b2ca942301536c6c53b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c9f64d-2121-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1632918939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918939, "uuid": "b60bc39c-72cb-4457-94ef-d6fb163729c4", "comment": "Malware payload (NanoCore)", "value": "9826c3b0acaa180b1c2a13303c6650cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918939, "uuid": "46fe0dcf-d3c9-42a3-9851-227d7002bec2", "comment": "Malware payload (NanoCore)", "value": "817fe703f879bcc5ed27158f18940cae46272f2088f28461d89534b6a49bdcdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918939, "uuid": "4dfcafbb-e479-49e7-89bf-7634ca471748", "comment": "Malware payload (NanoCore)", "value": "3132ba76bcf6136cabb1094601a3046902c1a5bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918939, "uuid": "9b3a755c-0f73-46d8-92bd-cae32ff83e8a", "comment": "Malware payload (NanoCore)", "value": "9235e45542b6fec641b36c149da8f86930b216cb9f450918808d74079efda520caabfa4028b918f694140d13ce6de102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918939, "uuid": "bb0ebddd-0ca3-4a37-b6c0-189f5c31477e", "value": "T1C0F48D69F61CE29EFD0903B021297CD424E80CAD197CF917BEA6B5E230FAD7651F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918939, "uuid": "3f11c438-5ad3-4947-843c-959b48f06b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918939, "uuid": "a893a707-4765-4e70-b01a-1bbfb1a2ee8c", "value": "12288:tD4VHfQe6ZyWshg+qbZxTZZWunAWvLOGNavZs0JBGsgGPNoPyeNQqaoDJPF+Pjks:tD4VHfQe6ZyWshg+qbZxTZZWunAWv6a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918939, "uuid": "3f58b35f-ba06-4925-b980-5c30ce719dd4", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918939, "uuid": "db54cc4b-31d8-47ae-a382-cc236bec5548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918939, "uuid": "a974d978-fd4c-4a24-8144-dc5645b7a82b", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aca6d47-2145-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632934203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934203, "uuid": "fa21b487-8373-41d3-832a-30bc6fd77f72", "comment": "Malware payload (Mirai)", "value": "372f1da501b29cfc853f093936e4f28f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934203, "uuid": "b0c393bb-c3d8-406b-b2ec-4b046c483e59", "comment": "Malware payload (Mirai)", "value": "819675ec3e493894588d21d04b3ca2ee080392a50c772746a92f583aac264576", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934203, "uuid": "8fde4326-e1de-4496-b2f5-2cd00c5344dd", "comment": "Malware payload (Mirai)", "value": "6c8d6c70326a6c0d210ed4bfff2424c2d4794b4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934203, "uuid": "d6bccfe1-8918-4a01-a4d7-9eb281af6891", "comment": "Malware payload (Mirai)", "value": "59ef16e3e0115f89070dab1c023f58d49cade260a40b6aae2b83b47cb5d4e35625da9953f65d992a9ce76684df703374", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934203, "uuid": "c7c04d35-80b6-4252-adda-f6058da34f1b", "value": "T19E63027013BAC52198F13E776BF9CADFAE980EB47159337914C8537A2E85C49808B9C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934203, "uuid": "61a58f7c-c213-49fb-83c2-534ac7692b90", "value": "1536:5OFwK53EkRjAp3O76ipfEWzNVqw72XhRg1RfkLGsCEhi0cCPzJf:5OFwpWAp3Qh1EWzgXhRg0LVCDnCPtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632934203, "uuid": "016735e2-474d-4693-9f5e-a7448c0f2078", "value": 70916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632934203, "uuid": "0257844d-1c92-4e3f-ad5a-93210b2ba593", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934203, "uuid": "c2c79d46-c154-454d-bb8e-7d9d7939ecb0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a24b35-20b9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632874174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874174, "uuid": "a89ad6eb-901a-4418-b20d-80d277791293", "comment": "Malware payload (Gafgyt)", "value": "714eb996d85f333625ea99fc1487b8d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874174, "uuid": "661f80f8-e09d-4d5f-84ec-e65c525d5d09", "comment": "Malware payload (Gafgyt)", "value": "81ae2690e64dd4d471c58517b8324f96faf5eb3ffdb805235403bcc89311931b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874174, "uuid": "54088fa5-b7b7-4106-8102-78f3f8f10002", "comment": "Malware payload (Gafgyt)", "value": "5fcb60c0ced69bbaf939d69fa9f7900bf9dfded5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874174, "uuid": "88eebde6-a225-4c78-985b-29268bf40be9", "comment": "Malware payload (Gafgyt)", "value": "b286565b8049ce0bd5765f3db105b8f352169e91dcfdde36381709e3a9b6cf3591705c181dfd724e705033a15bd0585d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632874174, "uuid": "0f55338a-e9de-4854-8a01-e42d8fcd4911", "value": "T17D932B05F8454B13C1C227BAB7CF47493B266BB95BEB3302A6346EF02FC5B991D25960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632874174, "uuid": "b3ee68e2-6321-4a67-bc94-2f44c31ebc6a", "value": "1536:yu5sWiQ5ftEesFfw/DrRTOsX5hOkKxX86I0mRxqQEqn/lJXfPe:jiMsGrp5hOkKO6/mRxqQEqn9JXfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632874174, "uuid": "abd5ba0d-a774-40af-b41d-99cb0ff51e2d", "value": 96196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632874174, "uuid": "8e8ac9fc-bf69-4921-956a-c249bcde907f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632874174, "uuid": "3da25303-2005-478f-a49f-15642eef6cc1", "value": "714eb996d85f333625ea99fc1487b8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34abfdd7-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902383, "uuid": "214cdccd-aa47-463f-b4f4-428cc780ea13", "comment": "Malware payload", "value": "a08906ec3e3f03f1f8f20a787f6585fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902383, "uuid": "21734181-e4c7-4e9c-856d-9102aceb0af4", "comment": "Malware payload", "value": "81b09d1d135fae6e9fefa937b3fc771f5f3a6b96235207d60f7a683f208773a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902383, "uuid": "5d332de3-acc5-469c-b1f1-2123f095897a", "comment": "Malware payload", "value": "e1ceb0372969fe738a59837bc76bc4093bcdddb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902383, "uuid": "7900827f-2803-4c16-bae2-81637a5874a3", "comment": "Malware payload", "value": "896e7c4aab736abee39e3e6198ae1eac61720ee2223563e994d108ea970056dc2f0b500530a67e8bdf293148eacce572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902383, "uuid": "579a6d24-7d6e-4f46-86a6-0ed24b0cd89f", "value": "T1E773BF11BF812E48E7B91B3316EC25D607AFBB4D9DB097CB682D89D84F37A4084D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902383, "uuid": "4e694f29-5197-498f-a179-75f72adff631", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902383, "uuid": "1fe95174-6ff1-4562-ba28-b4406901635c", "value": "1536:JuHHM3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQte6R9/V1az:JuHs3xSyRxvY3md+dWWZye6R9/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902383, "uuid": "2f361ce0-fcc5-42bf-a5f4-de5ea1b94919", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902383, "uuid": "517546b5-a85e-4e2d-a1af-de7e468a3611", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902383, "uuid": "7454e619-2ead-4bd5-8c0b-71d6c0a0a72d", "value": "81b09d1d135fae6e9fefa937b3fc771f5f3a6b96235207d60f7a683f208773a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf9fcbb-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632909215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909215, "uuid": "a51f1384-f684-40f0-b90b-d992692f75eb", "comment": "Malware payload (Formbook)", "value": "51c46cfdcb94cf241595e99600ba40b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909215, "uuid": "39a2933b-1f70-4f77-80cc-4545825905bb", "comment": "Malware payload (Formbook)", "value": "81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909215, "uuid": "72730dc3-eeca-4224-a2ed-b01581054e64", "comment": "Malware payload (Formbook)", "value": "00ca9779115daee4f009d1048994270e5d9f86ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909215, "uuid": "311630a0-f59c-41db-b389-ab5df95f65d3", "comment": "Malware payload (Formbook)", "value": "6c70f78507a5ff1b175117fa5cf711eae3f933ede08c9f82f1974913566c063da32c9528012aa876f75e740c60f738c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909215, "uuid": "3464a788-8cf6-4e00-bfd4-50730b3ed9da", "value": "T1B8540222BBA08CF1E48352B16D3EE735B33DD98D41660A4B7B987E5A2C73383152574B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909215, "uuid": "74262cd7-a009-4e47-9e13-5ba27cd6b0f7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909215, "uuid": "ea340422-8974-495b-8680-9a040299269d", "value": "6144:U8LxBto7IA92cXNfRcgNJ9uWZKs9eH2m4yxr/i6k8:W7j9fqgNJ4Wss9eHD4y1Ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909215, "uuid": "2fcdbe70-821f-480b-8516-46fb0f1cb276", "value": 295981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909215, "uuid": "babbae92-fa28-4941-8077-4f7d5c633b2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909215, "uuid": "c660eb4f-31d6-4e08-aa66-fca68f742b03", "value": "51c46cfdcb94cf241595e99600ba40b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc0408a-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1632901938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901938, "uuid": "7953b5bf-406c-4449-a00f-99d65afa9c73", "comment": "Malware payload (NetWire)", "value": "b94adc74beea6a8879fa488901a56fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901938, "uuid": "9d7d87af-3596-4dad-bfdb-9f8312cf8bfb", "comment": "Malware payload (NetWire)", "value": "81cadf613f108486862c5f79d0e5e3a320ca433eb595f6686f7cb7478367c669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901938, "uuid": "92560f63-ca96-46b8-94dd-47a215901dd4", "comment": "Malware payload (NetWire)", "value": "a10510ab01f536b872e401baf331f660bae95e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901938, "uuid": "883503a9-4dd2-4888-90df-d392d26cf352", "comment": "Malware payload (NetWire)", "value": "97c2e6ba1aada6d68aa5ed724822a477e05e20ce659adc3b0869295c5398c41963ca9a8e2be863e5c622b372ac283220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901938, "uuid": "3d6617ce-1bc3-483e-93b1-16dd96800a6a", "value": "T12DF31718FA8794F6FE0B1D31919BF33F0B757A01C131CE92EF541E86EA23C66150AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901938, "uuid": "dd353ade-7f09-4406-9247-51eb48e23bd2", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901938, "uuid": "6c06d37f-672c-4400-8107-d6bb191588b2", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvvYMjMqqDvFfm:jOTcK+NrRioGHlz8rz0i/vzQqqDvFfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901938, "uuid": "9a618d76-885e-4f17-8be4-2e7c2b54e174", "value": 164416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901938, "uuid": "5b11d994-83bd-4785-8f02-197ddfa29d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901938, "uuid": "48116f93-de68-4a49-b9dc-48bf90560974", "value": "81cadf613f108486862c5f79d0e5e3a320ca433eb595f6686f7cb7478367c669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69cc425-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900427, "uuid": "40256319-2d44-4767-a925-affcc65b465e", "comment": "Malware payload (Dridex)", "value": "a28cad99026860e7b8ec347ae2ab02bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900427, "uuid": "ab8ca4fb-daf0-4184-b235-716763b4331b", "comment": "Malware payload (Dridex)", "value": "8237f65854c412c7421e1867e21f701349e788c14203713f0e1f36758c672b4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900427, "uuid": "2e90c130-de52-46b7-9102-9280f056d9d2", "comment": "Malware payload (Dridex)", "value": "6f0e03debba3b1e26a757d53bf6879e667844db3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900427, "uuid": "dbb6b02c-fa69-4ca4-9849-f5505bf9438d", "comment": "Malware payload (Dridex)", "value": "12604952c539fd48fd125abe33ed40013a09ec52113da4b1f93765d1a5c197e1eab33748a6b8d5bdef80effa89adb535", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900427, "uuid": "881cdfac-da60-4540-8388-0c33fc23dd62", "value": "T117A5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900427, "uuid": "54e91d2d-f69c-4cf0-b09a-9b5ba441952e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900427, "uuid": "35484a64-1cda-49da-8876-a2b43d76c63d", "value": "12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1It:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnbIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900427, "uuid": "6a550b15-325b-41ce-bf40-24fd1754f893", "value": 2162688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900427, "uuid": "99a59b02-40b7-4285-824f-ff1b565f45c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900427, "uuid": "8a8c7312-69cd-4c21-ae95-d8f0d169a76d", "value": "8237f65854c412c7421e1867e21f701349e788c14203713f0e1f36758c672b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f997f735-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900136, "uuid": "a4b39c56-96fc-4ff2-947b-0cec0f2a920e", "comment": "Malware payload (Dridex)", "value": "6188117fa29279a407af98c00e927d8f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900136, "uuid": "ce358b82-f237-4cd6-896e-f71f9a1ae3e4", "comment": "Malware payload (Dridex)", "value": "82d88c3629122ec720afafcacf812a599ad92aa4dc81761f87465b7dfe654421", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900136, "uuid": "4bab9c9b-1b7e-462b-a2d9-4f90bfa88a4f", "comment": "Malware payload (Dridex)", "value": "b7010f254a4113d0cb985c858e9680df845d0bfe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900136, "uuid": "33f2268f-f98e-425a-86ed-d199a06b47c7", "comment": "Malware payload (Dridex)", "value": "187faf778f26a1540b2595e4b36dc8cc3c6833172e48a71988bfb5749758a9b5db3fa39681d8d09e3198b8761dd46549", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900136, "uuid": "987c1794-a36e-4d3d-9af8-dee78d90660a", "value": "T19BE5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900136, "uuid": "e9453907-5948-4b67-8ae1-3634ecff2925", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900136, "uuid": "c542b998-1eac-462d-ba25-4b22c4862f50", "value": "12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900136, "uuid": "8ba6d020-b47c-460f-b693-88fa8d5226f1", "value": 3289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900136, "uuid": "fb8281b6-b5a1-44e0-b3c5-102c82998a6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900136, "uuid": "a910bb4e-d431-4cd1-8bb5-e89883f8dee8", "value": "82d88c3629122ec720afafcacf812a599ad92aa4dc81761f87465b7dfe654421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b29a0a-212c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632923403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923403, "uuid": "710bfb65-e665-43e0-9146-48d9da078ae3", "comment": "Malware payload (Mirai)", "value": "e65e4be62d3ac3268ebc4795f509a232", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923403, "uuid": "90b3605c-db13-4c4f-ae71-07a51318c57d", "comment": "Malware payload (Mirai)", "value": "834b84ce698c98d00e856c07a9533ea29fb251f94ce7e7cab2599581404454e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923403, "uuid": "8c1842b5-0b52-4ea4-8efc-cead7eb17e92", "comment": "Malware payload (Mirai)", "value": "7d9e75291bd12b43da822cbfa32791469064959a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923403, "uuid": "a986ed35-5d34-492f-966e-db7a02f0d9a8", "comment": "Malware payload (Mirai)", "value": "cd88a96b527ba19beb3d913b7a56e611c7b71c2f31fcbe40c0fb12f8d0a7bb77081b2fe8f8460c4dc55ee2a3b05ea144", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923403, "uuid": "900e2851-108e-448e-ab82-2b30b73c7239", "value": "T1C4242B08E950572BC2E327BEF69E528E33334BA473D7331989385AB43BC27695D36911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923403, "uuid": "fb0b98a9-118f-4b27-8657-1d8b50cf0e5a", "value": "6144:T2HPmi0aG7YrB9Cvi65hUfMbupM/9YByam+wM29ypFr:T2+i0aCYrB90B5hUfX+/Ham+l29ypFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632923403, "uuid": "e57f21e0-aab0-473d-b9dc-a209eda5ff1b", "value": 212857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632923403, "uuid": "aea36e39-1819-4a87-9d85-c7386ac8d36f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923403, "uuid": "0679cde6-be01-4389-a113-602dd10912ae", "value": "daddyl33t.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396e47d3-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900243, "uuid": "cd6e95e6-5670-45cf-8501-c22111fd6f7a", "comment": "Malware payload (Dridex)", "value": "ad8f941d641b6b566f3256b7f7b06706", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900243, "uuid": "dc8039f0-81f6-46e1-88f4-470ee27f47ce", "comment": "Malware payload (Dridex)", "value": "83ec6cc5397cdf94a819b4c1638dfb90b8c5d1fcb208282ed168171d8a2190c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900243, "uuid": "69cf2eb8-1fa6-409b-9508-b9ed73ff9cd3", "comment": "Malware payload (Dridex)", "value": "7fab60b11cb38418d82bbef94155aca1ef716e2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900243, "uuid": "f02ee833-b704-4a12-bef7-c23bdd064b2e", "comment": "Malware payload (Dridex)", "value": "f1d8665832fc832fe661a10501ed27ea6abb0bea8b55886d7b2803902e7d018b42c6177c676af686e1713a39c5acdbf3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900243, "uuid": "ad80ac2a-9dc1-4c9c-acb0-fbec57b2373d", "value": "T1CFD5E020EF69E1E6C6B89F3E9408352727F93D75110D618CC392604F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900243, "uuid": "93bda8c1-464b-4444-a117-cd722a2c40c1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900243, "uuid": "a988dc57-f799-4579-93e4-e4281f54ccf6", "value": "12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900243, "uuid": "60778c91-c0fc-4d74-a0bc-f9791eb514b4", "value": 2768896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900243, "uuid": "8a11ed1c-a7d3-4aec-ac05-4bf37bbb2fed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900243, "uuid": "06902fba-92c8-453f-94a5-763477ab2a66", "value": "83ec6cc5397cdf94a819b4c1638dfb90b8c5d1fcb208282ed168171d8a2190c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5879bc-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "aac3f867-e4ce-4929-b6c6-c9195d21806e", "comment": "Malware payload (AgentTesla)", "value": "8e5880459dfd487f693a49458336bacf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "7590f938-e145-4625-81ce-72381664be95", "comment": "Malware payload (AgentTesla)", "value": "83fd0c1a01b0384858ef8a90887cd412031b2f944801e7d915d68d816d5046fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "9f60a37b-89a0-45c0-ad19-03729241d547", "comment": "Malware payload (AgentTesla)", "value": "786a8c57ec302962118d8e06d987f323c36c8c3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "25b7c036-0395-4af6-a0d2-4dd884c7f636", "comment": "Malware payload (AgentTesla)", "value": "de5492f4391e4f92d01bf26395491a50c7e6bd76381bd60dde406e067385e684ba524ac4a4d652f1525521aa6d98cdea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919522, "uuid": "9009b59d-5eac-4563-9547-412290c88f9f", "value": "T16A64124382DAADF7F2465B71472E02F2F37FA629646612078B341F7F6D826825B130D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919522, "uuid": "ee681f31-f441-41e0-a5b8-d98911cad16b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919522, "uuid": "f0eacda4-0a4e-47c9-b58c-0fe1dcee660d", "value": "6144:F8LxBs6fwCZCBVkvS97R318dMn9m4Aq6dpJqHq/wn7Ch2/NgSrPybD73DT:/6fwCMByvS97R31uSUVDS8qN6bD73DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919522, "uuid": "251d2d76-9c9b-49e2-923a-0a75f07c3a75", "value": 311049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919522, "uuid": "ab5c0d49-fda8-4d75-8e62-c7832aa77a7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919522, "uuid": "d66d7acf-1dc4-434f-8137-7ee2eee2ad50", "value": "CMR-29092021679153_PDF.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadd5e6f-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919842, "uuid": "30d083ef-5ae7-41b2-89ca-4c3d16fb3685", "comment": "Malware payload (AgentTesla)", "value": "0f531c0786d2c71c7ab14abae4cda97f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919842, "uuid": "727c43ea-8ac8-402b-a385-bae9887b16fa", "comment": "Malware payload (AgentTesla)", "value": "847b366131942370d7a7c1598b83a8230a64f2589cf1a098492d05e9d16facc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919842, "uuid": "4514a46d-1da3-4046-ab78-1294f90720f6", "comment": "Malware payload (AgentTesla)", "value": "b29b3fdc7bac75f64a84986ab1429ea29026d1b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919842, "uuid": "3a37cb82-b656-4e8c-a329-cbeec5f6b715", "comment": "Malware payload (AgentTesla)", "value": "b904492307a8261af910bc9dee6cb53a9115512046839296924b7272df0539ecd7d21a817ddee58dbd313d4ae071985d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919842, "uuid": "b6850290-e30d-4790-a91e-30b78062a7cc", "value": "T1DC6412129AD059FBC52A027156BBEF3DF6AEC0385741AF8B07705D673D1224BEB1E182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919842, "uuid": "fa1eb07a-f31c-47d8-b6ac-370bb564ae96", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919842, "uuid": "b759de58-7bad-4c45-a233-529477234500", "value": "6144:F8LxBs+sWLQFQUaryt4L91gfw7QxBhMSwEZ9gQ9gw0G4P5sY4U5Yyt:/+bLcQUaet4Yf1bhMlEgCgw0GA5t5vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919842, "uuid": "449dae34-1f63-4d97-8483-16b3e7033120", "value": 312107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919842, "uuid": "e1c1ca10-c144-4021-a00d-aa7654874b8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919842, "uuid": "9b48aec8-4e3e-4301-bda5-3d39ea1f7e98", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39c58e7-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903079, "uuid": "17f123b4-db97-41d4-942d-59c3355974a6", "comment": "Malware payload (njrat)", "value": "3eacbffbfa0f1f8518e8f55cd85c9ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903079, "uuid": "38af6177-6ff9-4b1d-87a7-68dc6b5148eb", "comment": "Malware payload (njrat)", "value": "848389e1fda64606e31e4306672ff3943e234882ab6619c1e2d478028355ae22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903079, "uuid": "32b849c7-0eee-4eb5-a101-b657027f2c5e", "comment": "Malware payload (njrat)", "value": "d60d4171f646a72b0a42b638f9144ded42a2ee4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903079, "uuid": "ded69aa3-9927-4203-b43b-07611c9321cb", "comment": "Malware payload (njrat)", "value": "5d47415f896e345cdcc0bc8041e09fc150a2b3f5913ab3fd1576113977789a75c8ddc8dd6ad13e0b4ca679780c02698b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903079, "uuid": "e11b2784-acd7-497d-8513-777b2edf895c", "value": "T11A13E68CB690E174D5FF8BF1B4A2B2890B71A01BA906D30F99F154D94B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903079, "uuid": "42e51d6b-433b-47c7-878a-7ecd20b578f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903079, "uuid": "41ed6ed7-a39c-4b15-9e27-a219ad293e3f", "value": "384:UZy+Hl9n1iDcsyEqt3ptKwQsElGhOEazcIij+ZsNO3PlpJKkkjh/TzF7pWn5mgra:i99nU4pEqt5tKhohuuXQ/o8C+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903079, "uuid": "d06daff6-2d65-4914-9c99-dd6619f2473b", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903079, "uuid": "e6537185-75aa-4a83-9eb0-e60d3d4e9419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903079, "uuid": "15717f18-8f4f-4b48-9896-a8941950e7d2", "value": "848389e1fda64606e31e4306672ff3943e234882ab6619c1e2d478028355ae22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328eaad2-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632899373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899373, "uuid": "9082a4d0-cad5-47f1-b3da-5b37aafe3bab", "comment": "Malware payload (RedLineStealer)", "value": "19ac99cda799a4b089842bd000b5905e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899373, "uuid": "52c23e68-e85c-4492-ac59-89088a957d28", "comment": "Malware payload (RedLineStealer)", "value": "848cbefa4e9c76de30d7cf756fb5b2293bee22c5a45928c3df48afd170dc15a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899373, "uuid": "342446c9-9ebc-4523-9731-7b89967c0a0f", "comment": "Malware payload (RedLineStealer)", "value": "83d49cb53b611d103554bf450796b54a99c2a23b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899373, "uuid": "fa6e4d55-9c30-49a2-b89d-8f26e6149ee7", "comment": "Malware payload (RedLineStealer)", "value": "ecc14fadde2510b86d6d924c0b810e9688d83c6b7248b5300fc8cfaaabbb1297b9b2b6f36f11a10718b3b4c7326df9e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899373, "uuid": "0aba1848-04e9-439f-8655-19244fb1b96b", "value": "T16154D010F640D2B1C70205BFA865CBECE62DB94DFBE1927B26452ADF6A382B37534701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899373, "uuid": "4712e6c8-c22f-4b51-b3cf-ded0ea607d77", "value": "c660fd6c06779da3e6c79f00060c3a9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899373, "uuid": "4657c19a-d693-467e-b2b5-96952e9cc2ab", "value": "6144:2SnzriAbDjwrjeQtO+n0jNcPI117uSzC:Tnz2AborjeQ8+0WI1NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899373, "uuid": "c28dd24e-5ee1-45af-a51f-34782d0ceb4b", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899373, "uuid": "a8a33e14-5757-44b4-ab06-a27c6d80ddb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899373, "uuid": "56df3d7f-6cd0-4512-bcb6-38d965087112", "value": "19ac99cda799a4b089842bd000b5905e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8563a179-2140-11ec-843c-42010a9c0014", "comment": "Malware payload (Amadey)", "timestamp": 1632932154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932154, "uuid": "667627a4-6724-4a49-b6e2-e5b2bc5ca912", "comment": "Malware payload (Amadey)", "value": "c30c528c3c3d33903c598ef03b799e58", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932154, "uuid": "431b64f9-4e7c-4f12-800a-2de025659bec", "comment": "Malware payload (Amadey)", "value": "85450b08c8b089b5a642511b086c838e568dbc5a30174a398bb44eb62db6fdb6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932154, "uuid": "c9a11dd2-4882-44e2-8671-582341617cad", "comment": "Malware payload (Amadey)", "value": "8551c666ae37a03fd61cded18a9d3227c745d0cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932154, "uuid": "88febca2-f773-4004-8b7c-86aa7ccfae3a", "comment": "Malware payload (Amadey)", "value": "02ca276dfc82eea83e66fe6f3424d6f1cfc8fda1b396b955a70815eba819c2e4cc77833a184904b9190d32259804be63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932154, "uuid": "6350a3fa-2a1b-44da-a1fc-3e0563d23962", "value": "T19424AF0176D1C9F3D76141725CE2C6A4F52DBC6CEF2096B72B8456FE9F3D2D18A22212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932154, "uuid": "ee9a9cdf-3c27-43c0-85fa-c6df8524c6eb", "value": "34179943afcc1a565eb1e642cfbb492c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932154, "uuid": "e5fee7ca-7e24-43a2-b89d-ffcf36769e98", "value": "3072:a937UJjObnsgjFB2vkoapE5VCrcPI1ZepPUyHHe5RHZFS4sz:a9IJObBq5rMcPI1QPFe5R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632932154, "uuid": "14ea7fc3-3fe5-4e4f-940b-2017f6cc3a6c", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632932154, "uuid": "620c78ef-3835-4760-902f-07996f11f1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932154, "uuid": "dd36caa8-6b89-45c2-9012-7227fd4709e3", "value": "c30c528c3c3d33903c598ef03b799e58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604fde26-210e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632910617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910617, "uuid": "7a144218-a3d2-4e02-8740-a6f6aebb2c82", "comment": "Malware payload (Formbook)", "value": "5769730bd68a8b558a6932e3b765ad23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910617, "uuid": "3dcb9f9d-0cef-4bd5-a07b-d41ccb1a7f17", "comment": "Malware payload (Formbook)", "value": "85e45fbdd69f39214a4e3f588d14b1be4a7d81f4503813e1ab834c3525e568a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910617, "uuid": "061b909a-c1c0-44ef-ba69-de1ba589dc58", "comment": "Malware payload (Formbook)", "value": "dac6f67dd39ef8736c750d4e772b2bb2a9d891cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910617, "uuid": "c548539f-e973-4088-9b6a-ba11c0d81f71", "comment": "Malware payload (Formbook)", "value": "7b7915f1dd897e2adb85cfdcdf4ca89dc8d9d102e8d40ab2487467438a0382ad4bd5159234e280f1af4306d7f58b822e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910617, "uuid": "6d1baf30-c1ee-4edf-a09d-62255d8ca401", "value": "T1D554E051E150C6F1C706053EA815CFDCE52EBC5DFBE8A2736B50A5DFAE79193B022282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910617, "uuid": "2dc5627a-d407-4587-8faf-f05d151f72c2", "value": "1b0c9928ebc845bd66569c85cdb994cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910617, "uuid": "a0778697-52fd-4104-ae12-d97fad9d91b1", "value": "6144:XDBbNILeqZ3i4lSfn3Ajt0stJ1E5VcPI15yYuSz+:TBbNZuEfn3yb1E5SI15j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632910617, "uuid": "ff221a79-45b5-4d10-b257-941e9926b484", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632910617, "uuid": "ebded9f5-8f6c-475a-af06-331c329a35cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910617, "uuid": "9b9f1acc-da86-4784-a447-56a6744c9516", "value": "Nouvelle commande 09001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b2c37f-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632898794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898794, "uuid": "612077f9-1317-4278-99f3-d343559ae8ec", "comment": "Malware payload (RedLineStealer)", "value": "2f90345c192d169553fb7e51f69d59c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898794, "uuid": "f483a0b3-2076-4cec-9157-7113eb704bdd", "comment": "Malware payload (RedLineStealer)", "value": "86292445f59d153035c87b856bc215c8575258ad6b02e21c927cfa50535ac508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898794, "uuid": "022a77ae-a0a1-469f-aa07-13721acd0a99", "comment": "Malware payload (RedLineStealer)", "value": "07af4f9e66c467c716000056216ca7d7b8399a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898794, "uuid": "448e0044-5eee-4841-8a7c-6dc4539aa408", "comment": "Malware payload (RedLineStealer)", "value": "a68fe75cd80c9b72765be2e8fa75ff0f5062889b46e5e130801d0a5f37b09f211beb4187649723e3f5a8bd98c2792cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898794, "uuid": "2c8ae597-0551-4ddf-996b-5f90d73b4f9b", "value": "T1A054E050BA50C6B1C302017FA861C7EC913DB95DEFE1A63B675466DFEE792A3B034206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898794, "uuid": "d5b42953-2c11-4afc-b862-1badaf0f6f82", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898794, "uuid": "89965a35-6958-423d-9315-f3a0566f286a", "value": "6144:8infDY8PW878UU03tw2e5RLVcVcPI1ZpuSzC:9nfDrPW8783N5RjI1ZlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898794, "uuid": "33129e29-30ce-4ce2-ab1b-29d5112713c5", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898794, "uuid": "b4dacff6-1c83-41df-a89c-f49981b0c5c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898794, "uuid": "e20d7ac3-3543-4189-b4a6-4bf0495e395d", "value": "2f90345c192d169553fb7e51f69d59c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0256327-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903127, "uuid": "b20e04ef-3e3a-423d-8a9f-25cad41ea71e", "comment": "Malware payload (njrat)", "value": "3fe67b40b08d0c5eb5c0e75c9c75aa07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903127, "uuid": "e4bfd6da-43e3-48aa-8317-14ed240fbc5d", "comment": "Malware payload (njrat)", "value": "863484edb95485bc98d112c8d024d21c4be5f3c49def3970609ec8ce12b79cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903127, "uuid": "c4eaed6c-fdf4-4dc0-81f8-bf1924be51b9", "comment": "Malware payload (njrat)", "value": "4980c93628be1861adbe0517a5d0573c21bc5180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903127, "uuid": "258c9b1c-249f-4e9c-b45f-0cb6368b7a93", "comment": "Malware payload (njrat)", "value": "81c80353348b3d61d35fd1763e132cadb2985ff6604eb8dfe69d54e46380a06375eb1a7354a948653e38bb3f7f30d0e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903127, "uuid": "30330a89-b719-4986-8614-a5f80c17287d", "value": "T11803E03047FCC8B9D6929F33149AE4041BB7C3009DABFB3ED984916B5D9AF62C530626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903127, "uuid": "32287aad-616b-439d-bfc6-997f51ba2bdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903127, "uuid": "b8007016-25ea-44bc-a9ab-c9d02bcf5bd9", "value": "768:qypVypDcyDhgINHLM0Li4QYfhNLf7sdF+wHxRM:bpVzyNLQ0Li1cLf4RM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903127, "uuid": "a14abeb3-8f0d-4984-a449-c064e5012b40", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903127, "uuid": "610d04f4-9a2b-4f87-94af-fa255e625b6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903127, "uuid": "e6fc4e85-5b18-4201-b4ba-0c832890b684", "value": "863484edb95485bc98d112c8d024d21c4be5f3c49def3970609ec8ce12b79cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28a9969-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632898836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898836, "uuid": "c6e924ec-5f9b-428a-8d94-bf3d2d495862", "comment": "Malware payload (RedLineStealer)", "value": "03cb15f5dfa7234b1ff9d3402221ceb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898836, "uuid": "b7a77590-26b9-4c9a-83fd-58ee1508122c", "comment": "Malware payload (RedLineStealer)", "value": "863ffe4f5f345bedf85854875b10c19fcd8d951562eab07a0b5dc9e892abb4bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898836, "uuid": "3f1ea52e-bb59-49a7-8d84-0ede193c6466", "comment": "Malware payload (RedLineStealer)", "value": "9ff85ddadfbd7ad950ee47a41e2819ae2d48682c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898836, "uuid": "df0c591d-ad2a-458c-9c71-ca27415a25a6", "comment": "Malware payload (RedLineStealer)", "value": "20a85dc070da4716f03d59ec6de138548a06544615391ae56a8e04fc0fa8390ca75cfd1bec220fbca0296b86fa497f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898836, "uuid": "9add595b-cfde-42d7-ae61-88558c36f61f", "value": "T160C41201B280F7A7C752167FA43BC58CA22DB94DAFF181336B4466DF6EB81937A21351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898836, "uuid": "10a72b84-63c9-4e36-9edf-d185cf1c50a4", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898836, "uuid": "a233daba-7985-480d-b170-05281c71bb55", "value": "12288:yoYG9j5INPloSuxq8kwqcfdPxBcz881mj07buJqUgI18nNM:bYk2Jmq8bjV7cjm+yJqrI1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898836, "uuid": "5d8d555e-1004-4948-91ea-a440eefeba08", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898836, "uuid": "f750ef76-2a7a-432d-b459-445ba370276c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898836, "uuid": "364c68a1-de1e-416a-9c18-d22b65f10976", "value": "03cb15f5dfa7234b1ff9d3402221ceb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eac332e-216b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632950530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950530, "uuid": "7796ec8c-bc9c-4ab3-b54a-93c3a445cf46", "comment": "Malware payload (AgentTesla)", "value": "9aea39139785e751478d8ff53a06b543", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950530, "uuid": "de1eb662-c6a2-41b4-b1af-282cbc79c7a5", "comment": "Malware payload (AgentTesla)", "value": "8655b97f361462f2f5d402ea09fb1a66e99a865cdb50a99d86e8b4eb3a7cd47f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950530, "uuid": "0074dbb8-17ae-4ec4-8883-94752cdacfd6", "comment": "Malware payload (AgentTesla)", "value": "0d7c56e9bbc5a33aa0ce0854d45c389bd3e5c57b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950530, "uuid": "8b3d49d1-9655-4a17-b761-2811c59ad0c5", "comment": "Malware payload (AgentTesla)", "value": "5db1a42df8337549f3dd0e7c12b1b76ce3c68263250acf81f57a6e0317f370461758adf3a40b3645ad0dd5677d01b6d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950530, "uuid": "d5d69e54-5d30-4ecf-8843-71ad24e45fb3", "value": "T1BC35CE394D2682F7C7EEC63CD44C5BDEDA62A8837A919F1AC495DBC3125B70BE48844C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950530, "uuid": "8d66eb6b-a4b9-41e7-8e32-75ddc55afcf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950530, "uuid": "12a73744-1594-4f10-9281-9c8be040155f", "value": "24576:V/IB/+XYP6UEx81lhjA8++++4+++++++0+++++++a:N0moSUEx81lJh++++4+++++++0+++++D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632950530, "uuid": "07b7c417-a551-487f-9358-23ff4ab9d12d", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632950530, "uuid": "b448120d-4507-41e5-8399-c27d94b9157e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950530, "uuid": "8687894c-216f-4768-9e30-3d761caef7da", "value": "QUOTATION REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee41f0b-2121-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632918936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918936, "uuid": "0aa4a648-dba7-4850-a1cc-63f276391c60", "comment": "Malware payload (AgentTesla)", "value": "bd1ab93cb363096d4d32a4ae99f05e8e", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918936, "uuid": "1f77331c-b713-4f21-a2b1-c5cddab21bfb", "comment": "Malware payload (AgentTesla)", "value": "8683f537b622703b1879b355db96ea7c2b523c7094ac3bf46ea0a9b60cb5b376", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918936, "uuid": "bdc66739-6835-47c7-9556-5c5cf9628eb9", "comment": "Malware payload (AgentTesla)", "value": "278b7f7795eef35caa90edb43bd485cb1de3f123", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918936, "uuid": "d7ae8235-5c4b-4359-86d5-f74c1e39e11a", "comment": "Malware payload (AgentTesla)", "value": "f93c00aff9e3218955f0757f72bb160d44aa387297880c7326fd0723f31fc10065a02efffed92906db43c4087b6370c4", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918936, "uuid": "a109b5d6-590d-44a1-b960-85f15ab73fec", "value": "T120450F394D2682F7C3EEC67CD09C0BCEDA66A8937A918F1ED495D7D6026770BE49804C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918936, "uuid": "5d8312d6-f784-41fe-9277-a862485f2b06", "value": "12288:iAscTBkWKcVuXHgPDvh4D1Fj0UN89HNPJWceBpB6AoR7e8yjOG7QD7jrpd:hjSW5VeAPV0VT2NPJvLpyyG7QDDpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918936, "uuid": "9d9d830d-4bf1-4faa-be87-5d7d1f1a6a5e", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918936, "uuid": "c46b6ce4-d163-4080-bb5e-e67a38a5636a", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918936, "uuid": "0b10eead-9d28-4117-a6c0-ce0a461ba2cc", "value": "AUG_Statement of Account.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996b1805-210c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632909853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909853, "uuid": "b982b92a-06d4-4431-903d-ea29186142bd", "comment": "Malware payload (Mirai)", "value": "5b99053d2bb05276a2dbf252c63823dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909853, "uuid": "93d6a238-7880-452d-a001-25a4f24b8015", "comment": "Malware payload (Mirai)", "value": "872691017e2f1a33da56e79c9117eb4ea7857650df3e4a01f2f3bee2411ad62e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909853, "uuid": "a4f66f1c-ffe7-46af-aca7-235591376627", "comment": "Malware payload (Mirai)", "value": "cf8c1b1d034071b29205e9b238d6c1162961948c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909853, "uuid": "2568c992-30b6-476d-97f0-9e4f81655872", "comment": "Malware payload (Mirai)", "value": "377e2446ed72f8998d64fb877c5f49996c838ff0903357362ccf923193a88e1ddfea9d6bff016edc6d8d556d370cfdc2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909853, "uuid": "beb4bc88-6b7e-4537-82a6-c550242f057f", "value": "T128633BC4B853D9F5DD1606303076FF339E36F1BA2129EE8BD3E99572A942602D403A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909853, "uuid": "cff3e7bd-fa0b-410c-acd3-406e281be2e7", "value": "1536:PMMsn8+ixH3dGaPelKsLBd+OpUzGGjpq+oJLrEohdrBVrhh9h:0f8+ip3dGaPeJLBd+OpUzhq+ojrDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909853, "uuid": "53739a42-2ca2-4970-a41c-d5467135553a", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909853, "uuid": "fe5b32cd-18a9-4f3c-9b0e-a4bc2de177c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909853, "uuid": "3330c602-9028-4b34-b9ab-66046ae314f2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ff3991-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632908878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908878, "uuid": "7fb08da9-5048-4cf6-9150-596b7daea126", "comment": "Malware payload (Formbook)", "value": "3f375e1b39e24ab6ff0663fb0b77a431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908878, "uuid": "ec34ce9d-57bb-4274-9e3f-7fe91c975f9c", "comment": "Malware payload (Formbook)", "value": "87e14807d94b233fe1299ec3f5df34065191522aa682eaac3202f78250268c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908878, "uuid": "951ff78c-f100-44a2-bf6e-371f903a1086", "comment": "Malware payload (Formbook)", "value": "96170053ee422c8b6b2d0ede33a61776c0f0305c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908878, "uuid": "b9da54e8-acba-4994-9ee9-25b9080ba6b3", "comment": "Malware payload (Formbook)", "value": "9ef87f6329fc5b1e204e86ca9839b2dcc3c48a770c84905976fa0801e60994fdfbc6ae8018cddc7099403c1b2156244c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908878, "uuid": "76ebca6f-3317-4554-8d2c-a7f26fa8cf54", "value": "T112055C61E7D58CF2D2262B750C2323269012BF76344C785D6EBA7FB62E34190742AD6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908878, "uuid": "5b46e9bb-6a9c-405b-b9e4-0d03ee7dd088", "value": "f0c25cd198950ba1bc931e9bf4f4e5f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908878, "uuid": "cbc41631-98f5-422d-90d1-d3c39dc95c8e", "value": "12288:02DA+ebuMqQ/5KIXmdLwWZsSOarJsU0QLS7TnUEB/XNkYEQPC:C7FJ/5KIXmNwWZsUraU0QyfN7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908878, "uuid": "0e11d379-4cd0-493b-9d97-89905cc2d843", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908878, "uuid": "25660618-f493-49e6-b88f-a11948a91c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908878, "uuid": "375028a6-08a9-4e92-818b-7827254debb2", "value": "Lista comenzilor atasata.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee456e2-213a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632929539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929539, "uuid": "08b78103-036e-40ca-9fa7-27dd7b3f655c", "comment": "Malware payload", "value": "109106feea31a3a6f534c7d923f2d9f7", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929539, "uuid": "536efd17-a6ef-43bd-a6ec-7216b2fefde0", "comment": "Malware payload", "value": "8900cf88a91fa4fbe871385c8747c7097537f1b5f4a003418d84c01dc383dd75", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929539, "uuid": "07ad9239-5759-48c6-847b-82af499eaf30", "comment": "Malware payload", "value": "7f8593f741e29a2a2a61e947694445f438b33380", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929539, "uuid": "85510b0f-b79d-48c7-8020-3191249b6381", "comment": "Malware payload", "value": "6d03b581f65e84456a46fcbc8ca421577cb92fc56f44931bda008d6566e6aab6530cd2deac84b1f44f1fb8965508a77e", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929539, "uuid": "2c6566c6-bc68-43e1-85c6-8bac12859fc3", "value": "T17E82F80FF20664EDC21BC17885DE6732E0B2783152672B1E2B74C7303E646A95B7EA19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929539, "uuid": "5a735040-ff93-4701-82a9-9dbe71791175", "value": "aabbd2dbff7b6da570b1d10d91e56428", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929539, "uuid": "7e8a35da-2863-4b13-8b84-11e404b8e468", "value": "192:fMd4AHkvEKy63YAXNJ0TMgRjcozXernPkNB+fvxRmRjxabNjpg5:0d4AHkvE96o8D0FlciXCkL+HYspg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929539, "uuid": "831ed313-614b-4c21-bc01-677fb6db82d8", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929539, "uuid": "6e1ec93b-29be-472a-bdcc-9eb9f99feb3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929539, "uuid": "b4fd685d-3dd1-460a-9e5e-0dd5b4059166", "value": "8900cf88a91fa4fbe871385c8747c7097537f1b5f4a003418d84c01dc383dd75.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf93c112-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903072, "uuid": "a7d8ca96-4203-4a02-947e-131a6291aeb4", "comment": "Malware payload (njrat)", "value": "28c3f61294f4e7f30725de6515474e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903072, "uuid": "2a2e50c6-8b31-4a2d-ad0b-979a41aad964", "comment": "Malware payload (njrat)", "value": "894b6b2ba32dbcb980882299ae7b0389b2182accc27feda5d356a4ef749b27e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903072, "uuid": "373a4833-8971-41d8-ac90-98f3b025345e", "comment": "Malware payload (njrat)", "value": "e678e3e8680a039784cc370c642a679980f96333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903072, "uuid": "2406a1e9-8912-42e0-90a1-b2cfc9ef3b21", "comment": "Malware payload (njrat)", "value": "387b2352051a1cac1bb33384de74660be233b372bf436f561fe59695148749051a60823f256cf8f9566d4b710d024903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903072, "uuid": "62276865-58d5-4bc3-99e5-26a534691116", "value": "T1C013D78CB794E175D5FF8BF1B4A2B2890B71A01BA802D30F99F154D94B73AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903072, "uuid": "11da3787-4069-42dc-9314-d292c6eecfdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903072, "uuid": "54b92b3c-31dd-4a06-a37f-1f1628a478dd", "value": "384:fZyR4DgolYxOoyi08Hyf2ASEN8MFQPzgIij+ZsNO3PlpJKkkjh/TzF7pWn//gre7:hMouIli04kDP8qwuXQ/oy/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903072, "uuid": "bee8c15e-a11c-44d4-b70a-0ce4e0b62094", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903072, "uuid": "3b0f7b45-2ee2-4fc9-b6a1-0798dc0a756d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903072, "uuid": "ed350162-7cae-442a-96ed-1380c2760011", "value": "894b6b2ba32dbcb980882299ae7b0389b2182accc27feda5d356a4ef749b27e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefb87b6-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632898427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898427, "uuid": "e527d3db-1720-4c7a-af4c-8c3b8abdfaa6", "comment": "Malware payload", "value": "da1cabf2d34d998e4ff8b00fda3aa937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898427, "uuid": "2c2ccd9e-a659-4a4b-9430-761337ab4268", "comment": "Malware payload", "value": "89702b2b35a92b86d0ae50d952478ba9345f44d983479079bc5d6e4e1cea156b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898427, "uuid": "fd1cd136-e834-424f-b658-ea7d54a3afca", "comment": "Malware payload", "value": "1f94588df54269b791e9e060cff72a7f8b3ad1e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898427, "uuid": "cfe7a9f0-c4c9-4cc7-b75d-615b87724694", "comment": "Malware payload", "value": "24c176dd095a7c39768b86031083dcf8657f3634a9fc116af519c066f0fa088456387e078b0fe8be868296153cc2bea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898427, "uuid": "b30d3959-23fc-4c8d-ab19-eb77fbe952d5", "value": "T18706901163F90996F6F32F30AEB481545B36BDA99EF6C62D3144428D0DB6A50FE70B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898427, "uuid": "017a68c7-85cc-4b28-95fc-a0194dc1cd51", "value": "29c4c5f8766667965cf6248336ce2ba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898427, "uuid": "c020275f-fa21-497e-9489-198bcbf5a582", "value": "24576:t0FLx8hSA/6oTNTRh3Qh3OXFZr6Er+M3NsoBAYdlKl9i8L5DBMY:t0px8UYTN36sZv+4BAulKl9JtaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898427, "uuid": "6bb572e7-8267-41fd-a3b5-c77bd4510e76", "value": 3934720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898427, "uuid": "5f287a9b-b899-492a-961f-cff599cad625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898427, "uuid": "9fc4bd2d-b499-444c-800c-821f00ef044b", "value": "89702b2b35a92b86d0ae50d952478ba9345f44d983479079bc5d6e4e1cea156b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a88eda-2132-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1632926054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926054, "uuid": "6d156d93-938a-4a44-ab04-4f6070757751", "comment": "Malware payload (Hancitor)", "value": "c43018a5f38a2b74bbc5198bbf40e98a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926054, "uuid": "17cd9228-f0f6-4c6f-95f9-b6f320b62020", "comment": "Malware payload (Hancitor)", "value": "89783756c7288b8d0a47bc759658884a6d531ce50666aadbf790e8cd1979cdf9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926054, "uuid": "3f167c10-0b56-460c-a1e2-a1765b39a6da", "comment": "Malware payload (Hancitor)", "value": "9d0a96a5dbc1595b072d75738125bf4dd1a3edc1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926054, "uuid": "bca0ae9b-ff7b-4913-bfbb-e5b5afca6abe", "comment": "Malware payload (Hancitor)", "value": "0a1ac1b71489e39c968094827058b87f62d6086a2abf2101cc9dfadbeeb6a9b374ea8c8886f212a4fdcf74dca9774b32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926054, "uuid": "6b3f7c13-128d-412c-8211-6ad96c5b96de", "value": "T1CD051201BA90DE47D616497A1DF6DBE53B38FC36DE18CF8B7258730E2C39A6499009D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926054, "uuid": "bfec6f38-584f-4dbc-9147-924c591f6334", "value": "24576:KEIZ4wA74D4SQKxZcy8gthDWIA3jQ7LMmT:K+wJD4QZh/qIukL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632926054, "uuid": "45e0b92e-86ac-427d-b94e-06cc427689ca", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632926054, "uuid": "1ed283af-61e6-412f-be6f-dd5f9e770a96", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926054, "uuid": "7b6ab29a-67fa-4250-b871-f7d4404fa966", "value": "0929_977822708747.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f441d60-20d3-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1632885355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885355, "uuid": "14e46896-9d50-4d68-8600-c8f3843adecc", "comment": "Malware payload (Tofsee)", "value": "f8c9d11a8316183bc3c137f9e1d452c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885355, "uuid": "a47764ff-c1ff-4f92-9419-1aef7bd8de48", "comment": "Malware payload (Tofsee)", "value": "897bb67dac34904d72e20fb6b62feb31c86575107563db56535c38d81eec56aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885355, "uuid": "5e92554a-ac88-40a1-a62e-29af0cb9635d", "comment": "Malware payload (Tofsee)", "value": "a32a7b8ca21bc1da2ccd397e88fcb589b41a81e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885355, "uuid": "a145d92d-7676-426d-b534-83bf81a1813c", "comment": "Malware payload (Tofsee)", "value": "cbd196690bd1acb7eb992365b6fd5008995ad24222505b75cfe5f52a123db1afeafa183d1ae590118d0d79b2ef1ba47e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885355, "uuid": "e0549de5-e143-470d-9d30-2a0e1c971413", "value": "T160348E10A7E0C034F4B712FA4979D3B9A83EBDB16B3591CB62C516EA5A746E0ED30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885355, "uuid": "6e0c7f50-d9e6-40ee-882f-68fd11ac1990", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885355, "uuid": "bc35ec68-95bd-46e9-9467-9f8c7d11628d", "value": "3072:IiknbWZjk1EVrMSGyoLB6bK4OOr10d74UyYQUYmu+kXebuBxW9pz32htgSOl:IpbcjkoMSzqBn4ObD7XWGgW9pz32fgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885355, "uuid": "89755325-77bc-4bc8-aebe-9ae0059af5e2", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885355, "uuid": "febc83f7-eb73-446d-9e7e-3aacc2e4e359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885355, "uuid": "f39a755e-b7ed-4053-89e7-4d86bfc223d5", "value": "f8c9d11a8316183bc3c137f9e1d452c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2419a8-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632884731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884731, "uuid": "7026f507-7cca-4fc3-a3c5-0e0430c83a2e", "comment": "Malware payload (Mirai)", "value": "5b177d874e0f53b4cef4e39d67cceeff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884731, "uuid": "a04e29ed-a298-4afa-8a4b-195d3f66af9d", "comment": "Malware payload (Mirai)", "value": "898dbb0c94a7a17725032bf6efc96561998ecb473e9aa86d48bf34b1444bed2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884731, "uuid": "5238258c-0385-4cf7-b744-9d5524b8a5c9", "comment": "Malware payload (Mirai)", "value": "1d8ba0c16409f0410190ec0f4ae46b116bb5c9bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884731, "uuid": "ad548016-6baf-40c9-aa9a-35650e05bc3b", "comment": "Malware payload (Mirai)", "value": "adf5b2ec493290b01af4f5510a5bb67434315024ca2f7751da4b6c0898e487da021354cb1ab305d2d95b1c7f63e13c8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884731, "uuid": "1ee079f6-d671-4ae9-ac04-2b07bf2ab897", "value": "T161D31A3B67230E23C0C9447119E30331F9B9D75934BE57C3A9D06EAD6F1AA8434667E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884731, "uuid": "3e7047a0-3086-48f4-bb18-7cc72b0cb5f1", "value": "3072:yLgqnxnBv+fZNPP1bEj7wmm2dMzP2vcDeNO:QgqnNtml2Umm2dMzP2vcDeNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884731, "uuid": "4bf18ebd-2968-44b7-9d10-e561e4c1d5da", "value": 135857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884731, "uuid": "0768bb7a-a640-4d3e-b998-ea63ec9d802a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884731, "uuid": "5ae99cad-659e-4ec8-9779-e626b1a1332d", "value": "5b177d874e0f53b4cef4e39d67cceeff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db7aa30-2120-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1632918424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918424, "uuid": "b7cdeaeb-b304-421c-b83f-ae9fdc2ae227", "comment": "Malware payload (STRRAT)", "value": "fef7458a118a9f5291b1eec9956b7c37", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918424, "uuid": "b5ea51e9-6fd9-4d9c-8ec2-cd4a0fd6d53b", "comment": "Malware payload (STRRAT)", "value": "89ddd76c8a55caef9f05473a49fefe22c0f5835abe63b95a51fd972bb7a959be", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918424, "uuid": "87251472-db16-4250-9265-adca566951f2", "comment": "Malware payload (STRRAT)", "value": "e071b26e4d69101ab044944c4053f3c55905cdc2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918424, "uuid": "c5ad3393-ac9f-4c43-8122-c9c5098f6dd4", "comment": "Malware payload (STRRAT)", "value": "660e830ebbf1135879e10db480225a2fc4ddb7e12d8b22b77e17531a5bae0281641fc2035a38045b6d6ab9822c155560", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918424, "uuid": "f653f6c5-b853-43a1-81c1-15ad9f41d93c", "value": "T141A3D0AFBDA690B4D91B817356088231E60D61D9C14AE37BA0FC04863F79D6D0B4ADDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918424, "uuid": "f0206904-13b3-4993-9f6d-dcd7ffd3261d", "value": "3072:5bdD/fWw/TRe6S0GbN5geAE7eI6GWaBzT:5RDWFI+XgnEyIoaBzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918424, "uuid": "d80b631e-ab68-4a8b-a521-6f5d0bc6b778", "value": 106180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918424, "uuid": "916a7a45-6ef4-4b1c-8f58-462ba1c2a4b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918424, "uuid": "5a1e173f-d995-4384-92a2-cc1eeb599bff", "value": "MoneyGramTopup Report up Sept 29.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5353c881-2124-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632920044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920044, "uuid": "eec2f6dc-264f-4b15-8977-e1a123ce19e2", "comment": "Malware payload (AgentTesla)", "value": "45a4a9702b705321488c53a86607ff4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920044, "uuid": "e2357f9b-e07e-473c-986b-d20a0e0496fa", "comment": "Malware payload (AgentTesla)", "value": "8a0afb2acdc2403ded68c297e922bc9ed98447457be8c267d4654949925d69d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920044, "uuid": "a78da3f3-48c8-4106-aff5-51ed5ebcc8a4", "comment": "Malware payload (AgentTesla)", "value": "7d39b29f4f498b2434be88d5d208abaa9ce83a1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920044, "uuid": "69be94f0-9759-447e-8ca3-5a1b3badf98c", "comment": "Malware payload (AgentTesla)", "value": "90ccff187c6e806312927330ed045734c2b5f3b34fac09d662f2b2b618641a6c5362245cd7ef682bbdead17696ab235c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920044, "uuid": "3acaafe0-01e3-44c9-902b-1ceb4e864e0b", "value": "T1C5058C1AFB14BBF6C21D4EBAC887168043E4C1673336F79BADE21AD05655E06EB1F046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920044, "uuid": "4fd8d016-d355-484d-b720-cf3397d7262b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920044, "uuid": "140a34e4-5815-4596-8e38-72f087077075", "value": "24576:50dMmJocqIBzfRN6c0TGdQVZljy7RY8V0W0FtwIHwnshxS9Ecs0giIoS57UFZwpZ:50dMmJocqIBzfRN6c0TGdQfljy7RY8Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632920044, "uuid": "98b4a50c-c86c-45fd-9631-af8809162cad", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632920044, "uuid": "9f087e7a-96dc-4980-b1fc-d4ee4c1edd2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920044, "uuid": "598f0d98-3ed8-441e-ac32-e0b3f34b6959", "value": "FAOS_210929_0015PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108b86fe-2100-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632904470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904470, "uuid": "a8282747-f2ad-446a-90b5-87c50576971d", "comment": "Malware payload (AveMariaRAT)", "value": "4ee984dbe97f1e2883af4ffdd339dac7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904470, "uuid": "6d832694-94a4-4cf5-929a-108f82c4c0b6", "comment": "Malware payload (AveMariaRAT)", "value": "8b1aa34a7beb2b5140c7fa59d42bd086322daaf1bb8b1fbf7980322e69b1ef4f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904470, "uuid": "6b993cc7-ab96-41bc-aa36-28c6e972be71", "comment": "Malware payload (AveMariaRAT)", "value": "a7f2c66095dbcef5e2cee9d1213dc6815bbf097c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904470, "uuid": "92b4a4ac-b8d7-47f8-9c95-1701e691a304", "comment": "Malware payload (AveMariaRAT)", "value": "cbae03904d4ff42c0cf3ec66fbcc9ab6771c4841fd1d10457d3f838ce1f3c02abca4e96411a6a4774ea2d7a0048f2ccb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904470, "uuid": "be420174-9850-4979-bc5a-82a95895e830", "value": "T1245423E03A53AB4F64B3F13BD627C6E61C849F0E605FA1C94EF776E821025AA605753C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904470, "uuid": "8ce36b53-fb2f-4830-9dca-206acd9b78de", "value": "6144:sD7Y47nd79zrlOYtJeiJsGtedEStfuYrlndux3mdbMyoTm4O+gx:s1R1rpP9JsGIES5bJndu0lMyo61x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904470, "uuid": "0fbd4ec5-8aa6-4ea9-952a-8ae8f86fdd16", "value": 281255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904470, "uuid": "9d53e701-0b12-4a0c-8431-d736f7abf392", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904470, "uuid": "45e00eef-c93e-408f-868f-9353b6979308", "value": "PO-RMS74OM PT Chrome PVT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8865b1ce-20da-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632888350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888350, "uuid": "c2aec17f-e678-4b36-959d-166382b9ad13", "comment": "Malware payload (Loki)", "value": "f6c19df68b7c40475c2c94380c51abde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888350, "uuid": "e0a4d7ba-8f35-4b6b-b17f-4866de2b1e4d", "comment": "Malware payload (Loki)", "value": "8bb27baf14bd0c4cd0df2ba2ad00aa0342bf0023716f675a2fbb0a2a8e19b55f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888350, "uuid": "dc0b87c3-e5ec-4fdb-aaa5-8c92214203ab", "comment": "Malware payload (Loki)", "value": "905aee0203178c9a70a558244772b81489938573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888350, "uuid": "dbd34bd8-4399-496c-9373-b2d0681c6a1c", "comment": "Malware payload (Loki)", "value": "a8abe51d47e3f50e40fe288be10c3987fde911236c19079942fb8e9f199dd13dc7fef6d1b53d1ca14027d9c4e673bb13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888350, "uuid": "41f895c3-d12f-435d-b87f-510f9f365da4", "value": "T142056C2AB60CE65AFD1433F02524BCC411B81C981C6CBA17BA7672E6B4F9D27DCB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888350, "uuid": "857e0521-a61d-4cc5-83b0-7c08be855f09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888350, "uuid": "8f04c166-9240-4efc-b81b-e96d21beb61c", "value": "24576:5D4VHfQe6ZyWshg+qbZxTZZWunAWvT3M3qHKuPdQEAGA8:jT44KuPdQEA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632888350, "uuid": "026647cf-0e8d-4ab7-bf2e-ca89a52fbb83", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632888350, "uuid": "16bacc5c-3dee-4bd2-970a-b5ee240fdfdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888350, "uuid": "e32db5ea-e27f-4155-ba89-bedca87ae6a0", "value": "Quotation_SD-210929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b274230-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902313, "uuid": "921027bb-5a58-42ba-acbf-0ec692c600fb", "comment": "Malware payload", "value": "becbdff627b216276728e8d76f7cccb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902313, "uuid": "350abeb5-d191-41b0-84fd-921ceaaec918", "comment": "Malware payload", "value": "8c0b380c780b6aaf1d09c12107ba9f1f262d963a1ca84f12acbd63b96a6b433a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902313, "uuid": "01d0d1a9-e0cd-42c0-ae81-b6e121dc4b78", "comment": "Malware payload", "value": "73d7b1f7df2e204772156561c931322f0c8c8e8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902313, "uuid": "0eef9699-f36b-4246-9665-5450f7f274d1", "comment": "Malware payload", "value": "30ea25192968358f591ff5a3b9d4ba476c208223904929c889c3d68f54798113199f56d417cdea18e9091e15405618c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902313, "uuid": "5fd6d36c-9e39-45c8-992f-e907f17db317", "value": "T15473CF127F821D14D7F80F321ACC35CA0ABFB78D9AB05BCA1D2E99980F37A5459E0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902313, "uuid": "7c61af34-6ed5-4def-9670-2a0ed284f14e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902313, "uuid": "ac55cc2d-fdb9-4a31-8455-a8b382d1f5f6", "value": "1536:le58xLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtd6+t9/K151:le58JE2EwR4uY41HyvYd9/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902313, "uuid": "b75a78ca-962f-47bf-ba73-09073f499074", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902313, "uuid": "56e74e94-be06-4cc2-8205-fcaae80ded0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902313, "uuid": "e1ea3516-7feb-469c-b7ac-306ebd29e22c", "value": "8c0b380c780b6aaf1d09c12107ba9f1f262d963a1ca84f12acbd63b96a6b433a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25ddc58-20f7-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632900930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900930, "uuid": "1c8bd927-c9ca-43a2-bc66-972f0de05afc", "comment": "Malware payload (AsyncRAT)", "value": "a3fc81a4bf5c20a3cb8a58e8b879e301", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900930, "uuid": "19d9d84a-b45e-4309-8efc-4d3b1fcf7d04", "comment": "Malware payload (AsyncRAT)", "value": "8cc2626335a3cad75995ab48ae1052ad56a158a098a92570963ba36e7df0ce98", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900930, "uuid": "28301fbe-274f-4bde-9bdb-acaba6392f2c", "comment": "Malware payload (AsyncRAT)", "value": "88a76fba86c3593b777fb8179a6209553712ae04", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900930, "uuid": "41cbf352-f814-4ea1-b8e3-c13ec348c8c4", "comment": "Malware payload (AsyncRAT)", "value": "9f45abbea642743924d6cb850a7869c98ebc588b2220e60e59caa403264924818b63c3ceb93347001207bee422bbeb9f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900930, "uuid": "e87d312d-fe12-43f9-b4c3-f4eef457ace9", "value": "T1EDF45C2AB60CE65AFD1433F02524BCC411F81C981C6CBA17B97672EAB4B9D27DDB405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900930, "uuid": "1e4c0c75-5405-4236-a2ab-6dde4a3530fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900930, "uuid": "0fb9e4dc-01d2-43a1-9fa3-e41c9d1195ac", "value": "12288:zD4VHfQe6ZyWshg+qbZxTZZWunAWv9z3M3Nafe410EQGMOcMdib/Waoal:zD4VHfQe6ZyWshg+qbZxTZZWunAWv53W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900930, "uuid": "7f1c9f29-fd5d-46d8-af41-fd951100bcb3", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900930, "uuid": "c9fd07b2-71f3-46a9-b676-28e35c584334", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900930, "uuid": "bfd85ef7-2759-488a-b7ba-ed837a1b1811", "value": "20212909.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb41c190-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900542, "uuid": "9e817770-0597-442b-a84b-6bfe2a23133d", "comment": "Malware payload (Dridex)", "value": "02c6936e19cbe48ee80504b237168846", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900542, "uuid": "6e0cb999-4be8-4cab-ac55-7f8166517060", "comment": "Malware payload (Dridex)", "value": "8d0e165b3087f8537e54dc7d6e0d227ed7d1d66b1dedf73beac4ea0cd5892e00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900542, "uuid": "5bab691a-d34d-48a4-85ab-66667c2dedef", "comment": "Malware payload (Dridex)", "value": "07950c7acf61e54dffca2613b5ecc872d9499019", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900542, "uuid": "e174b83b-7114-4cc1-91f6-240c155f5369", "comment": "Malware payload (Dridex)", "value": "33a16f48ce29fa7d4ad0842feb605a5306051bfaac4739bff4dfd103b4601632c522eecaccbe61bfd05e7e55462241be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900542, "uuid": "e2d7e783-44c6-4e28-a6b2-efe59d9e0ef4", "value": "T1F395E020EE69E1E6C6B89F3E9408352717F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900542, "uuid": "2871a9ed-6dff-4d1a-829c-09d9b61e019c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900542, "uuid": "bbaf8e30-00ea-4d2f-ab16-3af0358e0928", "value": "12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900542, "uuid": "2a077812-2ceb-4f62-8b52-2e8d633e70b3", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900542, "uuid": "63177dcb-671e-4378-b549-7d35b90bbb13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900542, "uuid": "21fa9374-88cc-4c29-ac5a-a4dc224da0c7", "value": "8d0e165b3087f8537e54dc7d6e0d227ed7d1d66b1dedf73beac4ea0cd5892e00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da80559-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632899928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899928, "uuid": "55033f53-3f0b-47ca-acc8-0db57e897ec9", "comment": "Malware payload (Dridex)", "value": "ae1d7411046dc28fcbd60f7a054729d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899928, "uuid": "22374816-fc52-4e2b-9ec3-b937e70e4112", "comment": "Malware payload (Dridex)", "value": "8d125c8cf25c0ecbbb20806f2aa0c3ea8a264a3bb76ab33620e99554087fc190", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899928, "uuid": "e810190d-ab4e-4888-94c9-ea9926756cc9", "comment": "Malware payload (Dridex)", "value": "b24202e3a98699816ddf6045a15ce524af383bb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899928, "uuid": "3a555740-06fc-435f-b74b-73018b9d5cab", "comment": "Malware payload (Dridex)", "value": "d32b984073d92ddbb32940d96d17f3339071f40a7c322f1224f8439a4350babc11ecf2b2691eeef45b7712b88e952b9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899928, "uuid": "df194b84-b2b5-4c94-88b1-c0bdcce6dec5", "value": "T18FF5E020EF69E1E6C6B89F3E9408352727B93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899928, "uuid": "87a6f617-0a53-4d01-99df-817852a21722", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899928, "uuid": "6c5955d0-af74-4f89-a733-6e7b0ffdf764", "value": "12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899928, "uuid": "bad5ed2d-2047-4782-a1fd-5657cd05ffef", "value": 3629056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899928, "uuid": "05bf46ec-9750-41b7-9d38-d86e0e54832f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899928, "uuid": "787a88a5-2f54-41b8-8557-d67a598d830f", "value": "8d125c8cf25c0ecbbb20806f2aa0c3ea8a264a3bb76ab33620e99554087fc190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ede626-212c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632923345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923345, "uuid": "26c26f3f-78a9-49cf-9a21-d03d1347f984", "comment": "Malware payload (RedLineStealer)", "value": "fad0d800e56ef91c12ce58d2dd26666f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923345, "uuid": "59895a9f-6f57-4eeb-8fc8-add7c861c2ad", "comment": "Malware payload (RedLineStealer)", "value": "8d3689555fe2d661aae711f0452288af2b4e4cdaecc3886964b3120872ae1fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923345, "uuid": "c1ba1400-d816-49e0-89aa-eb8c7ee72b78", "comment": "Malware payload (RedLineStealer)", "value": "a34bed980cad4ca8a4d399c5c587015b411b01af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923345, "uuid": "3502036d-af90-436d-9559-3a358acbe027", "comment": "Malware payload (RedLineStealer)", "value": "e7e53bd4012c0d0358ceffb3fe60a1692d03d91ee5fe85b9846dab36c4508ab5bb35bd9ad3644b9b3e6de1d784eefec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923345, "uuid": "00303eb6-525f-4474-be91-5391a7a586e7", "value": "T1C125F1422771CA25C7C42670B5F785288391DEA7F272B78F6F1E319868A23715D407EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923345, "uuid": "4af0af40-0bf7-43b1-8b2c-e87211e76a7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923345, "uuid": "a54e402f-5571-42f0-b7bf-d9d115dc9308", "value": "24576:4WuUFBKUzCedCXMv68wPXC7g6hvea4iy9Zmx93rgjU:nLFAUXdC8v68SSUevezi6mx938jU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632923345, "uuid": "a886de81-7d11-439d-9964-56c9d1019e5a", "value": 966096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632923345, "uuid": "746ecde5-a365-4721-9b4a-b4a5e049544f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923345, "uuid": "2b87c3c4-ec01-40a5-bf37-812f0ce7df0f", "value": "IMG_356537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609dfae7-2169-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949701, "uuid": "1b891eef-df5f-448f-b2f4-5bf3d2e8d3bd", "comment": "Malware payload", "value": "e0cf550900e033094805328f327df17d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949701, "uuid": "0b735f1c-750e-409b-82aa-797f2e4d73a0", "comment": "Malware payload", "value": "8d49f4d62f32381186bb74d032803832867dc89aa8b9f039db8417da8f721a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949701, "uuid": "0e99cba7-39e2-42c0-975e-5d4c83b71cd6", "comment": "Malware payload", "value": "2c9b10d43d9d526401d39fd79356b6941b9b187d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949701, "uuid": "6bf227e8-1720-4be9-8381-3ca499482fe3", "comment": "Malware payload", "value": "6a4fdb1e3c09338ec99ce558a309cb80cb26499d96773867b274f5cd09adfbefd9372cd3efbd0601d0f1793a97eceb08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949701, "uuid": "da56fec2-af1e-420d-9cf0-65a4356edbf1", "value": "T1C8E25C219388DBA3D71E5739442305C013FAE34B3533EF5EBEC861984AE7B556BA0593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949701, "uuid": "8785551b-ca09-42fd-b5f6-e134979f5928", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949701, "uuid": "13e93f72-35e4-402a-b552-1039fe8278c7", "value": "768:488JYPlEx7Zlu6PKIWLI8JSticI4dzJy6xi9UX:8CdEx7Zlu6PQLdstiaddo9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949701, "uuid": "77bf9bc7-1b54-473c-a41d-dcf1eb854967", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949701, "uuid": "fcd37482-f590-494a-aa32-04361c8fcd57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949701, "uuid": "4d3ed0e7-824e-4b18-9f24-92f55d1388e2", "value": "Payment Slips.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380c4716-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "4870775a-998e-49d8-bd3a-2b2346005b23", "comment": "Malware payload", "value": "2b9b4c7deb5c2863d0bfab12bd66795c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "84c41a7c-5d83-484a-b306-e3fc8379f596", "comment": "Malware payload", "value": "8dc65e5adee32fb1c0566ea999a22913d52b85ec7d57cf2ee74b8ddbf88a7663", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "9c5ea434-fb77-4cf5-9fde-03b6f2d150de", "comment": "Malware payload", "value": "5a907f1b7e6ba933036ac5af2a567ee7086c9e9e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "72412e8e-8d4f-4897-842d-f1bab9ea62d8", "comment": "Malware payload", "value": "32aa6d1246dd56c02733350db5b03b25e279a2239db8256204328b96f795de22401917504f80df22e80e564ec611f53d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "b151afcf-b558-45a9-a387-63bf57be8e7d", "value": "T183C3842E7E22BFBEE668863107F35F70879521D227919382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "ca1dcf66-d3a9-4170-b5e0-b2ffbd41b2c6", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeTEd3iIfrmW+IFj:Ted0W0MZQHnd3zfrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949204, "uuid": "a5a5f6c8-446d-445d-8da5-781f4651bc57", "value": 125968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949204, "uuid": "0ab99ff7-dd0a-43d2-b7ab-55cdb820a8b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "2631189d-d9c9-46c3-9512-d55e193b5f04", "value": "earyzq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fbc186-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632884772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884772, "uuid": "eab5acd3-b492-4215-8312-249164df8593", "comment": "Malware payload (RedLineStealer)", "value": "3d36f877680341511604f09550d7dd20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884772, "uuid": "8133cc09-8411-43f2-89c5-b538427bd7c0", "comment": "Malware payload (RedLineStealer)", "value": "8e0bf87628ea9c37fd9a0ca40fbbac0bf8d219f2f514efad2f63e0ba90cf7dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884772, "uuid": "9f773fe5-ba1a-4b2b-aee5-d8578a99b196", "comment": "Malware payload (RedLineStealer)", "value": "09efbeb35ec58e831ac58eeeac41947640d72a9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884772, "uuid": "6bb8241f-c38b-4d26-9381-3a6d567df611", "comment": "Malware payload (RedLineStealer)", "value": "0e9f826a52603af40bbb43d7ddd748eea43ebb4a75a1fd6a245d5adb1aeef96b84864c55749b8346e44d2c1d843a92ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884772, "uuid": "b0cd59bd-e87a-4922-b803-37ce70b91381", "value": "T12F04AE10B590D2B1C745013EA829CAECE53EB56DFBF05A373B9426DFAE782A37121351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884772, "uuid": "6d5407e6-a287-4cb3-a34e-ec45e724530a", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884772, "uuid": "06e7d5ef-1fdf-4e03-a6b6-cb6481ba529c", "value": "3072:ujkQUZ8dsDPCarNvnG8B1rcPI1ZeMy7BPqT8EuSzQz:ujwZPC2JGScPI1LIBPqFuSzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884772, "uuid": "d39289cb-04fb-46b2-bd56-5f5fad54410f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884772, "uuid": "7a5effe1-c959-4216-a641-8de181ff8116", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884772, "uuid": "8ede409b-b128-4910-9f98-8a217100dc74", "value": "3d36f877680341511604f09550d7dd20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31118569-20bf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632876607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876607, "uuid": "d13ea444-6658-4e92-a47e-1a8ed6cba592", "comment": "Malware payload (Mirai)", "value": "f6bf86afe7424f3c2b015384d974b98c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876607, "uuid": "0fb3432d-de3c-4e46-a2dc-1598f8346ec8", "comment": "Malware payload (Mirai)", "value": "8e1d447760d8eab615a69f9f69a1ccbb586e9eda9dda8926e6b608357f789a93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876607, "uuid": "b641114e-42b3-459d-bafd-f1c7deb5d9cd", "comment": "Malware payload (Mirai)", "value": "30a3506f1e7a184257dffd0119833a606999e41d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876607, "uuid": "d78edb8f-b9eb-4831-bb95-c4f3a756b18a", "comment": "Malware payload (Mirai)", "value": "8687590b02c4dc9b74ba6d3c158b524c6663eed181d93c09a2498ad3440afa4d2a5a8769964b2d13546271f3805cf8e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876607, "uuid": "59cc656a-f0b2-4e93-b044-4661fdac000c", "value": "T1B1130171141FB218FAB05CB97FAECCA873430FB8D6FD316154D856B8E6E0A4708A9913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876607, "uuid": "dc4f8ac6-5f98-4b0c-94a2-9ea04ae57a2a", "value": "768:YlA1z8mH9ppyAuDHmM+na9L8zXDr4o2tv9NaMe3bqs3Uozk:Ye1z8QppyAuLmM+U8fEo2tvLaMUnzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632876607, "uuid": "19783603-0977-4c4c-991e-176acf0b10ca", "value": 44000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632876607, "uuid": "2b8c018e-ba3c-4745-a613-1a32efb72141", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876607, "uuid": "a97cbe46-6366-485e-bbdb-fe9c1c29cec4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bfede3-2133-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632926680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926680, "uuid": "717f75df-649c-446c-9fb2-ee7f4ee8c8e3", "comment": "Malware payload (CobaltStrike)", "value": "ae2e3dc2c232a7513fc9bc82ee489617", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926680, "uuid": "43f66a7b-2e79-4105-9c32-7185a970563e", "comment": "Malware payload (CobaltStrike)", "value": "8e5fb57cda3b3eb6b8e66027d2efdc87bcb3b0463431106ec6db93e11200ffc8", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926680, "uuid": "df41d32b-7601-4531-b886-16480fa9ac8f", "comment": "Malware payload (CobaltStrike)", "value": "8029e69df9ddc8c44db6c32bfd0b5091f88a0bd0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926680, "uuid": "e192be90-1b56-438f-9fde-8ccb6c2b0d43", "comment": "Malware payload (CobaltStrike)", "value": "48ccf063e23c10b15f8aa01862194cb7ff8b1298e7c5f2fc14c73e42c542489215bef8ed61e31e1b7a559d9fe1a5c78c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926680, "uuid": "c8c5d26f-806a-4c35-8eb5-e5f0104fc914", "value": "T1CE45335AB1D31A20F17F443443A3A752B8B77740FB7661A407AED2BB5871FE8580CE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926680, "uuid": "af5d0328-6c73-4cb0-bae0-7e6cb16e770b", "value": "24576:ijyqlwU8sQi+bnJmQIEtKjvjjDSwloHniuL5CA77M1YOK96gE:4yCbAb9K7jjDSwlyo1YOY6gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632926680, "uuid": "186b2057-20af-48e7-b7ba-521adefbc462", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632926680, "uuid": "d6c04f2c-f50c-4963-973a-66986bbca8bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926680, "uuid": "c7b425cd-5dac-4e25-9329-d658f0eeb32a", "value": "host64_sh.bin.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcca903-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900519, "uuid": "ff477845-2d59-4e79-a806-baddaedeede3", "comment": "Malware payload (Dridex)", "value": "3c39881646b1ef50970e65d29d036b44", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900519, "uuid": "2124eb20-ac78-4d3b-a53b-67f95bf29dfd", "comment": "Malware payload (Dridex)", "value": "8e816954fb378dd51d13a00bea98c80c46d91a9c3199be628cd3272514c42a6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900519, "uuid": "d39b1af7-ed34-4aa1-b33b-6f4167008b51", "comment": "Malware payload (Dridex)", "value": "634e6fe03fa3be567a07dbd78a42ac3d4985f168", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900519, "uuid": "f740f8d9-f3f9-4e33-9824-c99fba13d35b", "comment": "Malware payload (Dridex)", "value": "d2c82012dff20ac1e42235bdef15c5542e7a24ef56d53d637653c4ee6778ccf12c9ae57aeb4e3f8e2ee815543e54e1a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900519, "uuid": "7991d030-1f08-4f65-829a-97c531b3e6d7", "value": "T1C2A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900519, "uuid": "10324b8b-c5d0-4178-b39d-2ff82e6f39bd", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900519, "uuid": "4b1f1df3-080e-4200-98d6-b925594b5c3b", "value": "12288:2VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:rfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900519, "uuid": "60e19ea7-9cec-48c3-9628-945775e81b9b", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900519, "uuid": "f511f654-ebb1-4985-ac11-59bcb14d8288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900519, "uuid": "a61a2821-902c-4954-8896-698a28c3a58a", "value": "8e816954fb378dd51d13a00bea98c80c46d91a9c3199be628cd3272514c42a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc149aac-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632899281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899281, "uuid": "f180db16-0ae3-423a-a0b0-040e9c61016b", "comment": "Malware payload (AgentTesla)", "value": "ac4c90528a2e19d809f5c990e846cc42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899281, "uuid": "ec6fbbbb-c716-43b8-8ca2-69289ff37e26", "comment": "Malware payload (AgentTesla)", "value": "8ebc0e8fa6f07dd4b811b2edefe9c447d913bc317ba0f072f9acb119996e291c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899281, "uuid": "04e4ce6e-c528-4773-8f4d-b409f7ee6dc6", "comment": "Malware payload (AgentTesla)", "value": "48b367058236a321ec4542d7d1712bdd8fade3bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899281, "uuid": "d185025e-c6c9-4339-910b-b76b2095f1ff", "comment": "Malware payload (AgentTesla)", "value": "8cc92cd70368771a2b6d426098f31863e66b8748a919be1c77b345ec4b0d53950413d2444f7f80786fc70bdebafe60eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899281, "uuid": "16252738-ab48-443d-b750-137e10e238a1", "value": "T15964222667D084F3F9C789725A323B35F2B3A80437A0B1C68B606F273A356D7145E5DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899281, "uuid": "d9238e2f-ada1-4b89-ac57-70ae7fe9e86e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899281, "uuid": "f06d6255-6761-4ba2-bbe5-c2999346533d", "value": "6144:F8LxBsSRZJtf+0dO9Ld4sjkfAjtTp/OrqrcdDfrdoKNy3cU8O:/SPfvd4aItT84uDfrdop3c1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899281, "uuid": "f9bf3f74-d3fd-47c8-9416-dffb58435c3d", "value": 309963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899281, "uuid": "2b78c19e-670c-4ec6-b0fd-c87b73f4539e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899281, "uuid": "fc652774-757e-4df2-b8fb-f8ee1fe675f3", "value": "ac4c90528a2e19d809f5c990e846cc42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98558efe-210c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632909852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909852, "uuid": "fbc4bad5-25ce-4c08-997f-b960d0f932d7", "comment": "Malware payload (Mirai)", "value": "0cd534ceea8eb50a2773ef39b2a77eba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909852, "uuid": "dc384335-28fa-4307-bf79-d2b4c8030bc0", "comment": "Malware payload (Mirai)", "value": "8eda81766b29001189ac096d23d4562965c0fb7c6505f11d676a7a0e3c50a855", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909852, "uuid": "d1a7f40c-2da7-4e85-be7f-f4cc6747efd7", "comment": "Malware payload (Mirai)", "value": "187adc247b5ae50fa97b95510cb7b7ec0a00526c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909852, "uuid": "f2444683-4319-46ef-82e6-e7f8c3b4c6a6", "comment": "Malware payload (Mirai)", "value": "5e10502f9e4de164348baabdb5826744ea0c06064c74b56581b363a9f9a982c64fdfe6a6f1e95d1fb4f53f4e56e6a8c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909852, "uuid": "0c2c67f0-733b-48cd-bda4-1bfb616c8a74", "value": "T16793950D6E258F7CFBAD823547B78E219A4833D636D1C585D15CEA022EB024E345BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909852, "uuid": "113530eb-404f-498d-bbbe-261243312b97", "value": "1536:l7zmUFGb9hHxi0PfF7HA1ffoffzbffr9MZBoof6dM92GwcIqhPWHhykTMHcYc0EB:p29hHxiQAMO6dEtehykTMHlc0E+o3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909852, "uuid": "b3405d12-6a37-4445-9e22-cd0f95fa8060", "value": 97448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909852, "uuid": "cfa6e3c8-6fd7-4f9d-bcd2-3adfb8d4771f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909852, "uuid": "a38a34ac-2fff-47f8-82f8-1fa570d64c1e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6970d46-20ef-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632897447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897447, "uuid": "ed56eaca-63dd-45f0-b889-6b45e2060a15", "comment": "Malware payload (SakulaRAT)", "value": "ba63dedd9e3fae4c3cd2b2defb711c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897447, "uuid": "4c345800-fcb4-492d-a26e-840be1bb46ed", "comment": "Malware payload (SakulaRAT)", "value": "8eef5c426b596685679e56f311c012e499c8b67ec2f26847af1e1b1b8730b467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897447, "uuid": "8c1f435e-005b-4eec-990a-78a7b8333504", "comment": "Malware payload (SakulaRAT)", "value": "ca2c1d00ecbd7e34d4dc08833352d580c6cc3a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897447, "uuid": "2fe10f76-23cc-452d-82a7-1514e0c0614e", "comment": "Malware payload (SakulaRAT)", "value": "e5c64896e31a794d343ee6cecc16c0b200446941479751cff27a666b4bd1cd27f491d76af548fd33f9e71c990e26c174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897447, "uuid": "dba6ac9d-5af5-41b0-af03-f6bcb38e2174", "value": "T13A26A21173F90895F2F3AB30AEB181555B36BDA59EF6C62E3144428E0D76A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897447, "uuid": "51f8f8dc-7f1f-481e-b094-43773223ca20", "value": "539502771da573641ecc7f6497e39f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897447, "uuid": "9cfece0e-f2a2-4039-be16-c511fbbcf3ec", "value": "24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYD:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897447, "uuid": "7532badd-a7a0-4dff-8232-071636b69d6f", "value": 4694016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897447, "uuid": "4b72547f-ea91-4e0e-b62e-b8d67da96ac7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897447, "uuid": "03d21d04-193c-4ed7-9467-2d96b33dc744", "value": "8eef5c426b596685679e56f311c012e499c8b67ec2f26847af1e1b1b8730b467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d99efee-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632901968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901968, "uuid": "416bf243-fc62-49b9-9ea3-8614d31debb4", "comment": "Malware payload (RemcosRAT)", "value": "ee7d9288b5a8598455d560126c47b1fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901968, "uuid": "6fcfa17e-169c-45b6-a592-25bf436d1baa", "comment": "Malware payload (RemcosRAT)", "value": "8f8069117493bce950c1257cda7f27b7f4b1ba037fe9c432988c89d4fdd16ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901968, "uuid": "87950050-52d3-4869-9b0f-9acd5e548973", "comment": "Malware payload (RemcosRAT)", "value": "a57f4652c26008b9e6d7df79a8812351b1d89fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901968, "uuid": "7b44b808-e0ac-4360-8533-bad4110aaeb1", "comment": "Malware payload (RemcosRAT)", "value": "38eb54e6aea685ba764de21943d31199c7c1ae0f409beec298c083c281d88cac156e7876a9fcc5bd4a73377d14f9101f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901968, "uuid": "085770a5-ecb5-462a-a3bd-e40cb67a73ae", "value": "T107D3F1007657D3A2E9D23A3B4518065993B6E300766BAB2F388C327DCE573D63B615EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901968, "uuid": "7f1c9d9d-63b5-425e-9b12-9ef23a84e4be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901968, "uuid": "ec2529cd-a56a-4241-ba27-9974b537d86e", "value": "1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKk:xPd4n/M+WLcilrpgGH/GwY87mVmIXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901968, "uuid": "a5844c24-a0c3-4272-87e9-246c90df9e2f", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901968, "uuid": "d6498a75-5fed-4d6a-b674-ad1ed8381887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901968, "uuid": "17d773a1-db7d-4696-9f80-8ccb7aefe75a", "value": "8f8069117493bce950c1257cda7f27b7f4b1ba037fe9c432988c89d4fdd16ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35de19c-2166-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632948605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948605, "uuid": "b28708df-a63c-4089-9867-47ddd2669919", "comment": "Malware payload (Mirai)", "value": "b33022b1bf0fe5f146f2c13bcc3a229d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948605, "uuid": "dc65b672-f17d-42d6-9e35-42140756e9dc", "comment": "Malware payload (Mirai)", "value": "8f810be80e6d99f02f678f470cdc91f6b3cc7ca47803ce9a5125c9e80228f727", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948605, "uuid": "cfd9ef1e-9a47-4a7c-a9ba-f71a3465f23d", "comment": "Malware payload (Mirai)", "value": "0dc757942886c7145fba7b7188bcfc8dfe9f393a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948605, "uuid": "aee4ad52-1baf-4385-8b18-104c9ac24cea", "comment": "Malware payload (Mirai)", "value": "ba5c0ed2a11cbe14b01d4abdd586bf06cf9d7bd2ccc855429ba580582ecaeb6de7f3c6d6b6b3307793bab1c36aba7f37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948605, "uuid": "786c3bb0-2f3c-4d90-9681-464dd02aff3f", "value": "T1F723024E0231E02145FA5979D2B181414FDF16BC02BE30FB97749296E268AD31EB9FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948605, "uuid": "d37bcc6e-a23b-42ce-a862-e0885ad0c4a4", "value": "768:OHq8Y4hmGAsm4njygfcvNVzRfX27RhpujNs9q3UELMyBZ25Z7X30k0:OHq88GA8eljRed7ubLMHFr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632948605, "uuid": "b8805847-8535-4220-9909-42c3e809c8f7", "value": 46876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632948605, "uuid": "bc296524-9242-49b0-9308-9a875fc05474", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948605, "uuid": "525520e2-4efa-4845-b019-871cc677f5c1", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494ddf27-2124-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632920027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920027, "uuid": "73cbcc12-9cf5-48c7-b22a-e127a68b1782", "comment": "Malware payload (AgentTesla)", "value": "f15f79e479aae285d57f244ccd2f52fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920027, "uuid": "21d099f9-2188-4917-a936-129b7df46ee3", "comment": "Malware payload (AgentTesla)", "value": "900c66919f1aefd5e5a3048a4b33eb0377af4d6aa0a6062571bc3dceff1f3330", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920027, "uuid": "a9e22eb0-78d7-42c9-a2ef-0e805ca0a562", "comment": "Malware payload (AgentTesla)", "value": "b514f6782ce8ddbdfa28d2408c63130ff6a99248", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920027, "uuid": "3e439701-e4c8-4dd9-b0f9-c9fce6509fb9", "comment": "Malware payload (AgentTesla)", "value": "2b4f0ce6843878e9b42b5ea8704c0b71211452f5de960f4d2c88c1493e75a6cebaf309dfb878fc23adf8a8d777d2c31b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920027, "uuid": "aa9dcca8-bd04-4d2d-9b52-0355776ca9dc", "value": "T179B402235A3C69D3E86A64B165630ADFF6B06C389B614863720EBE374C74347C90F56E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920027, "uuid": "ea2dca9b-9589-4e8f-9a40-76015a3847bb", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920027, "uuid": "529d9439-7954-4a16-a8ab-ad6aee8e67f9", "value": "12288:psfDsUg10etIAZ0uY/2WAF7aX46Jc34jD8A:6408IAZ032Wk27c3i8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632920027, "uuid": "ac5df612-721b-45cc-b8c0-e4d52c96f3fe", "value": 526140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632920027, "uuid": "f3486e11-c201-4568-b844-7d8e49e491d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920027, "uuid": "ad1d908d-e565-445d-935e-c0dcbe2454dc", "value": "PO#1135 - \u88d5\u5049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5d0fb4-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1632898368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898368, "uuid": "07880213-1e04-40c7-b73f-59efb4b4cef0", "comment": "Malware payload (DanaBot)", "value": "74c14461a494eba92f7dda5fce0ed6c9", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898368, "uuid": "b7aba733-ef0b-40fc-9e20-693e7bc080e4", "comment": "Malware payload (DanaBot)", "value": "904c63c6ba6f054301ea872def5eef9e3530062f3adbea45c69f9c3a79b11911", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898368, "uuid": "f03dd34d-fc88-4d63-ab9f-4dcd12dab60e", "comment": "Malware payload (DanaBot)", "value": "7affc5a2dc489ba175b3d1e0c5463fe8f6803537", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898368, "uuid": "b1ce912d-8e96-4705-a649-302196729bed", "comment": "Malware payload (DanaBot)", "value": "f208ea30d9285854736fb01c17ae1f339e7330110920fb917a3837a4c00976793fea4f11789d3f7507ce34baf5ab8cc4", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898368, "uuid": "e640df29-a6c3-4fef-aa97-73ad0f33eb64", "value": "T1263512106BD1C035E5B323B588F9D3B8B92D3EB1672890CB61D597E99A356D0EC32393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898368, "uuid": "29763420-0483-4e49-be8e-ddfb81e6df72", "value": "1435fac27cb0e146b6806556c822ef8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898368, "uuid": "8f93425a-3450-4c7d-875f-76f36bc05b99", "value": "24576:K6CYbEuF5IwwHccyCuixFq6lDWDOUjFvUcgFVOa5dCDUyM4MlTZLXggT:PFGEinXWDxJvUcgFUgYDjMVlNLXrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898368, "uuid": "7d1135f8-e292-4da6-8d79-cc1ab8061bf9", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898368, "uuid": "4ebebe82-c57e-467c-9948-8a1797f2a36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898368, "uuid": "b1bf722a-a2e8-4aa9-ac65-b30c98ccf753", "value": "74c14461a494eba92f7dda5fce0ed6c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f6cc0f-2148-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632935570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935570, "uuid": "da0d4220-77dd-4ff0-9e07-9970c27eb38a", "comment": "Malware payload (Gafgyt)", "value": "da94dba21ba91fa91509fc30999a287c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935570, "uuid": "cc8fc704-326d-4a15-95bf-d5dd663136fb", "comment": "Malware payload (Gafgyt)", "value": "905379ed811eb90987362daaf8b8f35226ac6617f1d5dd994700369739659e8d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935570, "uuid": "abb8e266-64ec-4722-9e1b-0c9e3d0739fe", "comment": "Malware payload (Gafgyt)", "value": "cab02131546a06a1bac8309eb4255527ce290b57", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935570, "uuid": "4d29d551-1cdc-4f0e-842c-79fb85e92d0a", "comment": "Malware payload (Gafgyt)", "value": "40dfd44c508a8330a9313876e5f569ef313b58e2d0883540efe225061a2e2a4758e9e6520d236a9eea96ec9433165e54", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935570, "uuid": "675416b3-5dd3-45db-819c-c41204ca9efd", "value": "T146D34A27B6E98DFBC05752B02EDF8AA29521F4FD0B32712733D46D902F6D9C54928A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935570, "uuid": "f1d5d347-3984-464c-a92d-c49122b2ca9a", "value": "3072:kcB5V4FlMdeoqw/rcqvmiKEOWm4t+5BphaY4dd9Jty2FUQmDoud2FHGtJogq:sgoquEOWRSphaYod9ydQmDoud2FmtJoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632935570, "uuid": "1a038d5b-c92d-49eb-ab11-bf6d58b54de1", "value": 141450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632935570, "uuid": "19a4f58f-312e-416e-aa87-50efd05455ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935570, "uuid": "db81973b-a846-40bb-a44d-a82e5bea0226", "value": "da94dba21ba91fa91509fc30999a287c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1906072d-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632898471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898471, "uuid": "2dbe666d-3a33-4e3f-ba8d-01051779834a", "comment": "Malware payload", "value": "f5aaa59dcf5248f1bb8d5c9c341dd099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898471, "uuid": "c7bf565c-7804-4e1f-8996-f2bbc9b9b91f", "comment": "Malware payload", "value": "91ea745f59acc680f6156594bdf7dda6b056e82160193f912b3cd7121b0f9e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898471, "uuid": "ec2e5e0a-a797-4332-9886-c57fa767581c", "comment": "Malware payload", "value": "55ad64fb0e6e512cfafaa73a64656acadb02004c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898471, "uuid": "e5263b76-b75c-400c-9c19-3857cd23b8b3", "comment": "Malware payload", "value": "a40168e38a6d003b0255001524e633b84056cccea5b654328fe5be9856d41c82a36db3499f5c0328a513c08ede579c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898471, "uuid": "1ca58b40-8e44-4490-8854-7483e4d01af8", "value": "T15104071A7550D093C7D132304FB5D9B66BF49D180891AA0737E87FAF36FF6834A0AA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898471, "uuid": "c22da9d8-6839-43cb-a7e4-771e133aa980", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898471, "uuid": "8340d8b4-0366-401d-8236-8f9097c18e2d", "value": "768:CsmG6ZXDU8J1+cp68XHu/zwvW9DTGBKYMndHfNIfNOuauIEdKOcjxWvZy7c:XBkTL+cpRX4tToxMndVOOenc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898471, "uuid": "352ac9e5-5899-44c3-915f-2de9e0bead11", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898471, "uuid": "b121266e-abc9-4b5b-8c27-195c23303d51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898471, "uuid": "173a124c-fb8d-48bd-b501-11edd49910de", "value": "f5aaa59dcf5248f1bb8d5c9c341dd099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aa3aaf-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1632898979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898979, "uuid": "25180bb2-9eee-400c-b2f1-d0fb30cec073", "comment": "Malware payload (DanaBot)", "value": "1814662fda4a0aa4816c124a0fa12002", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898979, "uuid": "91760595-a1e4-406e-9e92-0b26d4bbf28c", "comment": "Malware payload (DanaBot)", "value": "92882d39873b86b9febece1c865a245aabdd7d5c44da54931d25a6e3d9e25670", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898979, "uuid": "d0a1a15e-779b-4095-904c-c672d7776912", "comment": "Malware payload (DanaBot)", "value": "5f3f2dc414946a35e10bc70155ab2014024ce465", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898979, "uuid": "e793c33c-db25-43be-ae41-744f74872b2e", "comment": "Malware payload (DanaBot)", "value": "e95273b997b48961c3245c2083351a79b5a79326dc00855d5900f4311572d869c273f9802e70794561be36d282ddad4d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898979, "uuid": "e91e8a95-ce2d-46e3-b974-b5d0095cd6dc", "value": "T129263341B7C1D87BF2DE42362C61BBAA48E664554B61D3293A857B483B3C5D22C0DF2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898979, "uuid": "42c615d4-8826-4817-b941-f1fb427a0e00", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898979, "uuid": "e645a5d2-bd14-4ce6-b587-2d0859e25aa8", "value": "98304:9ZKagY6llt6YTg5Wcc9G/CfgEgZEKZd/Xu5lZD6/+hZXkRIPL4gU4l+:94eg6qcPCfgEgiKu5DrXKIPL4gUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898979, "uuid": "7d2660b1-a95d-4a9e-873d-6840e08a95b9", "value": 4604128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898979, "uuid": "739aa10a-ad2f-44a3-bd4c-3b6334e3faf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898979, "uuid": "fcf90349-b459-42e1-bc46-b25436f04c6a", "value": "1814662fda4a0aa4816c124a0fa12002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378a84fc-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "ae2c8073-ff04-4714-aad9-c91a3f3b9939", "comment": "Malware payload", "value": "e5e4b6f2414a80646fe0e89e94282a74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "432622fa-86d5-4911-b9bd-43a75d405ec2", "comment": "Malware payload", "value": "928aa4c414bcb7a5fc4b3cb41e1e9d5e75cd54c55562812780baa4814cc36d11", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "cee54d35-2bc3-4c52-bb3f-a839f74f6f75", "comment": "Malware payload", "value": "64c0ecf782667393bb1ae0780b90bfc8831705e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "1c71fbbf-1cad-4afc-929f-2717c0bb881b", "comment": "Malware payload", "value": "d61f031efa285313ac7f4adbfb7363ed13530ac64bb7001faa9c784c427b69ce9b221ae20d337603b4765792eff8feb6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "fd89501c-0bbf-4e9c-9c43-f785df8eb38d", "value": "T1D0C3945BBB618EB7D81FDE33059A4902108DE58A12D96F6FB2B0C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "2be3cc24-cdf1-4638-a513-74930c1b6874", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpQ+DsrmW+IFB1Df11hR/:/UyLqAmgMJM8Eq+DsrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949203, "uuid": "65602ce5-edc2-4fc1-bf08-32b2ae0401f1", "value": 126048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949203, "uuid": "96a2949e-f0a1-42fb-8492-4946a83372f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "f8066314-948c-49ee-8844-e9ef0f3352d7", "value": "cemtop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b053a87-20e1-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1632891307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891307, "uuid": "42bebf42-bce2-443e-907f-c441fbec19e7", "comment": "Malware payload (a310Logger)", "value": "985dbcc380026129bcd1807ba73c1072", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891307, "uuid": "8d5b3cb6-fbf3-419d-81ee-10fa68319818", "comment": "Malware payload (a310Logger)", "value": "9295e25f8d2faace30d36a7497aa48df5bc44de15cee22fc6b1e4233e3c50c50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891307, "uuid": "560c1571-5bbe-494e-a523-9e6c109be448", "comment": "Malware payload (a310Logger)", "value": "9c815e486f48d6a09e29d9d8575a6d1dd5dd9248", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891307, "uuid": "248333d0-6423-43a6-845c-7bcce7321fc7", "comment": "Malware payload (a310Logger)", "value": "3314e5ec9aa6f5ac0b3e2738e23d34d4a838421b636802d8c1fbb8b7b1e7cecc017c2c43b1a666794b7e8ac1dd9f6db0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891307, "uuid": "7201f28d-295e-4614-a116-17db60e0e831", "value": "T14C658B1C7A0A1AB6FC9DD830C9196A05BB660F0727E0BAD257DB15CB974F1FA2D04F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891307, "uuid": "1ade4345-3add-45c4-af5e-f842a3d8fa8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891307, "uuid": "5784900b-b6e4-451e-b29c-8be20d113a17", "value": "24576:4Dy3BNfIol/MUJHAtd9STrlIOn4vaxosZT25oIkjH4GJyGNFa4gfnv:42NfIojZAT9C/4vaxPT5ICZJ77a4En", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632891307, "uuid": "525963c1-56d1-44cc-998e-8880418afd31", "value": 1413632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632891307, "uuid": "ace6870e-7f13-4efb-9116-a038c7d297fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891307, "uuid": "99f179af-0d32-475c-ad7f-70e36ac4de6e", "value": "985dbcc380026129bcd1807ba73c1072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940112ca-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632908985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908985, "uuid": "f5daa852-9d2c-4eec-9556-4839c83eaef7", "comment": "Malware payload (Loki)", "value": "a4d11a86003f66f24a3a9b7f4889574e", "object_relation": "md5", "Tag": [ { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908985, "uuid": "6397d90a-58ce-4f8b-bfbb-ffc4c479e74d", "comment": "Malware payload (Loki)", "value": "929cf24f9b6ba0c9a1eac923be18c9de7fef3f7de33d79829ea6fa98b0344822", "object_relation": "sha256", "Tag": [ { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908985, "uuid": "d32e36ca-4417-4b5c-804d-40850c6472ff", "comment": "Malware payload (Loki)", "value": "8b185d4437cb9391b81202aeb295b341202879b4", "object_relation": "sha1", "Tag": [ { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908985, "uuid": "101dc050-a8c5-4329-8f1e-6d2f7220d972", "comment": "Malware payload (Loki)", "value": "76e1e27601a42df64d1b98effaadb5226444c3c4cce933c489d12ac431d52756673f4f76a7d3c95b2ee1dac2f0a3f48a", "object_relation": "sha3-384", "Tag": [ { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908985, "uuid": "e509d716-4d44-4a2a-a927-e005c30e721b", "value": "T16CD46C59F61CE29EFD0903B022297CC415EC0CAD197CF927BEA6B5E230AED7551F109A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908985, "uuid": "98da9d85-e921-437e-8a18-289d396554d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908985, "uuid": "fb37b0a4-936f-4f65-bf25-e42571c9afd2", "value": "12288:zD4VHfQe6ZyWshg+qbZxTZZWunAWvKFUQ8gukUWA7fKsTzae7I3PueQdfw3E3687:zD4VHfQe6ZyWshg+qbZxTZZWunAWvAu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908985, "uuid": "5c3f3ba7-2e13-4a9b-961f-de07e7cc3192", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908985, "uuid": "1c45c819-4b3c-4329-a0a1-982442cb68dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908985, "uuid": "d00d3ee2-6973-4851-bbe1-4c5bf6be97c4", "value": "Obavestenje o prilivu za 00653\u00b7647839\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70956ef4-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632899906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899906, "uuid": "8c794570-4991-415c-99a4-d12f382b6e14", "comment": "Malware payload (SakulaRAT)", "value": "4e7155bd7afbb888e41128b78413855b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899906, "uuid": "51eda6b4-42dc-4d9d-8b1f-6d69c66ae5cf", "comment": "Malware payload (SakulaRAT)", "value": "932249c923c8f7977c12785238e68d4b2030471fc9edbda0ec326ced3bab755f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899906, "uuid": "61c0c915-1155-4fd3-8311-364c46aa919e", "comment": "Malware payload (SakulaRAT)", "value": "8387ad1ee24852185eb9dd265987ae39fa0254d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899906, "uuid": "707cda1c-01d8-4b19-bd55-16b5862ea18a", "comment": "Malware payload (SakulaRAT)", "value": "4f8b895dd826107f4586db3aa7362fd8d4566315851040782ecc451c53a0118a22ddb34feda749075b8b02c959718a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899906, "uuid": "44790443-8980-4c9c-9056-1d83f5d62c1c", "value": "T15206D51173F94985F2F3AB30ADB081555B36BDA99EF6C62E3144428D1E72A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899906, "uuid": "4bae940b-ee55-4fa9-936c-f335b0791cb5", "value": "4511896d043677e4ab4578dc5bcab5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899906, "uuid": "90afe48e-1092-408e-819d-df4c55eb1e40", "value": "49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTIN:oU6eUNZZJHsH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899906, "uuid": "4707e68f-44d0-4a7a-8cc1-1514459dd26e", "value": 3801088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899906, "uuid": "7bfd23bb-71f7-4416-9476-4d7b057a4538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899906, "uuid": "667f0bd8-0a82-4de7-9851-6f7924f8ab41", "value": "932249c923c8f7977c12785238e68d4b2030471fc9edbda0ec326ced3bab755f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a791c802-211d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632917179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917179, "uuid": "d1a942c1-80b1-4491-ac32-00739e44a1f3", "comment": "Malware payload (RedLineStealer)", "value": "a517c307af008fca4fcd6caff59aa809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917179, "uuid": "9860851f-4d8e-426d-9808-8cc6995f16bb", "comment": "Malware payload (RedLineStealer)", "value": "9351b3d3a5b780220b67f06c7cb9b8d49a95055f6aa0934b733b0208458cfa6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917179, "uuid": "2bc361a8-ead5-4e8e-a866-4e57c5469f8f", "comment": "Malware payload (RedLineStealer)", "value": "69e9cd85861a4d57652d52721536eb65f6cbf215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917179, "uuid": "e5494b2e-8b52-4f73-95ca-ed56832ff8b9", "comment": "Malware payload (RedLineStealer)", "value": "bb5784bba8fc6f4818d23ea34448462d68683f89f3ac090be945b17fd7a94d10904a381320ae68fa1228fd7065ac6ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917179, "uuid": "9e0bc64b-216d-4b57-8e4a-21c317e05747", "value": "T12854D010E540C3EAC306067EA865CBDCD92DB94DFBF06A363B9426CF6E791A37121352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917179, "uuid": "ac90af85-762f-4087-b1fe-042b55df43ce", "value": "f249badb491e7862c803d80af2d74342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917179, "uuid": "c56a0475-4fa1-4dbd-87ee-d80bc0b95d13", "value": "6144:d1b0y38YMfytbTS/7VcgUMzHLcPI1ouSzy:713vMKlTU84YI1Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632917179, "uuid": "2edbec7b-31a1-4f71-ac54-0664ecec722b", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632917179, "uuid": "f04fad3d-b126-4a42-af36-1c84d767033a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917179, "uuid": "e57748d8-192a-47d2-936f-80c37335164e", "value": "9351b3d3a5b780220b67f06c7cb9b8d49a95055f6aa09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a716ed09-20ea-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632895273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632895273, "uuid": "aaf91914-fa77-48e7-8064-0d185ac9605e", "comment": "Malware payload (AgentTesla)", "value": "f7d9c26763c1c4878f424fb4576d0c29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632895273, "uuid": "8f0d6ae3-9339-403b-8e13-40dbb28cee6b", "comment": "Malware payload (AgentTesla)", "value": "93fad7701df9ff93bd4099e35acf33ccaea74bc1dff47fb2920991b6959f98bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632895273, "uuid": "7b17d65e-aa46-4c78-94d2-e6001a22704d", "comment": "Malware payload (AgentTesla)", "value": "dfedf42ba24d94e0772e71fde8b4f12cd607bbf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632895273, "uuid": "9bd10f49-61b5-4f79-97d6-3304c2f8e475", "comment": "Malware payload (AgentTesla)", "value": "5038be08e3a6a36f96cbc95740fab7f326915119bff6689beb9da421274d990ae0b599e48d58663d58beac048b215640", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632895273, "uuid": "0e0f95b7-0a7e-4841-a12c-8549170f6a3c", "value": "T126D33842B7C89711C41456B5C4EB573903F3E98B77B3D2853A488AEA0E017E8DE89BDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632895273, "uuid": "b41673ba-045e-4946-abb9-ca428d9e3c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632895273, "uuid": "25708835-f090-4e0a-a3f9-ac122df86aaa", "value": "3072:rYtisv6M+7W8KZNl+5MLZy+oYS0h0CTXYmvFMQ4b1LfU:rYtbvr+7W8E0jYS0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632895273, "uuid": "48b4d497-d2de-47cc-b639-be7ad4e825bc", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632895273, "uuid": "3372095c-ad41-409e-9cfc-a2f7c1d07ebd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632895273, "uuid": "30e657d7-f486-4281-8d26-3384548739ff", "value": "P-list - PO SO-203 (1st Container).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b1c035-211a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632916021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916021, "uuid": "1d5fff8f-4dfe-47c0-b3c1-0552f52190f4", "comment": "Malware payload (RedLineStealer)", "value": "d253aba64cc5370cd806ea862a11c2dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916021, "uuid": "09571dfb-b582-4862-9616-c54e17d459d7", "comment": "Malware payload (RedLineStealer)", "value": "950bfa5ec6f7e8987aeb2bc6584d18bd3ef83942aa73c3c42faa9389030f0691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916021, "uuid": "fe722893-79c3-4b9f-acb6-abd6a5e55ce1", "comment": "Malware payload (RedLineStealer)", "value": "29379ba2e2c6f857aec730ce4cf28ea0bb21d54a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632916021, "uuid": "23a89e70-a592-431a-8049-4728f52bcff1", "comment": "Malware payload (RedLineStealer)", "value": "bc6ebb5b44e0e6f06bf907c76546bb7ba4e7a7a22fa2a6cf7fadabae45d8575c086ec47fc4c169bd6e2bdfaad87a388a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916021, "uuid": "3425e7bb-4569-404d-91ab-f21842e560d8", "value": "T1B754F120E150EAF1C74641BFA851C6DCE52C795CFBE1A6372B581AEF6E7C263B224305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916021, "uuid": "1fa88dac-724d-4cfb-aa3d-f4746729e14a", "value": "f249badb491e7862c803d80af2d74342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916021, "uuid": "2503de29-38ff-4674-9400-1046bf6cd66e", "value": "6144:Th6zLM3uH11sWpyNtW1Gd0gyqrsdTcPI15+XUuSzy:F6zL7H11pMm1K8IeAI15+XQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632916021, "uuid": "f4035311-f7c2-4020-b2fa-4eb5bc2126dd", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632916021, "uuid": "ff76e6bc-5300-4f02-8f22-45da1a91efd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632916021, "uuid": "8ed57e17-4a27-4ed0-b7aa-d25360b54c7f", "value": "d253aba64cc5370cd806ea862a11c2dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb1402b-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1632899368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899368, "uuid": "f1c6ad1a-5a6b-418f-93b9-c87c98a782e0", "comment": "Malware payload (TrickBot)", "value": "9a64d2aee38e1bc2df9cad75962a1301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899368, "uuid": "2437416f-e570-4d2b-a509-654a78386716", "comment": "Malware payload (TrickBot)", "value": "95b999ce29d2e82dfe33e33261634d449466671debf78c2ebb4747e3434a1d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899368, "uuid": "9375e081-5781-4625-b590-d7558be07056", "comment": "Malware payload (TrickBot)", "value": "36e5249ee17f6a8704278a6aef2e2d59f0846934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899368, "uuid": "a522a456-2ff1-4342-903c-4aa72a341303", "comment": "Malware payload (TrickBot)", "value": "8544954057abd3a8b0b219cb6a80ed6d9b338ceb15a564780e21edbeac49a6c20be669733c6e5eabef2f5aaae7f1f878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899368, "uuid": "e5203e89-a60f-494c-976c-4abbdaab4adf", "value": "T113B4E0213181C031E5A310758EFAE7BA9E6EBD30175164DB7BD43A2F4F25AD1BA3424E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899368, "uuid": "91cb8c5c-7acb-49da-bb80-87a94f847232", "value": "edc289e000b8972f5dc69ab59ef219f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899368, "uuid": "9adfe66a-4d64-4df5-9e1e-ffce334ae707", "value": "6144:V6ZlxMlN8qVY0rbGdW5boVMd3AqEiAqqhYOtRF5498DF06YjnU9ZEF:k94vY0r6d4boQAqPGRRFK9e06BHEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899368, "uuid": "f0456404-c1a0-42a7-b61c-1067bcff79df", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899368, "uuid": "7cadffc6-30c4-42ed-9203-f341e34f248a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899368, "uuid": "de21951b-7baf-44a8-bac2-2cb1a97fb4a4", "value": "9a64d2aee38e1bc2df9cad75962a1301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d237b17-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632896492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896492, "uuid": "19e40812-0fa5-445c-95ca-53ff0a3f6ce0", "comment": "Malware payload", "value": "0d2b55984c139a877edf7da2e50ba1d6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896492, "uuid": "93ef587b-dd7d-4cea-b552-94db836c937e", "comment": "Malware payload", "value": "95eebe3aee67a21ae1a73a37612740f589c7c015cad6dd5a6fb73f8c7f05f619", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896492, "uuid": "a626b194-42ef-4a83-8073-c574b2d8aee8", "comment": "Malware payload", "value": "3f07a5d368baaf66fcd3994edc5a262ae9cec164", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896492, "uuid": "7324c82a-6f17-4701-b94e-e4e551d567ee", "comment": "Malware payload", "value": "1e7a38b1adc8dd9af14e45365e67dfb30c8db0ee157e0f3c9033b25205358560066afafbe32ba1d4c7f3bcc964dee499", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896492, "uuid": "307fb4da-c52a-4888-ba72-dbab0a2f0942", "value": "T1A0C4AFD458DA80A6B98105DDD9C0F44D9820FED1355FDE28C7AECC73AE596F8AEC408B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896492, "uuid": "83199277-95d5-4750-992d-0d2450db23f0", "value": "12288:1////////////////////////////////////2EssndzFHRsU0:vRsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896492, "uuid": "8d97b457-c696-4fb4-a3d2-1095f84e193c", "value": 549275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896492, "uuid": "419f8695-ab88-4790-a9e1-46dce287975c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896492, "uuid": "4e97af99-fe33-42bd-9e4d-f9362ff0431e", "value": "V.2101.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599ac869-2159-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632942818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942818, "uuid": "722ed4ac-5320-44dd-91f5-831f8688db98", "comment": "Malware payload (Mirai)", "value": "a7a68f20719a686badeb8decb6e2a965", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942818, "uuid": "fcb75b78-9feb-4122-990d-4ceb3990e137", "comment": "Malware payload (Mirai)", "value": "96456becfed2886714f33998a69574855a80d5dfc42af195a0327bca24c30240", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942818, "uuid": "6ce79cdb-81fd-4adf-b49d-24ec2b25e3dd", "comment": "Malware payload (Mirai)", "value": "d314108755127b2fa7026541c4f5c605da4ae5d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942818, "uuid": "a1d03973-1956-481f-a09e-b2ba87de5d38", "comment": "Malware payload (Mirai)", "value": "ac1717401bc188e4414b30b0813162098a271b67c89750c5853128ddf554078c5075d6e37b55fd51b26252da05546074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942818, "uuid": "9a5414d4-5660-4573-a845-149f13ef1143", "value": "T1B5534BD9B401DE7CF85BEABE4416490AF921635165A30F27A3ABFDC3AC731A89C13D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942818, "uuid": "b77dcd12-1e4a-4215-a698-528ff396146b", "value": "1536:WAqFmx7fQr0E8cpIe4KW1+wPa2xj8K+Itn8z:WASpbdW8wyo+24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632942818, "uuid": "11498356-2466-4fab-9d46-e65c8bd4f28f", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632942818, "uuid": "e9025833-e3f4-48f4-ad95-aee451284192", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942818, "uuid": "73787761-a8a3-420c-a371-dbb377af0310", "value": "a7a68f20719a686badeb8decb6e2a965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd98c02-20db-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632888653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888653, "uuid": "12283a6f-79d5-4aed-a444-189934d23c36", "comment": "Malware payload (ArkeiStealer)", "value": "c54477451f4a6fd3bbb6adff301fa84f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888653, "uuid": "d9f5ae90-e63b-4c50-aa6a-f17e029691f3", "comment": "Malware payload (ArkeiStealer)", "value": "96458b37d93d0638e168dd2c880e2b34b08d448cd163d11fccf2d80a3d5be726", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888653, "uuid": "b4b99405-3edc-44ef-bb72-294aa7ea88f6", "comment": "Malware payload (ArkeiStealer)", "value": "14445e1e02e4302bdc880dbee6f814a42ac2b17a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888653, "uuid": "82e1bc7d-4247-461f-b95d-c55554be5fd2", "comment": "Malware payload (ArkeiStealer)", "value": "2c46538194f7b6d3a77aad2fb161e4f1f58a523111a0650cd672ef49fe7e7855d9341b1a922001835d286b73b6972d04", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888653, "uuid": "537b2453-7563-4c51-a693-ef3fdb13a372", "value": "T1D0D41200E280C3F3D79643BD6C65CA9CE62DB84CFBE16276BA4502CE6A39553792533D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888653, "uuid": "6d7da596-5f50-4218-8a93-645d948f955a", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888653, "uuid": "723caaf0-958f-4938-b10b-7a171972ad1e", "value": "12288:Whec0Ja5GgfOcW+mAx+dbOoGLRx/LlPSMKt2KzZdI1EY+:WhepmfTD+dbOo8PW2Kz/I1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632888653, "uuid": "a5147e34-37a3-4834-a1c6-7f586221474f", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632888653, "uuid": "8ad21e81-5dde-441e-8cf7-01cbd9200f80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888653, "uuid": "7f282657-4edc-4c7a-b7b3-387bb1d0f4e4", "value": "c54477451f4a6fd3bbb6adff301fa84f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad0d687-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632908889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908889, "uuid": "4080c832-82ea-4afb-9ec2-b85e7870819e", "comment": "Malware payload (AgentTesla)", "value": "3bcb68d06bbe199d7d903bd9bf7f9f63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908889, "uuid": "99d38338-a699-48d7-82dc-b3d49f9c2e5d", "comment": "Malware payload (AgentTesla)", "value": "96a994c8a1cd85aa5779b46052ad94a4fb72fbe8451ee8a8e6ae8be49a2bc458", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908889, "uuid": "ea703b30-3964-4c35-95e7-ce81344b277e", "comment": "Malware payload (AgentTesla)", "value": "a74db066215fdb01756ccf7befb4db0929fb2efb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908889, "uuid": "03f15daa-f4a8-4686-a86d-bb6012bb709b", "comment": "Malware payload (AgentTesla)", "value": "4d83c7bf213b82ae0945634fabc647fdc03e929001c46aa445ebd2f6b7b23853a889067f0d1747fb0f6f7a1c14278dbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908889, "uuid": "2d5eb115-5c56-46ad-af6f-38c5bddc4cda", "value": "T1D0E48D6DF60CE29EFC0503B021297CD425E81C6D197CFA17BEA6B5E230AED7991F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908889, "uuid": "6f11cc0f-1694-4cec-a6a9-4c732800f35d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908889, "uuid": "35c847c3-5a57-47f8-ae1d-e295be811166", "value": "12288:WD4VHfQe6ZyWshg+qbZxTZZWunAWvm4YU0q2CnZP3caB0sNNcK0c:WD4VHfQe6ZyWshg+qbZxTZZWunAWvm4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908889, "uuid": "25edb871-d11a-490e-8137-fb06f2725a9f", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908889, "uuid": "0c1b0c2d-5dff-4c47-9a93-820030f544d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908889, "uuid": "dd2943c4-bd46-4a1b-abf6-a2511612d504", "value": "DHL-Waybill.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e92150-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927569, "uuid": "4816d78d-04f6-46ef-950c-8c3b53743dfa", "comment": "Malware payload", "value": "6d355e311248ed085a0df74ed4e7ad57", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927569, "uuid": "3c010d39-3d9b-47af-a004-bdb0d2e2da36", "comment": "Malware payload", "value": "96c895b752c154eec83f2aed6f6f8d2247345d1b94d51735f522ec41c4e6f2c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927569, "uuid": "437186f1-d0b6-419b-b8c3-f72b65dadf49", "comment": "Malware payload", "value": "8375c8b9d590198e117b2b0880bc91db941e5980", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927569, "uuid": "d1defd4a-f4e1-4005-abbb-1bef346c29e1", "comment": "Malware payload", "value": "82f7961491724b6a920ffff1c75797e41c914098e0ffd76b11927ea86014bd90e5cf0aefc45dd230a79c35ac07db6346", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927569, "uuid": "93b58ebe-5ec4-4b97-8fe8-c150542f570a", "value": "T181724A92EA70C5B6F77601F59A73582EB92E4E43038A00F34AD80D6D9E8C5DB7D30692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927569, "uuid": "d97edae3-d7ca-41a4-998c-ba0b9fa3c30b", "value": "137c07334fffbbf706413ba8f9573af0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927569, "uuid": "b4b02185-e932-4200-8527-138958e59aee", "value": "192:bKwBo1sax6Y9LRNr2cf8+1o1NNv9wlCgYBNE7NcSaecRkKeO8zz6sY2DIg/316U:bKKix6mbiVN0lC3kuSFcRsZpDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927569, "uuid": "ed311edd-cc20-445e-bbff-757a01c9fb08", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927569, "uuid": "9a27198b-b55d-428e-acaa-ed4952da659e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927569, "uuid": "5e7bc8a2-f646-4d92-ace2-1525da141e07", "value": "SecuriteInfo.com.Trojan.Inject4.16715.3883.1488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60633d11-20ef-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632897302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897302, "uuid": "91a5e16f-14b3-4e82-a497-cdcf40cad1af", "comment": "Malware payload (AgentTesla)", "value": "e8ede7d83f7a11fd545fe204095862a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897302, "uuid": "d847bb7d-b6b0-4e53-8b75-e8c765b72c85", "comment": "Malware payload (AgentTesla)", "value": "96dc80764ccc8c8fc12ebdbd055bd05e88c1ee4d4e7d6d95b32ea2b59c8f4bc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897302, "uuid": "8f663225-cf48-40ce-82ef-fe45982721bb", "comment": "Malware payload (AgentTesla)", "value": "e8ee1dac8b7b6ec3ef39788181155f29a6e6fc11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897302, "uuid": "d8076baf-4bea-4f87-8dbd-230a9ad56a9b", "comment": "Malware payload (AgentTesla)", "value": "b93e32efca6dd3e6b4b03d2ced5e53523c66776f8bd10ea4a0abc3101ec0fe6bc1a2c77bd5444584b431d048e3ea5754", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897302, "uuid": "aa10e3b0-b1b4-4249-8783-93f97a389f99", "value": "T103E2813EE9E799E7DBD20AF77632A3400ED394105E37574A3099B185583FB202B1DAD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897302, "uuid": "58fb0b0c-041b-476f-a5a4-30882adb7bb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897302, "uuid": "c83a2d1c-c4e5-4e72-992e-dd3706d708e5", "value": "384:YnS2MuX3ntOEajV8TDF2/wwz5vvH2opvtOvt6Y4BwEapWNJoi:YS2Bc8vDwzB2oZU1ZdWNJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897302, "uuid": "c79e2ed5-2451-45ee-978d-c5b30ad418a7", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897302, "uuid": "25ed6723-35be-4074-bc59-f6b35a7f4843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897302, "uuid": "a467882d-4d04-4f7e-b2ba-3f03bdbfd2cf", "value": "HSBC Payment Advice_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92f4009-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632896565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896565, "uuid": "82f9c1c4-654a-4a69-86a9-01fb5334017f", "comment": "Malware payload (AgentTesla)", "value": "d5a80cbf5eabfbdb59b536852c8466f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896565, "uuid": "794db9dc-216b-494b-b5f2-2f35dcb1207c", "comment": "Malware payload (AgentTesla)", "value": "973d4ea9eacd23f874776f6f91fb2353316f985b76ba2b5d42b054da9774057f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896565, "uuid": "0c0255a6-95bb-4109-8280-223aac0500ea", "comment": "Malware payload (AgentTesla)", "value": "c12b484018ca99feb8b8578ad87bfba71393953f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896565, "uuid": "acf0bcd9-f6f8-4d50-b73f-6ab77a663da4", "comment": "Malware payload (AgentTesla)", "value": "9d3e20d14a99372603123dbda3cd0faee0810b91be89d8a660ef4aa3cfb7b202cb5078bc034151c2a1f06ff45de98098", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896565, "uuid": "02f01f6f-dd4c-4418-868a-afbcc9692fca", "value": "T14A255A1BB60CD65EFD1432F03134B8E011A81E5B1868A917B9F2B9DD64B9D2BDCB50CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896565, "uuid": "15f8bbb4-fe3c-4dd9-8b29-4bb6a1e208bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896565, "uuid": "96a1f494-867c-4701-b167-de1c08dfb787", "value": "24576:WD4VHfQe6ZyWshg+qbZxTZZWunAWvR3M37iY9QNL7PMyMWrHzx6:qF4GGQ5nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896565, "uuid": "35f8d719-53ae-47d0-80b3-58bd956c6a40", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896565, "uuid": "77363e12-8f74-45b7-88ac-89d8da487fa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896565, "uuid": "f07285a5-316d-41bb-9199-b56a33b6de6a", "value": "RFQ_ORDER#09029021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc47158-213f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632931527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931527, "uuid": "03786cc8-7136-4406-b05a-fb91db5ec7e7", "comment": "Malware payload", "value": "110d30a1d7b3e9db16ee8a1b26809973", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "html_smuggling", "colour": "#FC27F6", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931527, "uuid": "8ae55c1d-04bb-4ac9-9281-48db07a7a9b4", "comment": "Malware payload", "value": "9755c765d48923802c2e5824522c2e25a0bfaece419061d6e223e7f74a067d18", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "html_smuggling", "colour": "#FC27F6", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931527, "uuid": "7165137e-9a17-4ac3-815e-ce129b41869a", "comment": "Malware payload", "value": "3ce7f7238d5be83f9271d81d3d4e39427b232de4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "html_smuggling", "colour": "#FC27F6", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632931527, "uuid": "34a7cc57-64e3-47a4-b2b2-a9e194c1549a", "comment": "Malware payload", "value": "06b005c3d7980fa100e14df82e12ab0b33c1425a384d46116df823a74bb785c6967d9965030fc5e389ce8d567c1cb96d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "html_smuggling", "colour": "#FC27F6", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632931527, "uuid": "f12c28ff-fce8-4b82-9728-0a92a6fdb240", "value": "T1382502118AC43FF9DEAC6A1980BA161E93F05E9E5416B4C9FF337D8AAFB7544010B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632931527, "uuid": "1f1efcb0-4fcd-49b1-8c5f-168b5cc1b2a8", "value": "12288:Hr2I5ZHQVc0ribR18wshvNvQ2sIKbXBDcBwvfOGwgLW1SeJtmC7r+9bik6BKGgDr:HrRoVT+bNG5QIGew3OX1oCVK19Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632931527, "uuid": "947d5636-d474-42db-b6a0-ec16ab06b0dd", "value": 987270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632931527, "uuid": "5a773f2c-276e-4916-a219-113cb417d402", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632931527, "uuid": "1d7123b7-af47-4445-9145-4012ea033336", "value": "1ZA109T4043832978.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c193e3-210d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632910305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910305, "uuid": "aec04bbc-03e8-460f-b6bb-481e9789b28c", "comment": "Malware payload", "value": "5c3fc024d7cf1ccee1a777895c587152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910305, "uuid": "12e72602-4182-4d5c-ab9e-ef0d3ad6be76", "comment": "Malware payload", "value": "97fa42e9f36b5e195c9c488df251a607611af5ce878a8f55067fac5de66d9ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910305, "uuid": "5c08c494-66fd-4a5b-a5aa-5f09e1bfd17d", "comment": "Malware payload", "value": "e67992a12eca1145509670c3bd0a687d0049b699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910305, "uuid": "d3538094-bba6-4798-b1cf-b78678d77372", "comment": "Malware payload", "value": "27bd1b41c94f3fbaf441c26cf29b392cef2f6590b94fa4e9dac2e1948a474fbabd5a1ec93ebe3a67eef30bde9fb25420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910305, "uuid": "03ca3936-617c-4634-a744-d0ed9738cc93", "value": "T1B7463378C0328B59CCAB9B307E5AD3988FA54694049DD1A4AEF1CF1B0639746B7BF344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910305, "uuid": "cb02a22e-2280-4305-a0b9-6b4aea964d38", "value": "fe4b72c1e87d00ec8a399de3b4432210", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910305, "uuid": "c01ba0ec-9614-4e38-9eb9-85540aa29937", "value": "98304:8PzLaxGYikreJUKsy80AZSl0jqOcJCuOhq8r/v8Y9+hOf46W:8PzWwYJrbKsy8DI6LuOhJDUY9+h6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632910305, "uuid": "e20f6f9c-c06c-47e6-9b31-f917429fe879", "value": 5544960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632910305, "uuid": "ab491ca5-046e-4618-b40d-3157c0eb2573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910305, "uuid": "c464bc3b-7e35-4285-a043-baa92fbc500d", "value": "5c3fc024d7cf1ccee1a777895c587152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1332d5ee-210e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632910487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910487, "uuid": "db49938a-753d-4849-bde7-f1d5ea04189d", "comment": "Malware payload (RaccoonStealer)", "value": "481bd2e89355de9a8e2393eec9ee41d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910487, "uuid": "b09bc61f-85e3-4e39-90ba-7d2a7bf06219", "comment": "Malware payload (RaccoonStealer)", "value": "9924bd5f366254f985a742ce76fbbbdecfb963c81920e2ebccbe433ca48516af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910487, "uuid": "7487cdaf-a1bc-4924-8711-65a516f5e8b5", "comment": "Malware payload (RaccoonStealer)", "value": "8523b97b3b9f38a297f6ec16ea8bec267018b32b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910487, "uuid": "14c95fa0-e38b-4a7a-8990-e4e35649cb65", "comment": "Malware payload (RaccoonStealer)", "value": "bb85296ec94714aa8c2524d3e2bb1f3ad46b7206863fa6d5c380ed7c0f8cffc8946a897291ffe68bc4262ce18790fa93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910487, "uuid": "e614682a-60fb-4940-ac65-7c9f8c50b6a5", "value": "T1E0C4E020B7E0C034F5B716F999BA82B8AA2D7DB16B3451CF52C516EA17746F4AC30783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910487, "uuid": "c6fc92c3-0dec-4dfb-b4f0-7d63965da366", "value": "56c207817e66e7690a43bf97b1ee7374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910487, "uuid": "c8046d8a-ccdb-44c7-8fbd-aadddeb632ca", "value": "12288:0snE+k3cLXmlPSMMMpe60MFzeg7X+AX1XOup9:0uU3cLM1MV6vogbdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632910487, "uuid": "a2b3c17a-2a29-4ed1-854c-58d9a735dc97", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632910487, "uuid": "bec0f77e-484f-4865-94d9-15d9914d28fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910487, "uuid": "ce2d8acc-04b9-4bba-bc01-1e9d45ee2c0c", "value": "28347623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c4f9f9-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632898338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898338, "uuid": "ec0409d0-13ca-45ee-bd53-04444360bd7a", "comment": "Malware payload (SakulaRAT)", "value": "ccdb023db49ef98e92bc4e52fd5d7bec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898338, "uuid": "2a2c7764-55d2-4276-ac40-e1759e7ca39e", "comment": "Malware payload (SakulaRAT)", "value": "995e26d3c24d06f40dd6771fa55d0127639a50e59249c593cb21ee3ea9401cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898338, "uuid": "6db77848-4050-41d9-9a4f-55b3b33198b7", "comment": "Malware payload (SakulaRAT)", "value": "704fe7f943331a69984527e50d3ab1823e111f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898338, "uuid": "cc6f75d0-3109-4b6d-8327-a08746f31bce", "comment": "Malware payload (SakulaRAT)", "value": "9886b36d79f255f1ec7ef35c3a7dbdd1cc33b1176c94b4e1be8172e88deea6c7cb7ca29ab64e6c4352f31a1e2adf518b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898338, "uuid": "4307569b-42b2-4fea-8766-97c3e753e6e6", "value": "T1A526A21173F90895F2F3AB30AEB181555B36BDA59EF6C62E3144428E0D76A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898338, "uuid": "1c003ea8-7cb5-495c-ba70-1e9ff282e60c", "value": "539502771da573641ecc7f6497e39f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898338, "uuid": "edf9b869-7663-459d-bc42-f3a3a2410f1d", "value": "24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYX:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898338, "uuid": "485933d1-11fa-4583-8af0-ea06daf1524d", "value": 4694016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898338, "uuid": "efd8fa74-2d6b-4160-93a5-954695e344e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898338, "uuid": "743044cd-83a6-4771-8422-f9f5d4f1ccb8", "value": "995e26d3c24d06f40dd6771fa55d0127639a50e59249c593cb21ee3ea9401cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acefec7-20d5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632886045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886045, "uuid": "2c543911-5e51-4b75-81e5-4d379b882cdb", "comment": "Malware payload (Formbook)", "value": "a61342f7b1885d91f972c3ea636627bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886045, "uuid": "49fe58d8-0995-4884-acf3-1006c2170ee7", "comment": "Malware payload (Formbook)", "value": "997e4e187d2a0cc4a6074189861cd11be4c812cd6145a0b4e4d9d292126b4327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886045, "uuid": "2c80e29e-2325-4124-adbc-e7a2e7d2cfea", "comment": "Malware payload (Formbook)", "value": "c491a9ea6281c502d3f742703f3248a0a673d6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886045, "uuid": "4da4280f-d65f-4863-bd6e-5949c2eb385c", "comment": "Malware payload (Formbook)", "value": "30c307e921a824a1842b57dfcf60e96b8821ff62de6a9a7beeb6cf9a524c4ef9b0adefed8e566c8b735fc53527e96e8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886045, "uuid": "76a767d3-c33e-4fef-98ef-b57727c5d850", "value": "T14644122566909CFFF541C7316CBBA9BDB7B3C2224110659F8BA50F53AD3098F8E1628D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886045, "uuid": "40697e66-10b4-4d84-975e-f7fd7caafb5c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886045, "uuid": "50d771b2-8d9c-41ee-9fc8-e48f9c058cab", "value": "6144:F8LxBs+q9qYP3q8Tcvw0Y4Jnpg6Ot55nuvhPRN6m:/+4qYvBTcvFYsZg55uvhCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632886045, "uuid": "a563d9b5-9841-4b4a-8964-8a81d3c8aace", "value": 260881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632886045, "uuid": "41436a2d-0087-4134-9723-f8960fe9abf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886045, "uuid": "6bb10aad-84c2-4db4-bdf1-001e5ce71e0c", "value": "DN_2467899246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bd50f6-2115-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632913823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913823, "uuid": "a2e39c58-ae17-4642-af32-88c3bad46c0e", "comment": "Malware payload (GuLoader)", "value": "326f29a347549e64c9510a1e0bd6d043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913823, "uuid": "d271b54f-0a63-4312-b0d7-7670888db29d", "comment": "Malware payload (GuLoader)", "value": "99c1a96121410c61014d0115983f43fad64acc77d21914a9fb9e3c6ba262627a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913823, "uuid": "04ed22fa-29b7-47a4-a1d6-3f5b56803cb2", "comment": "Malware payload (GuLoader)", "value": "d70b73a10e45d9569da0dc44f99d49b7cb886959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632913823, "uuid": "7fb17507-3ca0-449c-989d-0a2e1969c80f", "comment": "Malware payload (GuLoader)", "value": "db747cc997591b57db8690a4d45836482302fea3ae3cde239f94d9d831227727437cbbb45169018696d2f852cd88f229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913823, "uuid": "84e01b36-ea93-4f9f-8250-d68cf4941f3f", "value": "T193C3F64795356D2BC4B3BAFBD705826E210D38E716D0494616C4BB1BAE27CBB38A3D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913823, "uuid": "377d5a8a-5b55-4174-8487-4b802052e4d4", "value": "71d5a9f33de2f7c250bf122de57cb463", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913823, "uuid": "407804d5-53a6-4ae4-a652-52152967c8cc", "value": "1536:8h0ZHEAZsxq4zf8JoJ5pn2dUAh8R+4ZMLoflfjxQ8dUw7K1LjP9L:8hYSxJJ5F2dzh8QmM0flfFQ8dUwyLz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632913823, "uuid": "42cd8f49-42f3-496a-9ffd-dcc5239cd044", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632913823, "uuid": "a4a54848-ffb4-48fa-8f3b-55c706767f03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632913823, "uuid": "e154b54b-9ff7-43ec-b10b-5eec6a3488eb", "value": "justificante de la transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6bf0a1-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898750, "uuid": "6b9ae967-1708-4291-84f4-dd7557eca254", "comment": "Malware payload (AgentTesla)", "value": "14dc5a46e0a59a6559d842734d47753e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898750, "uuid": "6f528f57-18d4-4e26-8ffb-47c9ddf80c42", "comment": "Malware payload (AgentTesla)", "value": "99d403672500aecc16e2b0c366f2ce398a44c1d994a69f2770fdaaab3258d004", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898750, "uuid": "df5fd3f6-8a47-4586-a78e-d59f6a1f9ec7", "comment": "Malware payload (AgentTesla)", "value": "1836e1dc1bf10860ed6ab9ce052839d79292532b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898750, "uuid": "87860342-5665-4dff-b1f7-a8ca312a0908", "comment": "Malware payload (AgentTesla)", "value": "81b217da57f87f0cbb0c3fe9e4050881764379076dac619f2a51ec4afd4b24648ab3cb4b3f8722cd42964356511e0f0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898750, "uuid": "3063b5d7-04b2-4432-b0c0-4f44e39fc844", "value": "T179B42330ADA4FB05F24F3AB165552CCAB74CD87ECE4364056B43E63451B04EC5AA8EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898750, "uuid": "94819134-0079-4f4e-9f10-b5c4e84480f7", "value": "12288:NMF//jQPh/iaJYkST5M63dd9jTckLuHHB1wqnh5vuH57nlDH:NMWZ9ikST5MENhunIM5vuFlDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898750, "uuid": "06cd4974-07d0-492e-b94c-6f35ebef64e3", "value": 535594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898750, "uuid": "50989e76-bc7a-41af-bbb2-4831b0fe69b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898750, "uuid": "a27a120a-53fb-43d2-874a-ead1c9383336", "value": "SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261c079f-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898493, "uuid": "05313e1c-47ed-47df-ac4a-9c92d6abf3f5", "comment": "Malware payload (AgentTesla)", "value": "46d90f71dc0d657c292b672f3068a11b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898493, "uuid": "4c8f1664-370b-4f1f-a70c-6ed896fb31fa", "comment": "Malware payload (AgentTesla)", "value": "99e8bac818f8f17c92868980e2a42eb02b221ad4bc5c179b7067333015701f4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898493, "uuid": "0bc07fae-0330-48c7-b23f-29770001fefe", "comment": "Malware payload (AgentTesla)", "value": "f0b0d3253bd88454fcd8d0f75cb1abd1f10b1614", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898493, "uuid": "d7fad8be-c030-4022-847e-d60e63137708", "comment": "Malware payload (AgentTesla)", "value": "e2b0792e091c8d1a9ee8c10176402b3cc1538fbcf763808478333e05cb05a22430982f7016cfd62c582dc3e653f583cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898493, "uuid": "e3bd2967-1219-4ff6-aad7-a226a64913a3", "value": "T142B42330ADA4FA05F24F3AB165552CCAB74CD87ECE4364056B43E63451F04EC69A8EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898493, "uuid": "a6cc41e3-6288-4b7c-a8c6-40c18dc781dc", "value": "12288:AMF//jQPh/iaJYkST5M63dd9jTckLuHHB1wqnh5vuH57nlDY:AMWZ9ikST5MENhunIM5vuFlDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898493, "uuid": "07e35732-4075-4abc-94bc-2686eb08a665", "value": 535606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898493, "uuid": "2b862d4c-2111-4c62-8451-733cfcd288a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898493, "uuid": "d74fd97b-a1be-43f8-9a9b-a4288c759c0b", "value": "SHIPPING ADVICE#QINGYANG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d127c9e-213a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632929509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929509, "uuid": "7ccd71ac-0561-4953-aeeb-5216ae547c4b", "comment": "Malware payload (Gafgyt)", "value": "c765025de63972635683d8099c0223fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929509, "uuid": "7c79d267-6997-49c0-ac7f-6a33a528c289", "comment": "Malware payload (Gafgyt)", "value": "9a355c032fe11c93de8356fb3322a3c1686a3d8d5105bce9c3a1db9a3300a428", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929509, "uuid": "378ebcb3-82e2-4ba2-ac5a-01c66ab37050", "comment": "Malware payload (Gafgyt)", "value": "6a7ce90416c5bafe8047710ea217ae54670b884b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929509, "uuid": "9e192a9a-0b42-4631-a368-c66d5e43944a", "comment": "Malware payload (Gafgyt)", "value": "f6476e93d01e94fe5609d48f2e30fc0f26fe663825dc2588e2dfe0c31a6de5b8f4f08ac565f3fc1f84703fb17bd8b213", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929509, "uuid": "797d2a43-80f1-4c15-8723-88e1aee5f7b5", "value": "T1CB148366BBA19EB7D80FCE3306D94502118CA58A46D92FAFB7B0C55CE38B94F44E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929509, "uuid": "48b6ecef-4d62-43d6-a1ae-b07642546bea", "value": "6144:P86Yi409bcXDfXE5hUiHMtWmKz6FhdzHWlwq:H409bcrXE5hUistWmKz6FhdzHWlwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929509, "uuid": "63744647-8a54-4b6c-a477-ff8e6613adc6", "value": 201440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929509, "uuid": "c8f51906-04fc-4e7c-89d7-3815c97124ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929509, "uuid": "0bc37b19-ece0-487e-a6bb-88f2ba2cadc8", "value": "c765025de63972635683d8099c0223fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7809f0b9-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632899919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899919, "uuid": "b9814e67-2e20-4d61-a009-be6e1e9fe687", "comment": "Malware payload (Dridex)", "value": "6c0c0a80cbec68bd24ef3f915d41787d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899919, "uuid": "33241368-58c3-4523-875f-ce910bbb48a5", "comment": "Malware payload (Dridex)", "value": "9a7494f6629229cbf66882c7ea29472088b87e7b49bf9feea57aac4a044baeb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899919, "uuid": "7188279e-0c1e-4aac-b417-ad3e4edc6e2c", "comment": "Malware payload (Dridex)", "value": "41093a58358e51086f77205fdb7e6f6b22fbd8a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899919, "uuid": "85dd5edf-a1a4-4bc1-a084-1952dd235fbc", "comment": "Malware payload (Dridex)", "value": "1871a707b64763f7904a50430661b2b4462c1aaa66b8c8d4fbb3d758c0cf7989399ad344a5d064a3bc2cee58e23d8930", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899919, "uuid": "bf63f4af-f595-40d0-97ae-63e8e0c45970", "value": "T16406E020EF69E1E6C6B89F3E9408352727B93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899919, "uuid": "ecd0627d-886e-4ccb-afb0-c41e62242ae1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899919, "uuid": "ef584f59-c6ca-4bf8-89d7-874fabc317a2", "value": "12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899919, "uuid": "55264562-157b-4d69-84fb-e701110c7090", "value": 3719168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899919, "uuid": "5b97a8bd-5645-4903-941c-07a9a65fa5cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899919, "uuid": "90d664b7-9788-44f4-8f37-1ebdc9de9a68", "value": "9a7494f6629229cbf66882c7ea29472088b87e7b49bf9feea57aac4a044baeb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07835524-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Matiex)", "timestamp": 1632908750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908750, "uuid": "85b9b382-225b-43bd-804c-2200b46e8b69", "comment": "Malware payload (Matiex)", "value": "4242ff7610974691b438ff0a051541b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908750, "uuid": "928fef75-75be-4f01-aa42-dcd444d8692e", "comment": "Malware payload (Matiex)", "value": "9bda87480b1435f3e0b3df9bb2a1290a1ef712b0e8d0e5ab88f40d852ad5d826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908750, "uuid": "252f5540-890b-41bd-86cc-e311aca45918", "comment": "Malware payload (Matiex)", "value": "ea9d76d9f9978dba36a9d2d4ab3e0f3db8f0f9d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908750, "uuid": "34faf253-ce0c-4e08-9af6-9013449dbd76", "comment": "Malware payload (Matiex)", "value": "d06e5b8c56ca0d2617afdc87492df0b936951686d136169a0394a87e75c6bc1cef6078c3b5a5efc44ac898ef20cbfe40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908750, "uuid": "6bb6f62f-6797-41c5-b842-885927f98b7d", "value": "T1777423A324B2D0E7E7F4277400FA7526FF76C38A10454A8357D9097F3B2148F662A2DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908750, "uuid": "bc5e9ddf-521f-4211-9429-bc58ab6e75cf", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908750, "uuid": "7f170950-7123-46bd-81eb-538894f85c3b", "value": "6144:b8LxBBXsyU9SIP/lCCMxV2MFB/pSB+Zip4sv43la2CUcKwvurlnmwrKDe9bK:ysymgB/ZBPFW41iUcK7rZmwmDOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908750, "uuid": "3c512c28-f924-4ac6-84a8-e148e7399dbc", "value": 353266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908750, "uuid": "b1ed0b30-3c93-4b8e-9832-66e4980aa818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908750, "uuid": "8a473bdc-a73b-4551-9f11-2f930822198b", "value": "876545678909876543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2710e767-212c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632923405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923405, "uuid": "d6742d6e-e6ac-43ea-a1a4-3fdc528b5a18", "comment": "Malware payload (Mirai)", "value": "e85eaafd708ca12a6558cfe3d6e670ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923405, "uuid": "8cabbf28-c6c9-4c75-b58f-e80e740e8fc4", "comment": "Malware payload (Mirai)", "value": "9c0cee92a206cc5a2829e4e4f57c19f012d93ef946e138ca7ae6e5597ed7924a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923405, "uuid": "b08f3ba1-eb69-43d6-b557-7708af1dd861", "comment": "Malware payload (Mirai)", "value": "bf878b6dd4bff424c05b7c0fb8ccc8154bbeb73d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923405, "uuid": "acbf660a-78c8-45c3-bf52-0cfbf44bdf60", "comment": "Malware payload (Mirai)", "value": "2f108624857dbf9fde21212567f824c0db4f3836fc7813ddc06e81e40f4b82baa43d31dfb8fff03fe07c3af0e5777625", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923405, "uuid": "0b43ccb8-f64e-4d6e-ac69-fea89c7c0eaf", "value": "T1FDC36D86BA80C1B3D04316F212D79F164932F6FE1A9BDB46E7682CB0DF19185B221F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923405, "uuid": "ebd9d2fe-f912-48cc-9736-75a0e278b4e2", "value": "3072:FUW8AbUZUmUuTgw4w6yZ6ybEFveOdV5hEp9iX2tZ+81Ygr1nmrMVduymG/rG+8:3c1lu4/UeOdV5hGiX2rYg1nmrMVduyVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632923405, "uuid": "c0ef95f4-bc58-4f29-9f55-1b661b3105c7", "value": 123159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632923405, "uuid": "ad2d409d-a9e0-4a35-8112-a54bfd17297f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923405, "uuid": "8a2e1aa5-bfcf-412a-a05f-cead2b2f051e", "value": "daddyl33t.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63608f1d-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902891, "uuid": "69fbd33f-bf26-4f36-ba5c-d13fc12d55c0", "comment": "Malware payload", "value": "a0615f053d53535a407c546f18e8abc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902891, "uuid": "2cd0e1b4-c38d-4cfc-af42-a6063704b992", "comment": "Malware payload", "value": "9c4a2b2a16771b0be241ac3b6973a83f488a007ffd1ad94ae698554e182507aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902891, "uuid": "01c2b018-0154-48be-8e46-ff4a3ae39722", "comment": "Malware payload", "value": "d8a2d5111e4a96067252e06986a3549f3f951f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902891, "uuid": "1c60b53f-1259-4cea-9ee8-4a2482433245", "comment": "Malware payload", "value": "c11f1a8a4dfc7efa7216ecbb5d56d08a9d72ebf2caaeca6414cc180698dde4e9cdd3ab0d6c58c429c96f523e492263ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902891, "uuid": "b301c7c4-c516-4632-8da7-a114ab8bc411", "value": "T14B73CF25BF521D48E7F80B3359EC51CA06BFBB89A93046CE296E5AD80F37BC456D0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902891, "uuid": "530cb3a8-7d58-46d6-a3d1-1ee40a36ac62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902891, "uuid": "48b80d89-3e2b-4d10-9385-96bd7669f9a2", "value": "1536:mcRCHF3uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtLQo9/l:9RCHFP3ZAtWDDILJLovbicqOq3o+nLQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902891, "uuid": "9f2fb16c-98b1-4bc9-a0a9-00356bb98884", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902891, "uuid": "36f42ba0-f42c-4195-886f-e5a7ff201869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902891, "uuid": "3f277b78-e03a-453f-b3f4-c0a711ef825b", "value": "9c4a2b2a16771b0be241ac3b6973a83f488a007ffd1ad94ae698554e182507aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c086a8-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902896, "uuid": "8bff4be5-0ecc-4b4a-93cf-7981aa45ca15", "comment": "Malware payload", "value": "4ec42c7185b425e696ca06d2183b8898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902896, "uuid": "708dcec8-70b3-460d-a49c-5cfa34e2fd1f", "comment": "Malware payload", "value": "9d7b1b766e9a7da94ce9bec5bdf42b74615ed50fb83443e8ff65e6d382537832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902896, "uuid": "f1d455b5-1560-4aef-95db-9f30474ca39a", "comment": "Malware payload", "value": "8dbe62f0845463832d9bdce9b1f1bfa479bf2d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902896, "uuid": "4281d78d-abb0-4a1d-aa80-38a218498d02", "comment": "Malware payload", "value": "6d683aa99ee6a1471c5cdcf879f79c735e66e9d12fe12a34cd2f80a30e46253c744b6a8b7b84e29560c1c74244831bc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902896, "uuid": "ef45f35d-0438-4b31-8d31-9ee11772cb85", "value": "T1D473CF257F920C48E7F94B3369EC51CA067FBB8DA9314ACE286E9AD80B37BC455D0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902896, "uuid": "4ba49606-1213-4b30-b8ee-2ae68a5ff18d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902896, "uuid": "9b7081ce-d34a-4c04-902c-5b6c45782385", "value": "1536:8Xc58UAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6709/v1kH:8c58UAtWDDILJLovbicqOq3o+nD09/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902896, "uuid": "f0cc696f-7965-44db-9f86-35945856a99f", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902896, "uuid": "d9c1d024-d62f-4b87-8fe8-b1eb5cb940c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902896, "uuid": "a36cd0f8-ba38-491a-9466-ffdbbf0c064e", "value": "9d7b1b766e9a7da94ce9bec5bdf42b74615ed50fb83443e8ff65e6d382537832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a597db-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Sodinokibi)", "timestamp": 1632901957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901957, "uuid": "6dbac752-b2c6-4336-96c4-7d03b7744690", "comment": "Malware payload (Sodinokibi)", "value": "cefffae5b88b714dd237424055c2ebce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901957, "uuid": "41e525e8-cca9-4fa3-bfbe-0c4f92ce5abf", "comment": "Malware payload (Sodinokibi)", "value": "9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901957, "uuid": "5709d085-dd81-4f28-b99f-94fe01146f40", "comment": "Malware payload (Sodinokibi)", "value": "cf0f8bfc14e862a1c0206939263821ae58a706a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901957, "uuid": "cbc144f6-2c8a-4b7b-91fe-9005016ae41c", "comment": "Malware payload (Sodinokibi)", "value": "b58c9baefd4d88f807043d31fab774f0364e37fd62fd7230efd68c1f722e1463ed1970d446d938b7fd4162d27b7ce495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901957, "uuid": "cc089912-1379-44b9-8bf8-8f6138f0a75c", "value": "T175D3AF77B9A142B3CEC381F2237B3E1B9AFEFE3010216577C361998419255D5A72B227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901957, "uuid": "b74c91d2-b60e-4035-947a-f77ec18c9d65", "value": "eb68d746c420bd3a83ab3b0473d926ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901957, "uuid": "e7780c1c-5184-470d-92cb-e5e0f509dacd", "value": "1536:ASOoRSNl/XT9yYSvVKJJgpBy7bICS4AY4zHbjOK9:WPaKJJctSobjOK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901957, "uuid": "42b6f068-f6f7-45c2-aa32-ba567cea69c6", "value": 140864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901957, "uuid": "d7c6afae-4ad0-4157-96f0-d21473436e82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901957, "uuid": "504bd388-966f-4efe-8ec8-44d90863a37c", "value": "9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd7c477-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632919877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919877, "uuid": "baa03b7f-9569-43bf-823d-5dadfaded366", "comment": "Malware payload (Formbook)", "value": "c5eab5882bedfc964c601f85fede02f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919877, "uuid": "5cf34ce4-fa21-47d0-8081-4a233af8920b", "comment": "Malware payload (Formbook)", "value": "9f6277c9f028bd5ba1acf206a4d9dc8ffcd0624240c095445607bf59de709a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919877, "uuid": "5d7c869e-2fff-4df0-8fd9-3b0dd255764d", "comment": "Malware payload (Formbook)", "value": "e0bc2447e41456bb087ff4b239ea593d2a8eeb90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919877, "uuid": "4bd4b2e2-71a1-4a92-87ae-be9d24e6da15", "comment": "Malware payload (Formbook)", "value": "97f526414b4b0c6882912f5f8a325c23ed0eba12fbca064bd34a1e25adb7730488c0b2f6387662da2a0456921cd3bd8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919877, "uuid": "6bc0f0da-4d79-4ea2-9589-f8a9d3ce2be8", "value": "T13DE48D6DF21CE29EFD0903B021297CD425EC1CAD197CFA17BEA6B5E230AAD7551F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919877, "uuid": "15e9a622-cc3e-4524-ace6-2a494c3e21a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919877, "uuid": "5fe50d46-5daa-46e3-ad1c-94300258c35d", "value": "12288:YD4VHfQe6ZyWshg+qbZxTZZWunAWvECrAn5s7y0l32hhIDZXeD3Go/giTAbHs0c:YD4VHfQe6ZyWshg+qbZxTZZWunAWvECv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919877, "uuid": "efaba2dc-5488-443c-9b10-9ae14d209cea", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919877, "uuid": "c29e7c3e-abe4-4b15-baf6-15acb07d12a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919877, "uuid": "1d4fb201-3307-43bd-b376-059f8cbab678", "value": "Quotation 29092021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c92a3de-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919576, "uuid": "cdadb9ae-b50e-4fcd-9896-78bf6ed270c8", "comment": "Malware payload (AgentTesla)", "value": "33dbd8627daaffc0e6102d99e095e416", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919576, "uuid": "b294386e-d960-430c-8c15-e0a71313a011", "comment": "Malware payload (AgentTesla)", "value": "9f6b57b32ec5adefe8ee6d9f6e25ed706941a31b673820ffd0bf43b4f8cae695", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919576, "uuid": "b6c7fa8f-3d3f-4052-aece-549ffcc3c8b1", "comment": "Malware payload (AgentTesla)", "value": "b4beae5047e6b8838cf9c6682817116e887036f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919576, "uuid": "4ced552f-76c7-4593-8aa8-e927039e4b57", "comment": "Malware payload (AgentTesla)", "value": "4f25ba53aa9ddcfad90a729b438b5dedc7da072ff376427df4221d241857858bd3cb435ed0e680aaaebf79f021bc20be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919576, "uuid": "2ed61e1d-7aae-4c11-aa5f-5b5dc60767fc", "value": "T12CF49E6DF61CE29EFD0903B021297CD425E80CAD1D7CBA17BE66B5E230AED7591F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919576, "uuid": "6b1c7629-f9c8-4e8d-ad3c-4a8de6379c62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919576, "uuid": "283c276b-f590-4c23-b6ff-27613c6f077a", "value": "12288:oD4VHfQe6ZyWshg+qbZxTZZWunAWvgGSZBJKEz5uBvk9l6Hz8jj/wFDmlUAygk0c:oD4VHfQe6ZyWshg+qbZxTZZWunAWvcJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919576, "uuid": "01c2cc16-787e-4de9-84e4-10880647b5b0", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919576, "uuid": "6d873ffb-cfb8-4347-92bb-37fd035b6013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919576, "uuid": "07f0cb43-8035-4960-a0e6-27f16fb9f3ea", "value": "Order specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebfa9ca-20fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902319, "uuid": "dd9f8af4-0dd5-4fcb-8991-504fc61e62e8", "comment": "Malware payload", "value": "c0484e493f81b16061277a9f6205d259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902319, "uuid": "9be4a326-2b1a-42ef-b737-241c5cd7df7d", "comment": "Malware payload", "value": "9f6dd77bd2f06d38f36d5f59454846d27eca279bd659659dae2621a3cf4e81bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902319, "uuid": "690c5d64-7aea-4be1-a79a-3f7cdfa98bd7", "comment": "Malware payload", "value": "1f9dc11e86907e0dc41ae3f2653833c00712eb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902319, "uuid": "3f2af849-43fb-43b1-8168-d6b2f10d514d", "comment": "Malware payload", "value": "804677b94f989af8b7c5b50152f26b798fb5ef45b9a095b958878e01a3e9aafe77033ff7daa6ccb6a042b70415ac82f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902319, "uuid": "1f7ad289-7781-4558-bbac-cbd0419800c6", "value": "T13D73CF11BF811D44E7F91B3316EC25D606AFBB8E9DB087CB686D89D84F37A1098D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902319, "uuid": "37e20728-0a37-4b5d-816c-1949b9d03356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902319, "uuid": "2e7fa77c-7f94-45e0-b2a5-4953407ddcde", "value": "1536:1tPWV5pXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtU6p9/119x:bPWV5ZSyRxvY3md+dWWZyX9/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902319, "uuid": "56dec476-cd83-4741-8e77-2e58b8d11913", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902319, "uuid": "0180cd06-3fd9-41db-b40c-f785ee3101bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902319, "uuid": "71845c32-0684-4e07-958c-daf8d12871a2", "value": "9f6dd77bd2f06d38f36d5f59454846d27eca279bd659659dae2621a3cf4e81bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9658fb11-214f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632938625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938625, "uuid": "442c7d9b-810b-43b3-acb1-100cce1f3f8e", "comment": "Malware payload", "value": "595cfcdd3417c6094bedfc31c889b842", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938625, "uuid": "d01c6dc9-309e-4532-9b3c-24cbd9bc373e", "comment": "Malware payload", "value": "a304d71a02a2f049934896df7fc93fde968e3576dc2d5f58ffccf3b0485c04e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938625, "uuid": "bfa4dc5e-008d-4d41-8e98-34891ce8340a", "comment": "Malware payload", "value": "2fa6a3a4d83fdb577790cc126c8c2a51b1674127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938625, "uuid": "f8dd7166-673e-42bc-9444-4c360308bb3f", "comment": "Malware payload", "value": "d144a41678108cc3126cfafacbde7e29a137cff39893b9e2347d4065673ad6ff49948f60381288e698635646e8feaa12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938625, "uuid": "f37c1df8-0f76-49e0-a80c-d2c70cf8e2c5", "value": "T16F65334773A0A9AEC65252315D3FE6703B514F40D0A5661362D87D2F3AF239B1B8E38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938625, "uuid": "612c4c88-0430-4be8-9bb7-4db2600025fd", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938625, "uuid": "9e25837d-307d-4a4a-a706-45d55aa9a983", "value": "24576:QaCI67ONUcrfArZfSvXGp3fkMMP/66eiSQu1tW7S8UDjEpPVAIUaOyh5fgUYW0:7B60OfSxvfehQuje7UXySOOm5fgE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632938625, "uuid": "ede3c9a4-9579-466d-9094-0a4bb9814bdf", "value": 1524447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632938625, "uuid": "8b11c144-76a8-4c52-b8b2-c3487a809e77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938625, "uuid": "8a80aed8-d61d-4015-bcb7-30656dbc6097", "value": "595cfcdd3417c6094bedfc31c889b842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101422fd-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632901892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901892, "uuid": "f5027b1f-7224-4395-b6c2-010ab800137d", "comment": "Malware payload (njrat)", "value": "c6dadfa2458bb2fcec4e19030216878b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901892, "uuid": "7cb120da-314b-4fd5-abfd-a90b2c8bf2cf", "comment": "Malware payload (njrat)", "value": "a31b7234f02625dcaa13aa622166c1f2b9292f92ff4375b5baddf31225b785eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901892, "uuid": "9e5e1efd-b56e-4961-9a51-c04eef82797a", "comment": "Malware payload (njrat)", "value": "a39845ecc03954bcb0846c23ff33ada6875f1719", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901892, "uuid": "d3b391f3-7b6a-411f-88c7-d1bae3d8d375", "comment": "Malware payload (njrat)", "value": "3d8fb0ddae89045b6de738812a51ca558bcf971d5ae879f08fd934e9fd3cdcc44880dc3777abf05163c658c88e436870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901892, "uuid": "4c3ffb8c-4b3e-461e-a20a-ac426d7ef304", "value": "T1B9A4225FE3B6EA58C7CE8777A0265304412BC15D98A6E65DB9FC18B46E21CCCB34BC84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901892, "uuid": "22d31bdc-4234-4e35-b096-c0bc220100f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901892, "uuid": "b1622cf3-cd65-43aa-a11b-6748f64df330", "value": "12288:U6Aj5fKV8lM3/PV7H4ryRTJZksTMoilvL4b6TSsQcpf:U6MRtMFYGRTJZkCG6orr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901892, "uuid": "eebc3e25-7375-4e9b-984d-455bcc969dd1", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901892, "uuid": "3fcac094-d8a3-4c76-9184-8cd5d9cf6a99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901892, "uuid": "0f07c100-a9dc-46e0-ad9c-d380976ce983", "value": "a31b7234f02625dcaa13aa622166c1f2b9292f92ff4375b5baddf31225b785eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0b57c2-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632908868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908868, "uuid": "3c471f4c-0af2-4431-b364-89af4d9b538e", "comment": "Malware payload (Formbook)", "value": "29bf3916fbe9efa5b85ec0b885995967", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908868, "uuid": "8c14e731-37c8-47d1-903c-ed34347c0afb", "comment": "Malware payload (Formbook)", "value": "a325ff051ebc1d366533e22fba4a75a4c0b183a28457ed2fea0841f68da06334", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908868, "uuid": "d728d831-131f-48a2-a934-8f788e3f0568", "comment": "Malware payload (Formbook)", "value": "cbcdfdf809c394e5d7038af945642af382f00eda", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908868, "uuid": "6b4d9fea-8f01-42b7-a492-7139a1d4be51", "comment": "Malware payload (Formbook)", "value": "9dc15354cf48773802ccb77535d350c9206ffdb16d6b72b6cd3a67e908f4dd5a120f777e151c0c8a70118971b44e081c", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908868, "uuid": "38900a70-84eb-4efa-806c-85a49f277fb2", "value": "T17515175AB109E1CDFC0C42B11166BCC410E81E793878AE137E9661E334EFEA56DADCE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908868, "uuid": "ce3ef848-dedc-4bf9-8f2b-54c1d1ffdee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908868, "uuid": "6f4af123-6627-4113-90db-097816eaec65", "value": "24576:jD4VHfQe6ZyWshg+qbZxTZZWunAWvk+q2IohuaAloSdOLI+6+:hEIjuZlPSN6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908868, "uuid": "a42cfe13-3876-453e-a578-88515cccb272", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908868, "uuid": "9dce6c83-562e-49a4-ae3f-e107396379b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908868, "uuid": "9272bb98-ebb9-4583-9bb9-efeed15a1079", "value": "Maschine Angebot Resale.de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac63d19f-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903013, "uuid": "9544a077-2d85-47d8-8462-93a72e9d3aa9", "comment": "Malware payload (njrat)", "value": "dd9fa20e95d785d15ea9f9ab178876d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903013, "uuid": "e6b00ddc-99a0-4a60-9760-11dddea59140", "comment": "Malware payload (njrat)", "value": "a3d76879d36c9e33eff1bc48b4154b3ef1e4f6a1c32cc584086629bef2673a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903013, "uuid": "6850bca9-26d5-48c0-a797-b09b9e894da8", "comment": "Malware payload (njrat)", "value": "4a926671cf12f506676d6cb13817e9a3fe2759f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903013, "uuid": "b1587ee5-6a79-4d26-b5ff-2c65ca82dcca", "comment": "Malware payload (njrat)", "value": "a751b018bb72210d8a10d7ba1f7642dc990d6a2e3683476932477e913b2a1cc3351f810e3518c4011b140b2c02916474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903013, "uuid": "f4eaa720-df66-42d5-8312-63c370025738", "value": "T1F063E783B788CB12E95815B584DF342813E1AFC72733E786BF4D72A919533A35D81B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903013, "uuid": "6781b734-f832-42ab-935b-302b521bdf94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903013, "uuid": "bafbf3af-e6ee-40cb-8a1c-74be248562ea", "value": "1536:cWD1ciNrSVTR1cQHUeq/6YThUoUyPspdA4GSuw1:vD+JR1cQ0eqCYThU5yPedv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903013, "uuid": "4a3e696b-d36b-47d1-9847-57e078c3f5ab", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903013, "uuid": "4d4699b6-4919-413f-9709-5b5b07d95996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903013, "uuid": "ab60f815-2413-4b46-9e23-399671814d8f", "value": "a3d76879d36c9e33eff1bc48b4154b3ef1e4f6a1c32cc584086629bef2673a0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2d7bb0-214a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632936512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936512, "uuid": "9a878c79-73c3-4894-901b-002683ca6d84", "comment": "Malware payload (Gafgyt)", "value": "5975d02a709953c0eaf07ca3882ea14f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936512, "uuid": "e860d171-2606-4547-9411-ca6b8cb63439", "comment": "Malware payload (Gafgyt)", "value": "a3e5e7a389fbaa25be30e74ca3fc2ec1f45ff9fd19db760f8f7605f4279ca09c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936512, "uuid": "edf660f0-9adc-45b4-a257-df0882a8df73", "comment": "Malware payload (Gafgyt)", "value": "333b56b4edb61cd2e1c010f4b7add1525f6d5a9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936512, "uuid": "c9b586aa-a6bf-4416-b02a-2bc8a311dfd3", "comment": "Malware payload (Gafgyt)", "value": "0a86f35e9a8ab1feadc5db55b57d656c23ff40bf5818d8dec8f50ab0ea0e3689aedd5736c2e29638c61853b6eee85792", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936512, "uuid": "388c6b59-fccf-4633-a2d5-ea7a8ed2fce0", "value": "T153041A09E810536BC2D323BFFB5E528E73371BA867DB33219A345AB42BC57591D39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936512, "uuid": "11d2ab71-f214-4f9b-b3e7-72150d501a86", "value": "3072:QdXEuuQawnAa1dKEZLxS5hUcpebXH8zZ9y77NF3msQLnh0X0Kr:8XZlawnA6xS5hUlXH8HI7NF3msQLnh6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632936512, "uuid": "72f9415a-b036-4aa7-8f7b-9f7f28504a29", "value": 175344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632936512, "uuid": "324621bd-fb42-4096-8542-c55a9889e2c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936512, "uuid": "24fd2781-ef86-47ad-a65d-8d1054903193", "value": "5975d02a709953c0eaf07ca3882ea14f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d56be51-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919658, "uuid": "305e46cc-6227-4d7c-a6ae-2b908e810a55", "comment": "Malware payload (AgentTesla)", "value": "0f1dd16f318117460db6992adfb503cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919658, "uuid": "72f0ba66-7ead-492b-b092-902b86ccddd2", "comment": "Malware payload (AgentTesla)", "value": "a4873ecdfd893a14e0ad64d1053b0fa41fce5cffa29df7577dedc74ed37ce699", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919658, "uuid": "cb40e93a-a9d5-4f60-a9ad-c827cc706d3d", "comment": "Malware payload (AgentTesla)", "value": "99d384a086136c8498c962cf1b7baea365bcb3cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919658, "uuid": "33d987c7-ddf6-4864-8c10-518928c4cc60", "comment": "Malware payload (AgentTesla)", "value": "b9264183a180fe4094b3e51b4ee3dc660d74740be84e53837d132903accfab2c7014f4e368bf2abed5aae80897cb6412", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919658, "uuid": "fc86cf61-a3ea-4f59-ba3b-e58cbf69adc6", "value": "T18DF48D69F61CE29EFC0903B021257CC415E81C6D2D7CFA27BEA6B5E230BAD7651F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919658, "uuid": "d4fbd278-ebe9-4cfb-80da-c702a781f81e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919658, "uuid": "4a9c28e9-74e8-4be5-84c2-0fea4f36630a", "value": "12288:ED4VHfQe6ZyWshg+qbZxTZZWunAWvlZM/rjH7qpGqdGD4q7QLvDlNmtMWOeapCOD:ED4VHfQe6ZyWshg+qbZxTZZWunAWvlZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919658, "uuid": "15144be9-5f9c-45e1-886e-2ca6947e0e09", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919658, "uuid": "6954f9fd-c3c9-40c2-9692-f8f4ae62e05e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919658, "uuid": "3239e9fd-cc36-4e5a-a55e-977c6316d3df", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3e378d-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632898723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898723, "uuid": "685e382d-0215-4cf8-8957-9d8472583f99", "comment": "Malware payload (RaccoonStealer)", "value": "1948edbaed64906de604142fb5eb8ba0", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898723, "uuid": "ac3259cf-b4f8-4427-ab4e-ef33545ae404", "comment": "Malware payload (RaccoonStealer)", "value": "a487b4e1e29512e1d0896e18b9683a996423a8b4efbb3e1a7b99045e5b7473da", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898723, "uuid": "c6e6aa4b-a332-4ac4-84ea-c94bba83cb2c", "comment": "Malware payload (RaccoonStealer)", "value": "89b54630a029eeee0c7f655ba94fb9a059ce66cf", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898723, "uuid": "96d8dc34-bcd1-4cb1-bbbe-d8af5203c85d", "comment": "Malware payload (RaccoonStealer)", "value": "ec3681c1c67082a499695f171c241444a56c9a0331e576acb6477d6f1b58847b34caa0d0febfc374c578e1f227e1e170", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898723, "uuid": "8809b6b1-d831-44f3-9b9a-0ef2f7cf7ab4", "value": "T10F450A00B7855B53D63C7CBA02533A0413F39AE63E26D2273F5D65EAA346EC65F0D18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898723, "uuid": "1ad95ded-414a-4040-b54f-c33e9f8d6926", "value": "1536:+CmImbfhgB6dCvz6r5pmwqf7Yh0Fy6XuWtN+70pKXQlf+3D:He5pmd7NVfN+70pKXQlfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898723, "uuid": "29a6fb32-e3e6-4415-8bf9-3e2ea2da1f84", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898723, "uuid": "0ada20df-e5e9-4270-adc8-08cc87153490", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898723, "uuid": "ffe27b95-ecac-4451-ba11-fd9575ba1a7b", "value": "SKM_C258201001130020005057.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9f35e0-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632903039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903039, "uuid": "e971129a-8663-4d82-af0d-5e2a0ed27fae", "comment": "Malware payload (njrat)", "value": "944c114e02b1d7fdc46e0b495cfc01c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903039, "uuid": "c6c80460-e271-451a-9eba-205da3499b13", "comment": "Malware payload (njrat)", "value": "a4f78e77907d8ea06d93912ebc29d191629c47270d87882ed9e8948a3bbb77c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903039, "uuid": "8aea04fb-166b-4d70-adb1-a09a642308a1", "comment": "Malware payload (njrat)", "value": "0b810447828a36ce22d905c0a5ca8ce6f38700ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903039, "uuid": "8ff3ab36-4281-427c-a0a8-a2eb906e40c0", "comment": "Malware payload (njrat)", "value": "aede0632f21d3f4bcb17be690f9e925718d472ee74cc2df96561a27802f3b61dcab6f0bbd36c6f1da91b298310df9960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903039, "uuid": "79fa7edf-2f51-442b-8232-8b4f18370b43", "value": "T1E853180B77A4C713C96C217680DB312813B6AE8B2732E78B3D4D52AD1E573E15D85B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903039, "uuid": "b1512a2c-183d-457f-ac96-2597defa3083", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903039, "uuid": "84e17d3a-4401-4029-adb5-755138be9224", "value": "1536:6weoCsTr2cg+H32CP4Gr+D12uYew4spdA4GSuw1:l2R+RED1IKedv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903039, "uuid": "a719fd69-6c0c-493d-a778-f6cd95a803a7", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903039, "uuid": "80481568-8678-4cd8-a3d6-dc67208c584c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903039, "uuid": "7ad176c9-de94-4273-8ddd-d78cc38bf107", "value": "a4f78e77907d8ea06d93912ebc29d191629c47270d87882ed9e8948a3bbb77c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b575abb-210d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632910179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910179, "uuid": "de13572b-e673-435d-be3a-139b45b1e4e7", "comment": "Malware payload (RaccoonStealer)", "value": "80192ada3754bcdf0dd0e486bf27e1b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "TRUST DANMARK ApS", "colour": "#138FE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910179, "uuid": "357038e4-1f55-4f3a-95a3-e510050fab97", "comment": "Malware payload (RaccoonStealer)", "value": "a5410fb3ebd9aad914aa830402ada638e95ec666a0e6f4857431008234fd2f80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "TRUST DANMARK ApS", "colour": "#138FE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910179, "uuid": "440cec5c-77b6-4cfb-8bd3-aadd76a40890", "comment": "Malware payload (RaccoonStealer)", "value": "3f4932609867bc9a640b0dd574abfd66ac7eb706", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "TRUST DANMARK ApS", "colour": "#138FE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632910179, "uuid": "820fe735-9cab-44ad-a4a5-0ebf142906e2", "comment": "Malware payload (RaccoonStealer)", "value": "188dcb0c9ccc5608b18b0d01084651462e5d9a36a4c6a423dae711400dc4facee65a5a03f88aac063d36031e1ee02d83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "TRUST DANMARK ApS", "colour": "#138FE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910179, "uuid": "e87af403-7eb1-4ce0-9d63-3268d859bf6d", "value": "T1E7726D973A58B4ABCD4A0D74A0C91A37AC72F360AF84045765B0C15EFA907F8693C59F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910179, "uuid": "74b01242-4a32-49b6-bfe4-bb58253b09b3", "value": "08d31493d73d9d2f2228adbc7a81739d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910179, "uuid": "b39efd74-7476-4bc0-ad58-390a4b319cfe", "value": "384:5bMKT+h2WqvMKLK9lJf2pwKNs3K3iFRn/:5bMeUqvIlJbayn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632910179, "uuid": "0056457d-e593-449a-8c40-6613f33874a3", "value": 16832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632910179, "uuid": "c11f4f19-46ac-4d47-b5c6-eb04debe0e59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632910179, "uuid": "531658a5-6138-41eb-8ada-4236b6236381", "value": "a5410fb3ebd9aad914aa830402ada638e95ec666a0e6f4857431008234fd2f80.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a4c9dd-2121-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632918759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918759, "uuid": "69b0aae7-9af4-4c18-876a-876c9809bba5", "comment": "Malware payload (Formbook)", "value": "08359b734342da1634a66e867b549a90", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918759, "uuid": "497d6fa2-de02-4f09-a663-04e1b603d3d4", "comment": "Malware payload (Formbook)", "value": "a621a7d8411c3a040a7560fd201d1bb9d269a1ed4bb43559879babf58e675eb8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918759, "uuid": "7df776bc-534b-4322-a825-c2fceb5bf8b6", "comment": "Malware payload (Formbook)", "value": "b17399be8059070447e488c754a9b0953e020446", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918759, "uuid": "51bc17e9-b1ba-4c01-9310-adec3212f956", "comment": "Malware payload (Formbook)", "value": "3fe98959230b3fde5ab4dae0bf6664eb470c39dd4004c70ed18484a5421b7efbe7978c5ce73d575e7b243d9b410fd5a6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918759, "uuid": "b6245fe7-6379-4e1f-9737-30948d420867", "value": "T191B42310FD8E8FFB929251C5BE1EA98144746AA082F0374BC00746B176DEF9EB9C3752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918759, "uuid": "5e06fc62-fc98-44ce-9227-d86b97a4895e", "value": "12288:PyGGLeVwsFcvHrLUkm79lW7c4hr7zhhp2C1xrx:Z23ccvrLt4n4hdhL/rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918759, "uuid": "f2fc9b3f-8303-4543-b7b3-ee129d53e1cc", "value": 511324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918759, "uuid": "e8f76477-8fbf-42dc-9d55-33bd82b65947", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918759, "uuid": "4f138c7f-10f7-494a-a48b-ca5f16bc9fd4", "value": "PURCHASE ORDER 29kva.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d8c15d-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900419, "uuid": "01ecbc0c-6d60-470a-9ca0-8b3c2b78ce8a", "comment": "Malware payload (Dridex)", "value": "57845e298142cadbaee180f051a1c0b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900419, "uuid": "21b624d8-5a5e-4086-beb1-789865b22220", "comment": "Malware payload (Dridex)", "value": "a623ad91357548f9e8f6087093168c9555622399a9139eee5f3aa13962c54a77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900419, "uuid": "60d55f4f-c9f4-4aed-8d0e-309d696de838", "comment": "Malware payload (Dridex)", "value": "4c8ddcf0f9141f922e79546e5591bda94622576b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900419, "uuid": "43cc7f8b-08b4-42d6-b8bc-0ad44637763c", "comment": "Malware payload (Dridex)", "value": "f6fecc9d1c4e5e301d23ec5efea9d6144fc0a684dc9abf2e812c24cc096f904b7d3fc4cc95c2661de6b86b0d9ec9b01f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900419, "uuid": "3c1f0bfe-8f50-4ceb-a649-61d832c72f06", "value": "T118A5E020EE69E1E6C6B89F3E9408352327F93D75110D618CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900419, "uuid": "5387344a-7e2c-40cc-8c35-53be356322d9", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900419, "uuid": "f17a1050-2db9-49ce-ac0d-fc17ecefabbb", "value": "12288:RVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:gfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900419, "uuid": "6a158a31-cc0e-48fd-9a36-b57b2f604730", "value": 2174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900419, "uuid": "66370b7c-7c4d-440f-8d86-8adc27d075ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900419, "uuid": "2d810322-2e4a-4062-996f-9bf7bcc3f6dc", "value": "a623ad91357548f9e8f6087093168c9555622399a9139eee5f3aa13962c54a77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e74684-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1632901875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901875, "uuid": "2a5ca6da-5ffb-4ffd-a73e-6f02079e369a", "comment": "Malware payload (QuasarRAT)", "value": "2fce71109883f3bcf447606e4f9fc0b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901875, "uuid": "61570fdc-ab2a-4741-9031-78baa478cc6a", "comment": "Malware payload (QuasarRAT)", "value": "a6335310e14b2663d04f0e1e83058ae53a8684c54365a0834470182bc429befc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901875, "uuid": "ac4023e2-c9f2-4caf-8d51-f66c7b7639d7", "comment": "Malware payload (QuasarRAT)", "value": "50191072b1d703029bb3e85597cdf14965211516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901875, "uuid": "8f75afa2-c8fb-449b-bed1-db7b4ccb5b5e", "comment": "Malware payload (QuasarRAT)", "value": "4b435033ec503e56c6d1613c2c00f2b72fad637ce1358f3311f2daf8609f3e1f0f41d16507f789354ca78acb212ef8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901875, "uuid": "3d77ae71-6f3e-4d19-a2e1-8cee435651dd", "value": "T1A0B45B4027FC8A1BE26E57BAE87154205BF5E417B267EB8F4548B1FD2CA67028E40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901875, "uuid": "8ad6ba78-eb2a-46eb-8aed-4b47beb814e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901875, "uuid": "7cd9256f-9235-4e14-9643-20437ded68e0", "value": "6144:dTEgdc0YPXAGbgiIN2RSBzj9SQwhCfVKv9+cEH0b8F9wonrZCzcTR3u:dTEgdfYHbgZDx3fHntwcdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901875, "uuid": "0ccf816b-76e4-4eb4-9ba1-155170abf983", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901875, "uuid": "4c3e346f-1d2e-49bd-8f2f-55dd37956d2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901875, "uuid": "3d797a93-c121-48cf-8f7c-903eec50166c", "value": "a6335310e14b2663d04f0e1e83058ae53a8684c54365a0834470182bc429befc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eef99fb-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900360, "uuid": "48ca834f-e437-4b62-a597-6a86b5c8a2fd", "comment": "Malware payload (Dridex)", "value": "f6528507e0c7e2f42c06bc7c3450d415", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900360, "uuid": "b6e0a56e-8964-40ef-abb1-d72f19418088", "comment": "Malware payload (Dridex)", "value": "a6856905d02a99fbcddf5fab7660c8f99f7fff107cf7865d716e972bf8b313c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900360, "uuid": "aa99c436-79a0-4269-8e63-f79635ee2f5b", "comment": "Malware payload (Dridex)", "value": "7fa4ccd800bcf2c5254abee391678b708cba3d94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900360, "uuid": "a3a6f127-b9dc-4996-9d87-7f63e8d9c6cc", "comment": "Malware payload (Dridex)", "value": "a6aa463dd62c9b7bdc0ef8181a241d2de0887378f2c2d0d478e0a300a7d298e0ee6da54b0856820ab4e83bf64689c36c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900360, "uuid": "0645efc3-158f-44e0-8e02-8f482765e99d", "value": "T174A56B10FFF205C3C09DF739789D3415A2B3AA65811F8A1D824F131E6CA5B513EAE99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900360, "uuid": "cf3c3100-fb53-4442-b180-e55d101e4ca2", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900360, "uuid": "bcb8b609-d4ea-4098-9274-e4dd724798c8", "value": "12288:aVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1klw:HfP7fWsK5z9A+WGAW+V5SB6Ct4bnbkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900360, "uuid": "a003b130-9fea-4c07-85b3-75dd43f3e7fa", "value": 2248704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900360, "uuid": "42c79bc4-65b4-4a33-ab27-2a62c5303eaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900360, "uuid": "36e0fd13-1db2-44f0-99e4-ea6c009d2074", "value": "a6856905d02a99fbcddf5fab7660c8f99f7fff107cf7865d716e972bf8b313c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2323481e-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902783, "uuid": "54e65b09-0a90-46a7-b967-bfdc1a932b45", "comment": "Malware payload", "value": "6d10deec36038127286b79e9157bbc63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902783, "uuid": "677ee3e7-82d8-4359-8df0-afb4ae7c6554", "comment": "Malware payload", "value": "a715470f2aa4724f2a0c405c8fb85ddc0adda9c5c51bdeecc40491edb25eaac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902783, "uuid": "5035fa72-810e-4198-bc36-88a8ab8bbde2", "comment": "Malware payload", "value": "e6b26e466acfc9bd004c55bff0de4c2ebf81907a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902783, "uuid": "7a433922-ed15-4d53-aeab-770b592e6f5a", "comment": "Malware payload", "value": "62167c88b822c0a2ef8c405391baf4bf8b4b91c6864016a0a1c5f2ed48b97a885282b8e711ae0790c8567b65a3a2b3cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902783, "uuid": "1f09a31c-1f19-46fb-92b6-192a3fcb86e4", "value": "T10D73BF15AE810D08E3F80B3215DC36CA067FFB4ED67057CA5D5E65E82B37B9099E0764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902783, "uuid": "32c29c85-f526-47e0-bb55-d42ddc0b118d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902783, "uuid": "fa995c85-1403-4ffe-b1b4-f634568fe1d4", "value": "1536:pPWV5jSVdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96t9/gS1+I/:pPWV5jSAn7N041Qqhgi9/yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902783, "uuid": "538f0fc6-8890-4179-9b1c-0436c88ae940", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902783, "uuid": "11e98ec4-fbeb-4fe1-9002-2374c300904e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902783, "uuid": "82c9a066-1332-4099-9427-add588a44976", "value": "a715470f2aa4724f2a0c405c8fb85ddc0adda9c5c51bdeecc40491edb25eaac4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446c9032-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632896396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896396, "uuid": "51671a00-bd8c-414f-9bd3-57b59dda85c0", "comment": "Malware payload (AgentTesla)", "value": "8b033f069ddd561fc8b68ba9af11d4a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896396, "uuid": "70ccd7d6-aeed-4394-838c-c2d990f60c08", "comment": "Malware payload (AgentTesla)", "value": "a8196ab66a7b64f2c527a7aa748dd4776b285c523b2facf748581c99c2d54998", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896396, "uuid": "37aeb15e-51cf-4cdd-a461-3792e540becb", "comment": "Malware payload (AgentTesla)", "value": "c31b492acc58e06cf036ca0269774e9e98104d0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896396, "uuid": "c5a40f13-9388-4cc0-ab29-6fb3cb040dce", "comment": "Malware payload (AgentTesla)", "value": "bdb2acde3b2f6364a1787a48985fb7c2748ad51c8487defad5c7a64cdfeddf703bba7f8d9db0dfaaa2aaf3d2663f9453", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896396, "uuid": "fe778c39-80b4-4f20-b9e8-dbee259be762", "value": "T1364262BDC09706A88F46A7B82B0B6F45148C766EF399953336B85B3567D2D3A401387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896396, "uuid": "00f3ceae-b8cc-410e-a1a8-1b4726ffe7d3", "value": "384:8bOhMYzw3ytBgtcBgY8xwgmpwo9M3Kfn35ww:8KhMY8iBTBgPYyo4opww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896396, "uuid": "a99df79e-6313-413c-bfc4-7ffb151e43c4", "value": 12720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896396, "uuid": "5b887efe-a057-4ef9-80fe-c4b7d81da45c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896396, "uuid": "2073137e-2d93-4b89-a7d8-c61c768a2fca", "value": "ORDER _NO_32017.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53789725-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632898140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898140, "uuid": "6db71261-2dcb-45c3-8c91-30f22f3b7100", "comment": "Malware payload", "value": "c7ae882ef431ab4d33d4f94cc076b6d0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898140, "uuid": "192aaf4c-d133-4ffa-aecf-17eabfa37439", "comment": "Malware payload", "value": "a81d483184348fae0894c40acb5199b49e02c2c942841baeb644b79c86abf9ff", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898140, "uuid": "8dec60f1-d5dc-41be-a636-5fad57c4e06a", "comment": "Malware payload", "value": "234c6df8f901cd6dd9267c0caeb6bc69814240ce", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898140, "uuid": "90ebf48b-d89d-4253-a929-58ace3854ca8", "comment": "Malware payload", "value": "f4957567de00baf74db2f99c2e452869abfd8eb94e1146573f34c26cea52646eaa268eb66ee9a778d680b0e1f0a0c351", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898140, "uuid": "3fae0744-4085-49f2-9476-cad9dbc59338", "value": "T1B1F401127EC14471E4B22C3519F99B74A53CBC311F358ADFA3947A2D6E301C26A3AB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898140, "uuid": "be979dcd-d51a-4d60-9a0d-3dcb8acb8eec", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898140, "uuid": "9ef4ae84-bf50-43ed-bbba-c7dc9f6fdf0d", "value": "12288:OKry2/qZXzmVpX+t4Ofzr45nqpC7NPNGhyZeoiLO7C5JBerZjfjlXlQq5:Jry2uXzmVLkUndqIUDi27Q15Cq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898140, "uuid": "1d407a3b-afbf-4ffd-9f04-d8c32a91cead", "value": 768696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898140, "uuid": "0cf0b820-0b17-4629-9b2e-36f5ef54a161", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898140, "uuid": "fe622b70-2e05-4ad9-8bc6-0583a5c6236d", "value": "DHL_7565644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c66598e-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632896490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896490, "uuid": "8ee095c3-a35b-4ba1-8e47-d2e6f5be55d3", "comment": "Malware payload", "value": "240e606c6ce1eb91a5fe12ea4c606eed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896490, "uuid": "f613c10a-d674-4c69-a1b0-f3a8c4b86fb7", "comment": "Malware payload", "value": "a85a99ac83316ab49d1a26b8688290a5da096d274bf09fae9b7df94fe5e1ef05", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896490, "uuid": "b0458550-a92f-4b61-8db9-977e9b82d353", "comment": "Malware payload", "value": "5ec39049c101b2a6960f6f5c09dce6dd602670f3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896490, "uuid": "32e79c8f-461a-4226-8f82-56348cbfea98", "comment": "Malware payload", "value": "cdd2de2894cf0ed61828927c2c1feb4d2d711878868d744ceb00011f6ff0b0a135dc3812063d332742de6687ec161cd0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896490, "uuid": "48254a1a-1b9e-4da0-a2ec-3ebbd469e910", "value": "T17BC4AFD458DA80A6B98105DDD9C0F44D9820FED1355FDE28C7AECC73AE596F8AEC408B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896490, "uuid": "ad7cd7b1-3620-4aa8-b25b-108479bf21bd", "value": "12288:E////////////////////////////////////Nss/dzFHRsU0:0RsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896490, "uuid": "693e8ca4-b96d-4c0c-926d-d3915566a594", "value": 549291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896490, "uuid": "7a9b5d98-22e4-4193-940f-8fe6609036ee", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896490, "uuid": "e8add1a2-bb7e-488a-9f0c-95eab5d90229", "value": "MV GULF WIND.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42022dce-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900258, "uuid": "617b0e63-472f-433a-945d-0eee5521377f", "comment": "Malware payload (Dridex)", "value": "3005d0b74b0b089282057b68ecbba125", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900258, "uuid": "39c5611f-4494-4b98-9af9-5e4da23278d2", "comment": "Malware payload (Dridex)", "value": "a895e4683a4a4b49b791b6f41f9061e9a3c7dea10c35d90eb55de116466d4519", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900258, "uuid": "e9bd93f8-4594-4b42-ba77-a20651f36990", "comment": "Malware payload (Dridex)", "value": "ead976e6fd127aad312f170eb3e65df90c9bb59e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900258, "uuid": "b2d16f61-5e92-45c4-be99-386d896ae297", "comment": "Malware payload (Dridex)", "value": "39f8b276c8251d45867f9d168ed7923a1c65d1c7b03e30ba5e462c15016398ae672109c853ad4fd1a84714fcb2bf216d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900258, "uuid": "464c1b49-d6bd-4009-8855-9f9cc2bf6ec5", "value": "T1C3C56A10FFF605C3C09DF739788D3415B2B3AA61811F8A4D824E131E6DA5B913E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900258, "uuid": "0009b3b9-22b8-455c-9592-960fc37a1f91", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900258, "uuid": "da399f0d-c79a-493d-8406-b2d9e348af72", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1T5:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900258, "uuid": "9d5bef53-206f-4834-b0ce-3895d1db2236", "value": 2727936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900258, "uuid": "84fc193a-791e-43a5-a244-7b9383fbc275", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900258, "uuid": "a01dee52-67bb-43f9-b342-146bddf451e2", "value": "a895e4683a4a4b49b791b6f41f9061e9a3c7dea10c35d90eb55de116466d4519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d326bc-20d3-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632885448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885448, "uuid": "da644965-8831-40e0-a063-a50cff12f274", "comment": "Malware payload (AveMariaRAT)", "value": "90d4b131ce4139d2118d2058074d7d3c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885448, "uuid": "1aaf4448-f657-452c-8296-d3d9e01369dc", "comment": "Malware payload (AveMariaRAT)", "value": "a8e79ab98f2b367304c2df704319eea240b7e3ab3d8afba773bb709f2234a6d5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885448, "uuid": "d90ce2ab-b9e6-4305-be28-bc1596cee5cd", "comment": "Malware payload (AveMariaRAT)", "value": "0bbf8b4d5902745d40d028f7c8c8ea17077a2dc1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885448, "uuid": "58ceb2dc-b6c5-470b-9094-3baa49947ec4", "comment": "Malware payload (AveMariaRAT)", "value": "d32c68a6418c6a46e828a07f53d75da86164b120e1d4d4bd8cc50e30c495f5c589a7be7aa67f18a2dcbb6074c3ad8a60", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885448, "uuid": "f504fcbe-61c2-4c6f-9ab9-d26e7181049e", "value": "T192055C394D2682F787EEC66CD08C0BCEDEA6A4837B919F1AC495D7D2025B70FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885448, "uuid": "77829c5e-de4c-48c8-a2d2-831e0bfd50aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885448, "uuid": "c3a5064b-479b-4af3-8fe3-4d27c878ac17", "value": "6144:hlShF+B/rFePuLzE7TOzTWDjBt0CTs8/sr88DnVZ/3LqS+pkh0xUw/ID:fAszF5bzTyTClZ/+Szh0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885448, "uuid": "87ced12b-2a93-4a7b-b6bf-60dbd18ba4b6", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885448, "uuid": "8062ec39-658c-4edc-9464-c0de53205833", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885448, "uuid": "e599c8c9-d73f-4579-a405-6262aa8b0b1f", "value": "PO_0098765RTYUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5f8291-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900117, "uuid": "8e3a984b-2908-4bd7-8269-986f8fd9beb5", "comment": "Malware payload (Dridex)", "value": "ba338582b61a48856323dd1f86f42c95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900117, "uuid": "fac70cd5-e346-45b7-9ac8-31a6087913b3", "comment": "Malware payload (Dridex)", "value": "a9664b3af0cf7cf434c3ee04d7486b447116358408a603b1c4beb95bca25dfe1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900117, "uuid": "3ba242c5-5a0e-4b0a-ae6c-734cc9ca7a1b", "comment": "Malware payload (Dridex)", "value": "1f35b4c43340f670b23e2131d7cadd2f89834522", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900117, "uuid": "6ad47314-e4b5-4137-beb8-1e1646518b33", "comment": "Malware payload (Dridex)", "value": "5264291928e8b3a974efdc6c929104dbde139c4ad700ec2233429bdbd61988f756b978171a9c54430b1e46703811a05f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900117, "uuid": "fa4e73b0-7d87-4e4a-b432-e7f2fdce4102", "value": "T13AF5D020EE69E1E7C6B89F3E9408352327B93D75110D618CC392608F5EFC6546E3E99E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900117, "uuid": "93f37aee-8af3-4edb-8173-4cf1e823ed63", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900117, "uuid": "c5620ffa-8e8d-47eb-86bd-41ca333536ca", "value": "12288:PVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:mfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900117, "uuid": "62fe7ff2-98b1-4edd-8d1d-b7927aff569e", "value": 3473408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900117, "uuid": "1a5853fe-c602-4fd5-810e-fc81ca7576e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900117, "uuid": "253584b0-7bea-4f97-9c41-801f90858fb4", "value": "a9664b3af0cf7cf434c3ee04d7486b447116358408a603b1c4beb95bca25dfe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d732d1d8-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927566, "uuid": "e5872493-7bce-4581-b762-a0d2a69f7dd8", "comment": "Malware payload", "value": "0b920b2f27590b67c54f3787103f2180", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927566, "uuid": "27a35854-ce78-42c8-bed9-276ba6bf34fc", "comment": "Malware payload", "value": "a9f72389f209e74e5e0ccc368a81866e59f873869e17e9e03572e3419f20d14f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927566, "uuid": "65a7fb10-b86b-4b5f-b88d-688a17b29340", "comment": "Malware payload", "value": "029a495fbb09ea3dca28807fd815baf8b541206f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927566, "uuid": "dce08d98-414d-48b9-aea2-544b44a81d27", "comment": "Malware payload", "value": "06d51dff58e9dc9fb42fba9488d9dc5c5b6ad00a799c0e7626f5235def8e8bea7c58e2297358fd4429065201de415890", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927566, "uuid": "85c5aa51-d9d6-4b0a-ad66-bc06de6e6dfc", "value": "T14FB2D7069551F1ABD9D302F6944F52F322408B166BF99ACF6DD82CF0BF0A1D56ABC213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927566, "uuid": "491a141b-3f39-494b-926d-b6bdc50845e1", "value": "453659d03798e960ca8aff976867e0d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927566, "uuid": "abc24c9d-9145-4079-81d7-2c7f36efeb76", "value": "384:Rt+65S05r0uoCz4hV6dAbxnRX2Hm2RDjyiM2girviHAMYhNy1T0wqNJP:Rt+65S05rPoCzwtiMpiruYw1TuNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927566, "uuid": "7db9c7c4-4340-4b70-a893-1309744f1578", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927566, "uuid": "fa0e8ab9-7131-40ab-85c6-969583f94c39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927566, "uuid": "6012d776-4ce5-44e3-9c64-189d5a72cdbd", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.21487.12533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3d3530-2126-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632921189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921189, "uuid": "cd330c7a-7318-4350-8f0f-d02fa1f9d73e", "comment": "Malware payload", "value": "6fe861a26cf63739057fff561735f546", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921189, "uuid": "2354324d-25b6-488d-aaec-483e4f80224a", "comment": "Malware payload", "value": "aa42da6f08308796d2f1a61ea4aa79ac6054b2f57670e553d7fda481bd521737", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921189, "uuid": "941d61dc-f1fc-43e0-b014-0e481706b373", "comment": "Malware payload", "value": "cb71797403943f71919dfb363e9e1298a0550b1d", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921189, "uuid": "3fbc93f9-db3c-4e3f-84c7-60353eea9154", "comment": "Malware payload", "value": "6c738fd661bf508d0f62f2a19e3efa085871f7d3231f197071d1816bc22fefe11734d4ac7e752752480b1a8b8452cf8d", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921189, "uuid": "5b299e15-535b-4746-8eb3-95a353dc27da", "value": "T1D935330F6AF00631C5DA297A3A3F5AA544E36DAB223744CF16B374506633F81F879E25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921189, "uuid": "3faf85f9-8900-4e57-92b2-3e1283ef3d53", "value": "24576:eMynlSXu4UDldxzOdjUbZ2gFR5TkUWj672qNJAC:eMg4UtqUAQzJhNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632921189, "uuid": "7ceeed90-5630-42f6-9161-b3201242d717", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632921189, "uuid": "a0718091-1779-48eb-90e9-0a5285811714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921189, "uuid": "d0d7a185-14f9-4285-8df8-3238467d5812", "value": "host32_pic.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd974c96-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632898345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898345, "uuid": "4806a683-532d-4830-9c7d-3de9b6be6ba3", "comment": "Malware payload (SakulaRAT)", "value": "7ffcd766ee8725bba557e3647dc8479c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898345, "uuid": "d4aa00e3-d342-4e88-9e06-5c381b752f19", "comment": "Malware payload (SakulaRAT)", "value": "aaa358445426f3c4910bf1aef6d0f491c13c347e65f7fab4852f9642315f1b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898345, "uuid": "619b0b23-34eb-409d-bf49-8533a80ecbf7", "comment": "Malware payload (SakulaRAT)", "value": "a8d16d9fc8424508b019c2cec71af718d2843e2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898345, "uuid": "fec587c4-c0b2-43bd-be01-189f3adf3866", "comment": "Malware payload (SakulaRAT)", "value": "55a2fdbaaa9b398f2be3eefc09e025ebafd630b2f035fb00a4ac13937e5d627aa5e9d2bf13c35207fb3afbf3b86ce10e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898345, "uuid": "8d3e19b2-9c8f-4cd5-bb07-98b25d0cd7b8", "value": "T1F826A21173F90895F2F3AB30AEB181555B36BDA59EF6C62E3144428E0D76A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898345, "uuid": "67b7061c-ced2-4a11-9c4b-8af1a0101367", "value": "539502771da573641ecc7f6497e39f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898345, "uuid": "3756908f-d27e-4f5d-a7e6-67dc7511ecda", "value": "24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYL:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898345, "uuid": "bd44727c-6895-49d7-b3ac-e0a438235454", "value": 4694016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898345, "uuid": "46dbb11a-8fa0-48e9-b53f-d892869471f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898345, "uuid": "9ef1850f-17b8-413c-8987-7ef3da1e3529", "value": "aaa358445426f3c4910bf1aef6d0f491c13c347e65f7fab4852f9642315f1b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73c3364-2158-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632942545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942545, "uuid": "7b4bdf9b-e3bf-464f-a580-c9cb92d24941", "comment": "Malware payload (Mirai)", "value": "0d89563f5d327c2c1c5d7f3d0b115bfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942545, "uuid": "93476527-5637-4944-bd46-e1dc6c0c72db", "comment": "Malware payload (Mirai)", "value": "ab2ef8ff02b2e54deea3bc475bfabb6e3787d3fc97442eaaed6f3e64b8ada780", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942545, "uuid": "f0fcfec1-4c0e-46ce-a98d-bbc53a13737a", "comment": "Malware payload (Mirai)", "value": "234b9aceac268754a36017dd1095d17ffe7a6220", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632942545, "uuid": "14318096-f9cc-42a2-9f30-7411ef9dc5c8", "comment": "Malware payload (Mirai)", "value": "36dae3f1d2b8840931285b9b4696d8582d8e14f12a9cc941cbf22980134653473518892ea72bb12b6da341612d98e6f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942545, "uuid": "1bf7f293-ce7b-4eac-8faa-8ed480e2569b", "value": "T11ED2E0ED63DC4A4FCE5E587E96E414F49B92619032CB9F591332CC0CCA7548AB0AE578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942545, "uuid": "2713b736-007b-4567-abf5-e77b220c409a", "value": "768:wMx/5rJIWSUxgeRM1+VpncRoEUpAr6CtPJWlWE:wo5Ox4RMcVpncRo/pe3J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632942545, "uuid": "5b573fed-bf64-4032-ad32-1a3de20a8d3f", "value": 30540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632942545, "uuid": "cfc53d05-84e4-457e-b4d8-cda5a57a1c29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632942545, "uuid": "54be073b-33a1-4c7a-9905-3735e68de05e", "value": "0d89563f5d327c2c1c5d7f3d0b115bfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ba6a32-20e5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632893228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893228, "uuid": "a0da1cbd-8e77-4e41-883e-c0fe658f5bc7", "comment": "Malware payload (AgentTesla)", "value": "7efb2dd63e3459998ab3d69bc9884c91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893228, "uuid": "1a20a164-ac93-429e-bdf4-2bc2a22ef701", "comment": "Malware payload (AgentTesla)", "value": "aba5215c92d5d2e34cbf12e6b2c1d380c2297d172e7e4788b84b228c8d07bc7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893228, "uuid": "a57ce7be-4936-4cb8-a699-87cd8f0bf0d0", "comment": "Malware payload (AgentTesla)", "value": "a591fdf08171d77f2119e76fe1882990a3f3bc00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632893228, "uuid": "e4b945f9-058b-4056-9894-37a97af37c61", "comment": "Malware payload (AgentTesla)", "value": "40b092db7e3d2071359984aa2d10b83f3679c211cc454f5a34cca7e2bd62bff0464e7485bfba0d1281127a236ffce383", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893228, "uuid": "22d52926-19db-42d3-a49f-a004d53a2aef", "value": "T104158D1AB60CEA5AFD1433F02524BCC411F81C981C6CEA17B97672EAB4B9D27DCB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893228, "uuid": "c4381ce9-c697-49f8-b28b-267e25983273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893228, "uuid": "6441ba29-8922-459d-b214-2bb9f9c47817", "value": "24576:r3M35KFfl0xjGD4VHfQe6ZyWshg+qbZxTZZWunAWv:b45KFKxj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632893228, "uuid": "a108e915-f724-4867-935c-70c22d2298a6", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632893228, "uuid": "0f771545-a294-4da9-96be-c2b235d4bd9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632893228, "uuid": "4ed6f533-8e6e-4b76-99f2-496bf1409569", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b83fe59-20d1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632884490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884490, "uuid": "ed491902-1fc6-4593-8776-a2e411945122", "comment": "Malware payload (RedLineStealer)", "value": "6112c72912e12d7f3490641386adf720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884490, "uuid": "c17aa35d-75b0-43cd-9615-f8207dded1e9", "comment": "Malware payload (RedLineStealer)", "value": "ac098ff6d0aab414dad2bce4a4a21ade100a6d4921bf90c7890409b8d37dea05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884490, "uuid": "03fcf341-06bf-423f-897c-cabc1e58641a", "comment": "Malware payload (RedLineStealer)", "value": "0e9e723ef7f189d679caeda6ea9444ecf1c104b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884490, "uuid": "682f801a-eaf2-4719-96bf-82ff9067f93b", "comment": "Malware payload (RedLineStealer)", "value": "b0fe05e7211da130773b9290664c06930138f740d71e1a9b4930dad69dab1c49da226e48c63cf47b9e9a3cffb7e02e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884490, "uuid": "5423d76a-0add-469f-9b57-4bf16587d2c6", "value": "T1BE64C010B7E0C035F4B712B94979D3B8E93DBDB06B2491CB62D526EA5A346E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884490, "uuid": "be286bbe-18e0-44c8-a19a-30d2726029a1", "value": "1435fac27cb0e146b6806556c822ef8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884490, "uuid": "9699dbab-5b99-47aa-9fb2-3e741e2e0f7d", "value": "6144:2XIIYZG52amx4s7vSyD3IHja7nlg86p714fEiZ3zPb1:2XIIYY5ox4seS3IH25g8wxsEk31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884490, "uuid": "3452ba42-adbc-4de1-b667-00dcceda22e0", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884490, "uuid": "6a71e2b8-f1ac-46e3-895f-1c550ebec6a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884490, "uuid": "01ae0a65-88b1-4e44-8a11-ffdf54cda0fa", "value": "6112c72912e12d7f3490641386adf720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72190b45-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632896473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896473, "uuid": "0cd47dcb-1833-46bb-abf6-a5f663107ecc", "comment": "Malware payload (SnakeKeylogger)", "value": "4adaae6efc360f86055290d9ba0d6bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896473, "uuid": "64738d2d-2a2d-4d53-bb5c-2da5a5efe756", "comment": "Malware payload (SnakeKeylogger)", "value": "aca8469fdd9ad2f21e1a7142848f3c133c8cd1fed509657b15cd7088562df48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896473, "uuid": "675023a5-5b43-4027-816c-b512c73dfbf8", "comment": "Malware payload (SnakeKeylogger)", "value": "ba018af2a5040c9917839d086ec8d235cf7a3c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896473, "uuid": "b1a5518f-b18a-494b-9d9e-f59f7acc7a2f", "comment": "Malware payload (SnakeKeylogger)", "value": "60ae5caf09a65bfa32ee0402b587f9a63ecbb0c3ee2ea0dc26c9517fac46ecb6b79fcb1e2689bcba1d66188f3d88a97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896473, "uuid": "1bc7abbb-71b4-4c18-b620-faa59709630c", "value": "T1ADF46C2AB60CE65AFD1433F02524BCC411F81C981C6CBA17BA7672E6B4B9D27DCB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896473, "uuid": "6ed0d2ef-fc4c-4f98-9925-a8da147744e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896473, "uuid": "b25b1e4d-b6a6-4778-9921-376d0f890fc0", "value": "24576:cD4VHfQe6ZyWshg+qbZxTZZWunAWvB3M3zzvT:8V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896473, "uuid": "e96f72e6-2283-4025-b1f7-2d47e814b1b1", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896473, "uuid": "b51c2051-be94-4d23-8ec8-cb519f6bb067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896473, "uuid": "b231de84-c146-475e-b95b-a788a7960ae5", "value": "OPFC Project in the Sakhalin Island of the Russian Federation Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee1b9fc-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1632898266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898266, "uuid": "22755169-f5b3-4052-8a9a-edf1bafeb881", "comment": "Malware payload (STRRAT)", "value": "83506918229f7f1b22076662402d6371", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898266, "uuid": "b07d55e8-5463-4863-a269-3e120a62f689", "comment": "Malware payload (STRRAT)", "value": "ad37b8d1063ab026ee0133ee2a7c11b0b27a6beadd4b19972d3474aa01f4313c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898266, "uuid": "7d831b6e-9104-4a2d-9c66-c8fce6745513", "comment": "Malware payload (STRRAT)", "value": "a860fd4ce9770bdfdca5636da40f4858fa72dea6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898266, "uuid": "9fd5466e-f18e-44e9-8a9c-0b6f967cb0c9", "comment": "Malware payload (STRRAT)", "value": "7125cad77d6d95f225cd102e6d7be64525363ed505aee457adc399292a82f5a4d95046d95f263433d398813ee0e3a257", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898266, "uuid": "dc5463fb-65f0-4929-8bd1-d7ec32fe07c4", "value": "T15304025AE8F7D1A1E11B393BD98CA142EF1D0698E20AF52B24FC09D54C7086D4B47E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898266, "uuid": "a906cbe2-d9f5-4a40-b2ce-449d6e990bfd", "value": "3072:loYPMIZAREYnVe21eL9mibrEjBrus96mIra2KnnAF8CodoFjo2CWACNsCP0s:NEeYEYnVrALpnaV96mIrj648EhoKAxCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898266, "uuid": "34bddf53-de60-44c1-a6c2-11c50cc33ded", "value": 188655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898266, "uuid": "a670b36b-59ca-4345-bbcd-f1c27cfe3623", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898266, "uuid": "726510b4-ffa7-46f5-bbd3-65e011f79d45", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d48b0e-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898390, "uuid": "486505a9-73b3-4f59-8a81-e490092edcc2", "comment": "Malware payload (Dridex)", "value": "fd1e038a5f65858b67c32bb2ad358877", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898390, "uuid": "2986f432-6dba-4d69-9189-4f5559c686ea", "comment": "Malware payload (Dridex)", "value": "ad854fb86608824045ce92ecd71c985f53ba6aac4313267584e0fa205b00bc91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898390, "uuid": "d5aaa703-de4c-41aa-9bf9-c241cc5a1213", "comment": "Malware payload (Dridex)", "value": "02eb4df9fdde89a34538d12bd89f30b915b9006e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898390, "uuid": "09af363d-bb0e-44f2-95fc-232d33cedd44", "comment": "Malware payload (Dridex)", "value": "377465df460537ee10008fb8a9af0f9efd9a85877bffa848f8b1882699f8b45de377e0a6e9b7dfd5991470cf8b5ba745", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898390, "uuid": "5c7aaa69-11e3-4a56-bb98-627cb6b1dff5", "value": "T1FD16D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898390, "uuid": "00577612-e018-47c1-b9d5-d4f255aff9f3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898390, "uuid": "edcc169a-c2fa-47a3-8415-6e89a8cca530", "value": "12288:yVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:vfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898390, "uuid": "943d2876-a149-4e7e-8f86-4ba3b96ec986", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898390, "uuid": "dc44aaa4-4cc2-40ed-9276-d3aeeb7f7ead", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898390, "uuid": "9fa7add7-58ca-43cc-be9f-ba11b55abf4e", "value": "ad854fb86608824045ce92ecd71c985f53ba6aac4313267584e0fa205b00bc91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226c8109-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901064, "uuid": "4500313d-a090-46ad-afb4-0ae639b2af14", "comment": "Malware payload (Dridex)", "value": "d2304b7fc19cbccd5a9c5cebe72461d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901064, "uuid": "62b4cc37-a3ec-4e47-a1cb-fa08fd7a21ff", "comment": "Malware payload (Dridex)", "value": "ae0a1f5bfa1b50d419bc4201ae5bb8be4938e064bc19e567096b4ecb9232fff8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901064, "uuid": "e5f9aea2-be5c-4526-8736-da5ad0c8a75b", "comment": "Malware payload (Dridex)", "value": "1a3f1308de9c94a8f706ebe9d02c5026717b23ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901064, "uuid": "f141f894-0dc3-4b59-8543-6051edb7b477", "comment": "Malware payload (Dridex)", "value": "5ab9ae4eff4d2f8589bcefa9061ea9749e1d992f339160121b9083a6ffaec6fd737d5b80452b36f81599b2c6758b364d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901064, "uuid": "a2b85c49-1632-4b41-a694-15bb1b60e898", "value": "T14695E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901064, "uuid": "8f8ae44a-c228-4825-a5d8-8f44d9868181", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901064, "uuid": "c06d72b0-aee6-493b-862e-12e2b4f9d70d", "value": "12288:0VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:xfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901064, "uuid": "f2b7737f-2b68-41ed-a23d-1ccc733a1743", "value": 1929216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901064, "uuid": "733a7f01-8f7b-4b57-be2f-fb312772eb16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901064, "uuid": "249899c9-5d51-4c76-8fc9-982f5003b726", "value": "ae0a1f5bfa1b50d419bc4201ae5bb8be4938e064bc19e567096b4ecb9232fff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746129b9-20fe-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632903778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903778, "uuid": "130ca20e-3ff2-401f-ade4-d073dc8fda40", "comment": "Malware payload (AgentTesla)", "value": "cd1643259273a3b7336fbb35dd4deed4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903778, "uuid": "3c442d4c-ed87-40a6-8574-503e3edc39c2", "comment": "Malware payload (AgentTesla)", "value": "ae8e0872739e9f01bf288575b4e4997043fce8346a56d37eb824c5b6d0739bb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903778, "uuid": "874fcfd1-5224-4980-8509-47b0c44c7c22", "comment": "Malware payload (AgentTesla)", "value": "0f605a9391dbc6d79a4490908040282d97731ad8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903778, "uuid": "a0398265-1c2c-4550-ab4c-f556e87b9057", "comment": "Malware payload (AgentTesla)", "value": "df0a722bb6f1a93103d7e35e0cd621d8b302ad40dca7472fba28ef0e1fbc38c2020f2b2f55c47149c85eee03834f7a61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903778, "uuid": "92a5c640-9328-43b7-95c6-c99d7ccc5365", "value": "T112C423C92D4DD321E76ABD3979C37682A678C6CB00677E773284D893E6285048DF0D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903778, "uuid": "48cdf3e3-da8a-455d-89f0-34daec865846", "value": "12288:/jYD6vg3GtuLjKu7pQ4HCD2zmYuK7LDaO4yECcpWGZ4C:LYD6vg3GY7pYAmrKXDthkpWU4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903778, "uuid": "4aaf9439-2dd9-468d-8fbf-74b9891be08e", "value": 586147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903778, "uuid": "849b7c4c-b589-468b-b835-bd7c99a0139b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903778, "uuid": "3a671d4e-999b-4f9c-beca-fe718926a3a4", "value": "sales contract 500MT.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2db044c-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901414, "uuid": "567d823e-6176-4f09-9732-1ba417947ac5", "comment": "Malware payload (Dridex)", "value": "71b785c379b7f6d26ba8073a9748cebd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901414, "uuid": "e8c1f3c2-a72e-464e-8c07-f8d4dae9fe6d", "comment": "Malware payload (Dridex)", "value": "af66ab7f6ca775be94db0314ee9c9648ce1bc3bbf24bedd5268afff09459dcd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901414, "uuid": "9b3f1f3c-33e3-46ca-8257-1e42605925c4", "comment": "Malware payload (Dridex)", "value": "6d4897947835e1e621db17dcd70dd267b0b3b08e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901414, "uuid": "9f82a3ed-4db6-451c-bc7d-ed657dde13bf", "comment": "Malware payload (Dridex)", "value": "075418e2db4a2a9f1869e9a2f4b8c3a1e6a6bdce43707bead08e6e7b44e3b231514caeb63349847b3cb13e9d53e0a435", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901414, "uuid": "2e8c1c59-6aae-4d51-b6b8-5a3000b072e1", "value": "T17265D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901414, "uuid": "c4ce6a91-080b-450d-8d0d-f2b2e6404d9c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901414, "uuid": "15f57eec-3734-4771-b785-53c7e251129c", "value": "12288:dVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:EfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901414, "uuid": "0d140db5-ca35-47bb-af4e-5c5c127d8679", "value": 1544192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901414, "uuid": "e9efe340-6bd0-4d7d-aaa3-84116dc49357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901414, "uuid": "15a00a18-248d-498c-9e43-7c4f7a8b29f4", "value": "af66ab7f6ca775be94db0314ee9c9648ce1bc3bbf24bedd5268afff09459dcd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db779b1c-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927574, "uuid": "1f4356d9-4ff6-4e83-9560-6eb0b2eea360", "comment": "Malware payload", "value": "5ce792c789b4f543dcd483328705b149", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927574, "uuid": "e655cbf1-ad14-439c-a13c-3aa791c223a2", "comment": "Malware payload", "value": "b05b77c57fd3fef88f05f5a7d0013f80885e148217c3f38f56aedd342464a86c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927574, "uuid": "f8477c34-8898-4620-bba3-409f8d422492", "comment": "Malware payload", "value": "def861f44b722e4f5f96e90aff6de12f3ff4427b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927574, "uuid": "2fad5234-a032-4cc5-8b05-7720172c4bf2", "comment": "Malware payload", "value": "f276eb2c2e6f0db5a545a3f91ecc76d597261fb5544d515fe36a42763537550e7721e9d2d4ef00f4d75b0b1b528f2e1c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927574, "uuid": "73a88187-11be-47cb-81b7-50ae02dd3637", "value": "T1EB724A96EB31C4B5E6BB01F2697119ADB94E4B82038B00F759D42D2C5F8C9EB3D70892", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927574, "uuid": "e4b8d031-1683-4679-a411-c9b4782ab24b", "value": "4304340aad7451ea3b2124f2acc3795e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927574, "uuid": "fae036ea-ca25-4d0c-9605-32dc9b5913b0", "value": "192:+1B2ZkRQCVSgiAw8NKJfN+++zktFRlsG8Nh/rXzJw7H0OYY/+76Pf316U:kMivLipPJrReLjz0H0c+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927574, "uuid": "ecc32ed4-6fa9-4983-9ea1-a4feca42d1aa", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927574, "uuid": "52be8ab7-3bd4-4556-8500-23b1b5a2348c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927574, "uuid": "61259715-3110-4a5f-8de0-adfcc1bbf9fa", "value": "SecuriteInfo.com.Trojan.Inject4.16715.25797.20586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c27732-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884713, "uuid": "c6796633-cb54-4b40-8e6d-87db391a5ad2", "comment": "Malware payload (Gafgyt)", "value": "05fe8433a1c9419eac27a2ed41742d9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884713, "uuid": "c295c555-1bd1-441d-9a2c-9c945cd096e7", "comment": "Malware payload (Gafgyt)", "value": "b0a1631ca5b86904e53ea07ab4bfd29e8cf901cc7ed0da96581329977ccfbd74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884713, "uuid": "6f085d70-de2d-4932-bc56-17ec8ddd82b7", "comment": "Malware payload (Gafgyt)", "value": "4a9559cf8d62e94a61dd8d67493d65ceda7b97e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884713, "uuid": "22053291-6aba-4d7a-bae8-e3fd519ead89", "comment": "Malware payload (Gafgyt)", "value": "389e7587316bc252e51422db780a04387ec3d67c2234800afbb41f20d68da2d7874ec86fa5e861b4f63650b4f470169e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884713, "uuid": "db530091-89f0-46f0-8b4a-496ca6691641", "value": "T1B5044C09D640875BC1E327BAF68B424E33339BB9A7DB331959389AB43BC17A90D36511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884713, "uuid": "13567258-d026-4119-a94b-7db794d2f15f", "value": "3072:pbLjb++IBxChl9aTSyYv3Jdk7CEuQKsptm4l3M/9PX6DYmU2wYxmvPN3:pbXb++MM9aTSyYv5dkuQKitm4hM/9vB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884713, "uuid": "d3f810c7-e6fd-4c01-8794-b5a20265b62a", "value": 187765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884713, "uuid": "47116978-b2fc-4b4b-ae4c-063e10d034d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884713, "uuid": "fe383b17-ba18-4fdb-b49b-32d5048dc642", "value": "05fe8433a1c9419eac27a2ed41742d9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116609ba-20f2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898458, "uuid": "fbf3e99b-9c1f-4fc9-806b-84d2a39dd74c", "comment": "Malware payload (AgentTesla)", "value": "49c777124579e4ddbbe7b1cf807ff5ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898458, "uuid": "ef2c821b-460b-42b6-bb8a-e381fcfb3cbf", "comment": "Malware payload (AgentTesla)", "value": "b0a7c65af364bab19ffe0980a830a9ff280e9bb3b4f56fb3c057b4b1002b5054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898458, "uuid": "b4351184-a690-48d9-9df1-e79438328140", "comment": "Malware payload (AgentTesla)", "value": "a3726c816f1a84d9645d02777f4a5f50090adbbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898458, "uuid": "fbe99691-f385-446a-a6ac-d410a8df17de", "comment": "Malware payload (AgentTesla)", "value": "5bb4501ad3db9dcae80ffa894e84c1e4c72e09ecf1868242f761ce77caa739bf92bbd17b8d39088ff3cbf3cba769fb4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898458, "uuid": "71df8171-77e2-4457-a3cf-75b1221b80b1", "value": "T195B42330ADA4FA05F24F3AB165552CCAB74CD87ECE4364056B43E63451B04EC59A8EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898458, "uuid": "d589e956-ad42-4dd8-bb40-1d3e7995fe37", "value": "12288:5MF//jQPh/iaJYkST5M63dd9jTckLuHHB1wqnh5vuH57nlDT:5MWZ9ikST5MENhunIM5vuFlDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898458, "uuid": "9610a593-8b84-443e-a400-985327875ab0", "value": 535596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898458, "uuid": "4b98f59a-be85-4548-99a1-1f6a79f6e3a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898458, "uuid": "fea39e51-bd8c-4800-847c-88ea5817c1e9", "value": "QUOTATION ASIA#2109.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26227d5d-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902788, "uuid": "05594506-2972-4eea-803a-15d412e9d2c2", "comment": "Malware payload", "value": "8228eca26de7c5e091ca2c8032b403eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902788, "uuid": "e4f250b1-8bbf-4421-af82-272085a170ef", "comment": "Malware payload", "value": "b0bfbec19dbdf3416a3cc726e7ac201dc898834d7fc60613632d4dd4370b6512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902788, "uuid": "4d992f52-e2ec-4874-9898-4cdb5841f693", "comment": "Malware payload", "value": "f2b8039d63e8990a4cc46081603e1aa8c68b6203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902788, "uuid": "cb6055d9-e4ec-4114-8778-5d9a762f2185", "comment": "Malware payload", "value": "af9398f0fe3e96a4c56e5d3253f41c0146898a69a928ce70dc6ee67f81cb0614f3c5cdca897e072074054ceaa6b0f890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902788, "uuid": "23057298-8723-4cc7-b7ec-f1f50479b50c", "value": "T10573CF05AF410E08E7F80B3209DC76DA067FFB4ED67057CA5D1E69A82B33B9059E0764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902788, "uuid": "e85fed42-4356-4205-9aa8-4c981a66aa65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902788, "uuid": "794ba00a-b3ff-4744-911c-92650477b73e", "value": "1536:psHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtP9/s21rz:psHa3Ln7N041QqhgP9/ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902788, "uuid": "be484d90-10d7-49f6-9509-70752600e815", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902788, "uuid": "5d72f53b-d0bf-4c42-b268-9a19a6042329", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902788, "uuid": "5ab5a263-cbee-4629-99de-ac3b5e41ed4d", "value": "b0bfbec19dbdf3416a3cc726e7ac201dc898834d7fc60613632d4dd4370b6512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a52892-2118-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1632915082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915082, "uuid": "48f7c481-774f-4d58-9d17-dea3c27dbcfe", "comment": "Malware payload (Quakbot)", "value": "879628efe6fb566fc83cb019a4d90f5d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915082, "uuid": "1ab9d5ee-27fa-4862-a9b1-89189ca352eb", "comment": "Malware payload (Quakbot)", "value": "b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915082, "uuid": "30bd8ce6-96ee-48c8-bdf0-7c307a82ab5e", "comment": "Malware payload (Quakbot)", "value": "b4eb4da4ed99f50c0e02b12c23b2ea65dceed706", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915082, "uuid": "bad9f74c-37e5-4c9b-94e2-29dc949700de", "comment": "Malware payload (Quakbot)", "value": "8f5ff7ecce2596a4970087f1f33b5bfbf4447d660f7b1867836ed5ea8fe6c9d80872ce8ff725b48bc99c3cae64d3277f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915082, "uuid": "a36f2365-c5c0-4530-9e11-f14c6aa987fd", "value": "T116A45D407A59F525D2A85A368F5AE5E807487D09DFF9704F78D03F0F3ABA4A3C62530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915082, "uuid": "144b949e-cb11-4651-b12e-e67abd1beea7", "value": "41236dcb3f0ee486c9586fc42b5b299b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915082, "uuid": "2dafdbde-6eaa-4479-9798-75bee759ed84", "value": "12288:KvT1+i+eRbPqeSIvNMenaJ8WECkSNDopGI5coPYb:Kv3F+ex1MrnECBf3oPYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915082, "uuid": "2c0c1eba-3319-4329-a949-51b3a34436c7", "value": 458965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915082, "uuid": "3bbbfdba-5438-4163-8923-b5efe5e3f545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915082, "uuid": "0658132a-9567-404c-8102-5717c24bae39", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abb16c2-20dc-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632889159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889159, "uuid": "facb8a6f-eb51-46ba-89a2-7ae59c3d47db", "comment": "Malware payload (Mirai)", "value": "8b4c5a5d30c68309170484d8d6cb296b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889159, "uuid": "44d40373-9826-4f42-9574-e3d35174cf20", "comment": "Malware payload (Mirai)", "value": "b19ca975a8e4878e5e03c32837d254f7bbdce812930ecafe48e736a276a60e81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889159, "uuid": "9aee0a27-4c57-4abf-a2d4-e097737829ba", "comment": "Malware payload (Mirai)", "value": "ce99b7985e14a3e2f1610190ec02eda618865da1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889159, "uuid": "5f53fd4b-1ad4-43eb-8707-dd84cac67b19", "comment": "Malware payload (Mirai)", "value": "31ec615a378eb63195fa294a04ae652f38c277831908ddf7af16d13c5e7b6b01327a242e9c1f2b0b0e1681290cbd1cf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889159, "uuid": "d49f2651-7767-42ac-b77a-52e251a62c36", "value": "T1D9D2E1B2D4ABD4A3CB5129BEB7F00FCB2B114FB2D095A433ED0C08A87E604A65F79111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889159, "uuid": "327744a7-ff8e-4a12-bcdd-0fb67a4dcde3", "value": "768:7rXirNJScKUr1GC67w6JyOWEyBaHa1xatAWCC9q3UELQg5:7rXbc71GCJOxycSxE5C3L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632889159, "uuid": "77e5a5f2-1954-4900-b537-9a2b6b7b6396", "value": 31112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632889159, "uuid": "9e28703d-e30f-45f9-bd09-efd2882fbaa8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889159, "uuid": "e6c8cec1-61c2-4f80-b2b2-276db28e2879", "value": "8b4c5a5d30c68309170484d8d6cb296b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2670487a-20dc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632889045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889045, "uuid": "a201d1bf-e8e5-4055-a2f5-d7880106e451", "comment": "Malware payload (AgentTesla)", "value": "b77a71057aab8444c048e97a318e88b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889045, "uuid": "6bd2cf4c-edfa-4aeb-b03b-d85165b341e6", "comment": "Malware payload (AgentTesla)", "value": "b1be4144db3b7179ea3eb78278d6a4aacbb13db5b4daf94cd2b98f604454eb25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889045, "uuid": "56f60196-72f0-446f-8451-d6864507b726", "comment": "Malware payload (AgentTesla)", "value": "290f40ddee5cdc420dae0975433fe065e4c9fc35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889045, "uuid": "b6ded064-f338-45c2-898b-302d9a43b140", "comment": "Malware payload (AgentTesla)", "value": "c58af0f560f15be2c121fd474edfd705b638a9a924142f877874bfe8555639980b7ea961e7b8be7f6dd54be1a34a791a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889045, "uuid": "2f182ea5-f39c-4037-96fa-b7d12431d975", "value": "T19405E0237A48EC16C22432F9A8A0D1D9167A7E846C45DB067970379EDAF8F93DD1E10F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889045, "uuid": "6ca7fd8c-1c92-48f2-9d5e-ac7be4812d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889045, "uuid": "545ac22c-b0a4-4a83-93e7-c3f358df6333", "value": "12288:VEz3M37WZDqsAeXUD3/AsWSn5BXqvpanF9yvb/TEoWIIAP++NBH0O5iX6AO:C3M3cTAT/Aon4pgnyTgf61TAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632889045, "uuid": "769d4ae6-a526-4e14-be78-3cc8d1905f64", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632889045, "uuid": "86a0db26-d6c3-4f43-9a58-dd1b54c7a53e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889045, "uuid": "1ba019b0-a864-4933-9c09-49c738acc169", "value": "PRICE QUOTATION OCT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057976dc-213c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632930221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930221, "uuid": "cfca40de-5980-49d8-bc15-74ad7184ea3f", "comment": "Malware payload (AgentTesla)", "value": "aeaf818b8ccfeeab95cec6f369aef1f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930221, "uuid": "1ac1511a-6b6a-463f-85e5-593d70e64c1c", "comment": "Malware payload (AgentTesla)", "value": "b1ce7d9d06a13bc7d657d74f4b8c45860444a60b17bd8aa03fa79b2a7d621d18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930221, "uuid": "b73326d5-cd96-4112-9e71-a2fb4e415e2e", "comment": "Malware payload (AgentTesla)", "value": "98a306a10532e713929e8d1ff6dd69d8cf354fca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930221, "uuid": "94e12d68-e7fa-495f-9aca-79e4af594948", "comment": "Malware payload (AgentTesla)", "value": "a61a07f9dbd64968f9d750b851fd288c776101eb6a993ebdda819d4cf05f5a0866cbcf330eda134e59a296874d140f10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930221, "uuid": "9d6a14c4-ede5-4d2d-872e-5d3ad697132c", "value": "T1D3A4AD3669CDAC27DBE01EF0EF51FDEBEB27984305F50F0292AA7966225D4427311272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930221, "uuid": "91dcaa8a-fe37-4950-b0ed-301831c7f870", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930221, "uuid": "5fa89749-e47c-474f-adde-84845e0feabb", "value": "6144:m8LxBGtv5HQOd75tbIEX0oBA8OBZWXhquE7uovixuJpe5k2bQ:uv5dddTEoBGZWXhquHvu/1mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632930221, "uuid": "90bbe511-f181-492d-b4ac-877a0b6e070e", "value": 481454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632930221, "uuid": "7a5377a2-bee8-48eb-8ef5-4ba568b1314b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930221, "uuid": "a3a2bb9a-9ec0-4972-8c55-ac3b9a62cbcd", "value": "DHL STATEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00088187-20f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900577, "uuid": "83397a54-b1a1-4022-a152-ddd849c1f89a", "comment": "Malware payload (Dridex)", "value": "06effa778a2a805203c4af335d725d2b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900577, "uuid": "8ec8cb83-f870-482d-9500-5b7c30b45e60", "comment": "Malware payload (Dridex)", "value": "b26b58a0fd0811e31a1f53e914784db5736478e1272929ed075f71bc4b48dae9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900577, "uuid": "6d47dca8-007b-4fb4-aade-f6e427c7e896", "comment": "Malware payload (Dridex)", "value": "4e41f99864618fb2b8b3342b67cbfd448dbf6b9e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900577, "uuid": "6f347e52-f0b3-4d8f-b110-82d18ea1f4b9", "comment": "Malware payload (Dridex)", "value": "c8943e3933df082fcd36ae3da8f2253a246d8114da25123edbe5632126cbd6103fd7f31be9866a9e932322655126ace7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900577, "uuid": "ca9d2dc5-8b82-4f91-b6e7-4f2191a32046", "value": "T15395E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900577, "uuid": "377a427d-169d-4aa0-b177-cff783e92003", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900577, "uuid": "c8609baf-a084-4a8e-b556-29aa0761e03b", "value": "12288:OVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:TfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900577, "uuid": "7cfe177e-1162-48fe-abc7-32e4e1a085b0", "value": 2015232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900577, "uuid": "df37b73b-5e64-405d-b342-8f03f8b3bd8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900577, "uuid": "9de547ef-a5d7-4478-abab-5939424175e8", "value": "b26b58a0fd0811e31a1f53e914784db5736478e1272929ed075f71bc4b48dae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9086a418-20d3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632885357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885357, "uuid": "57805c22-376d-4269-b64a-928072547d83", "comment": "Malware payload (RaccoonStealer)", "value": "8fc231b273bce371d521d8ce5283aa6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885357, "uuid": "0c492b07-cce3-4c9d-afb0-2bf98f399f39", "comment": "Malware payload (RaccoonStealer)", "value": "b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885357, "uuid": "8d09b56b-5833-435c-80be-7b2de7a389df", "comment": "Malware payload (RaccoonStealer)", "value": "4edb2f91be0120c3fa3fad07e295b1cd3bbd381b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885357, "uuid": "746dfa8a-700c-4662-b60a-8810498ad5aa", "comment": "Malware payload (RaccoonStealer)", "value": "7f76c1e664d970e2a8c85e6c816fb07d4c40bc483a45f4b0e54673e2785a07d83c46723f30980d457252f453728ff558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885357, "uuid": "ce1cb21a-03e2-42a1-8830-88587d368c85", "value": "T1DA349E10A7E0C034F5B712FA897AD3B9A93D7DB16B24C1CB22D556E95A34AE0ED30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885357, "uuid": "55ca2a22-aa63-49f2-9f4a-17d5c73152b8", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885357, "uuid": "9f3fbf33-25d9-483a-abde-3f53525fa694", "value": "6144:OpC/k1eo/ameoQnPXL1d2ZlPojSSOFf7/WV:OpC/kEoXeoQP7X2Zu7OFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885357, "uuid": "8af826f1-5e52-4bd2-85ec-2576d2e3cf0e", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885357, "uuid": "ce6ab8b1-01d6-4710-a203-5bf53f60072b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885357, "uuid": "89fbdf54-e297-4a7c-8c3b-b7ab87085f02", "value": "8fc231b273bce371d521d8ce5283aa6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91feca2f-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901680, "uuid": "65ffdd76-62a9-493e-80dc-c7b75d28308e", "comment": "Malware payload (Stop)", "value": "4e6afe8c311af44e888e5f4cc1c8e1c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901680, "uuid": "c419d6de-dbec-4bed-bcb7-3078e3f7cf01", "comment": "Malware payload (Stop)", "value": "b2cfd5cd948b40e9152e4dd8abe0aa346ba030afae6974b1cb598be87bafe2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901680, "uuid": "4c8afe3e-fcbd-469f-a0f8-9ed66d7f6796", "comment": "Malware payload (Stop)", "value": "be358e02b328bf52276a09938fd777d513eada77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901680, "uuid": "f50ac317-93c3-4837-96b9-4df0921dfa42", "comment": "Malware payload (Stop)", "value": "84a11aae09e31650c68c35b1aa526f92aba99d62ffeb8ceaddaa8b40c03010c4822a6235caa20c059cbe437ce8e1baf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901680, "uuid": "cacf9ab8-9b44-490c-82b4-bc82ed922df4", "value": "T1BDF412017792C1B2D4D21D32583AEBB45A7A7AB21B75948B7B4407FEEF303F09916B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901680, "uuid": "ae0aa55e-167d-40ee-8ec3-7c3d84c144ab", "value": "65186050f9601ee4db4aa7e9ce7b7062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901680, "uuid": "f4095bcf-d781-49c9-90a2-497bc4fbe439", "value": "12288:mNx4K9CHVfpC67AhI1Oz1L1WrsZHe77kOd38tS2hkeOud1sxVei+Wyfrb:mNx4KcvC67AhZznWoZH4kRs2hkeOkaxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901680, "uuid": "e4b9be62-f73a-41bb-a78c-6e72d1b1c7bf", "value": 747648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901680, "uuid": "edf64e1a-b910-4899-a52a-a6d9eb4256ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901680, "uuid": "e8f1966f-e467-4ec7-a4d2-872691d56f4d", "value": "b2cfd5cd948b40e9152e4dd8abe0aa346ba030afae6974b1cb598be87bafe2a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a65c199-20e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632892085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892085, "uuid": "c11af3d1-2295-4ab8-a6da-20969f8dea88", "comment": "Malware payload (AgentTesla)", "value": "e0bb17a3b225be38d4ecc6ba76f78b6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892085, "uuid": "03e30f1b-4215-4316-b9d8-3ae5e9fb1de1", "comment": "Malware payload (AgentTesla)", "value": "b2d6777b33ba1ba760b29c17264da5113cb34953888047d9475c834cf8b4d3bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892085, "uuid": "2c3e04c1-4937-4771-b412-e6eab89aa6fd", "comment": "Malware payload (AgentTesla)", "value": "42811454e31bcfe2ae9b40e3402fe3402c63543d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892085, "uuid": "50462453-e7dd-4f23-8b1c-01dfb64f4c2d", "comment": "Malware payload (AgentTesla)", "value": "bbae8ca8aaa940ed0134b40d41e1d42ecdb5923140057dd802b1b456db55a8136c943b3f73315d4db54230256efad169", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892085, "uuid": "6b0df732-05a7-4aac-875c-beb334c494d2", "value": "T1AF739DAFB344D5D3E0D912B6EB87C2B8C132B53107BA53391CA59AC75CBB3188F456A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892085, "uuid": "1b150a5d-5d06-42bb-abb2-4dec69d28d8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892085, "uuid": "d4e304d9-81a6-4513-a9d5-6d18b3bf2cff", "value": "1536:f9mabJ49WorRjCuJYzRjNzb0Eo1Layn11K:f0ayjJYX0Layn11K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632892085, "uuid": "a4d4e5e6-a7c3-4c0c-8400-38ba9ec53447", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632892085, "uuid": "6cf83378-8aaf-4dcf-8298-c47b35a2b60d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892085, "uuid": "94b3ea3c-a82b-4e66-a73e-6f4c2bd65e52", "value": "FRT_INV_0344202_1,PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36ac44b-2137-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632928339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928339, "uuid": "8f5be60f-8ff0-47f5-8c30-1de5e5c6afe8", "comment": "Malware payload (Gafgyt)", "value": "cc7582a39f7a52b30f071b59594dc9e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928339, "uuid": "5bc8f59c-dedb-4c84-a0a0-33f7d37f515e", "comment": "Malware payload (Gafgyt)", "value": "b3000b4d6fc4b4d575c84bfd3e58ed27df56c882df7637053e2bb6398656fbbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928339, "uuid": "626e4666-3563-4940-a6c8-7ca04788fd10", "comment": "Malware payload (Gafgyt)", "value": "36b80d49552de4e23edf3d34ab8f7604006b4219", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928339, "uuid": "4fd5f3b5-5a0f-402b-9a56-c541d63b91a2", "comment": "Malware payload (Gafgyt)", "value": "2f6d4e6dac6e1f59761142cfc3512a6f65fe2867c57486f0591039be5c2024356fa36ec38375c304aad3252b73858c8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928339, "uuid": "8db95243-1814-4968-9d05-ffb9755a2c3a", "value": "T156F3F648FD44577BC2D327FAEB9D038E37361AA867DB33119A344EB12BC17986D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928339, "uuid": "ef4b9dd1-71f8-4079-9e04-33f0c13b2da5", "value": "3072:UA3hTMeCjeqWD05hUQpe3Dj3uhU2Rm/KqQYbLcGOj1tq:/dMeCje9Q5hU9DjmPRm/KqQYbLPOj1tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632928339, "uuid": "b2f72ab4-3f6c-4188-80b5-ee775ef7abdb", "value": 158153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632928339, "uuid": "5aad9a83-56a9-42b7-a59f-1381f9731975", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928339, "uuid": "99344c07-b154-46c9-a81d-c3e6eb827c8f", "value": "cc7582a39f7a52b30f071b59594dc9e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c123268-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898127, "uuid": "91a7ecb0-1711-49b1-8ce1-b2d1020ac544", "comment": "Malware payload (AgentTesla)", "value": "c56060fb824fb85ad0f62196b41db8a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898127, "uuid": "02270894-7683-4a25-aeec-a41bc95c71f0", "comment": "Malware payload (AgentTesla)", "value": "b39cf37d9c46b943e0ad015ae77bc1f955ee64a84de43d63afd1d808f8b93227", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898127, "uuid": "95965a4c-fc4f-4e30-aae5-cc64a06a99cc", "comment": "Malware payload (AgentTesla)", "value": "cd86e03d9a634f5c290f04beb8880c27be552c2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898127, "uuid": "bdf468cc-196c-47a4-a3c3-17b863d5bb09", "comment": "Malware payload (AgentTesla)", "value": "d24636f85777119ba230348a0bb554ddb4f7ab5a876f8de91d5c8b73a108dd7c700c3c618917cae9e0054903434e58ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898127, "uuid": "913b166e-c673-4abe-8a42-63e79fb3ff97", "value": "T1BDC4BEDE1C64A7CFFB0E01F8FA79279C10ABD068D4EBB5D3D606B033106AA695924CD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898127, "uuid": "848442f2-5a14-46e0-9476-fd7d7b751a40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898127, "uuid": "76bc235c-f015-40b4-82a9-c8091f966ec5", "value": "12288:PizNi+hBr7IUA1LYpAFVg7BlNfB9HSNlXi4h6SiP+:qzNi+hBr8UA1Z/4PZRSPxh6HG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898127, "uuid": "0f33d626-3627-421a-8a86-130d00dff564", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898127, "uuid": "4678392b-2d09-4adb-8b78-14ae714fdf26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898127, "uuid": "5eb87ec0-d04f-41e4-8bb0-0e51402cc74a", "value": "dhl_doc88654325571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032a8583-2160-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632945679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632945679, "uuid": "7f1e36a8-fbec-4f22-baa8-b57d043e9ab6", "comment": "Malware payload", "value": "1eb05a1af93579718f2f7389db23337f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632945679, "uuid": "41301cbe-2914-465f-8163-780b6ca40d89", "comment": "Malware payload", "value": "b3da6e1803b8aa6a2b726dd0517c38fc355b1aa4c97de638d860b6eac203794b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632945679, "uuid": "b4cc6c0c-cc03-4b94-9600-d573a131290d", "comment": "Malware payload", "value": "b7aaa66fb248ecd8bf833c43e9d99f859f1b97c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632945679, "uuid": "dc94544e-3a5a-4684-bca7-7a4fe284b03c", "comment": "Malware payload", "value": "abb8c9165c2fb19b7e7123e27621e4b978146c02312872eae2577388b60ac3109fc3ebc4abf082e016fa48a3e4ad67ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632945679, "uuid": "0e6a93d4-bb8c-46a7-9492-d9781655d319", "value": "T17824F1B8D06759CAD958D1B8A7AD77303F6691B7780C28F8AEC3887C82F71101539B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632945679, "uuid": "26a7506e-2a99-4a0a-843c-6c22af3f29a8", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632945679, "uuid": "be7338ce-cda0-48be-8ec8-30686b66bff5", "value": "3072:GLVaDFq8d1HaD8CBbezrSHdMqNHqRUiZNRieJEl+GNjqdRI:Gxac8d1HaLJmKd3KRUiZNbErqrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632945679, "uuid": "cc8a96ee-09bc-4ca2-a3af-f98d7a5e05bd", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632945679, "uuid": "3beb0c14-f6bd-46fa-9b7e-ac9e5c3dd5e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632945679, "uuid": "4a2f1a86-17ab-4941-b3db-f2da39c214a3", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c2be2c-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902794, "uuid": "6042bd9f-afd8-4b0a-86c3-7188fda11e25", "comment": "Malware payload", "value": "50869c528b2e038c027989990c152832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902794, "uuid": "de868c6a-08d3-4d23-93bc-29a9dacc64ff", "comment": "Malware payload", "value": "b3e9e8c8b80d8b94afbd59425407c13252ba6ea9ed08c09e7c687585e500cd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902794, "uuid": "c9687835-a384-4054-a37d-7f999b29bc96", "comment": "Malware payload", "value": "7a42a82e6737b82bdac95bf07556d53364333968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902794, "uuid": "c064e748-0b38-45b9-9fc4-d53357933648", "comment": "Malware payload", "value": "58120dba338462552567acc5246206f88ad37b60bc10a874f6024b37959004313890cd5272cf95d752e34a8f96882afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902794, "uuid": "acf0cc46-dfad-47d1-8a63-4d73a0fd81db", "value": "T13A73CF11BF812E48E7F91B3316EC25D606AFBB5A9DB097CB682D89D84F37A4084D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902794, "uuid": "2f6d88f3-625d-4314-bb35-54f20f4000c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902794, "uuid": "d71b0e83-756c-406c-9765-a337fcd138cd", "value": "1536:HRWtHHM3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQte6B9/+1aQ:HRWtHs3xSyRxvY3md+dWWZye6B9/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902794, "uuid": "2e0f21e4-79a8-464c-b593-d926a9797474", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902794, "uuid": "91d72f9a-2174-4ead-afd7-aa7e2c172b99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902794, "uuid": "e7b34464-89d6-4798-af55-d665b0a1ca5c", "value": "b3e9e8c8b80d8b94afbd59425407c13252ba6ea9ed08c09e7c687585e500cd99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f56876-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "67491cf6-3fb8-44e3-92c2-7d5d3922092c", "comment": "Malware payload", "value": "8e2988b289c2e21669a659a0d1e1eac4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "a0bc1432-830a-4e71-9a81-b4f09b0e7181", "comment": "Malware payload", "value": "b43a2de0827224df43038e377a7c39d88302d5d337d9f665ac358c3748a81fc0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "7ba374c8-f040-487c-ad67-11bb5d1f5542", "comment": "Malware payload", "value": "5a2bc5319c5468c9c008778e9c5b5b71ea8d4ce3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949204, "uuid": "4be2fe91-d698-4f06-b09a-7ebf81552317", "comment": "Malware payload", "value": "c7f779b1871ec21c147b9832ecababca94b55a8c471266c89ed140de74b5a2a14733318b2054dcecdd0eafef74279d70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "abd95a95-a9cd-4d06-8bbd-075fa15f5942", "value": "T181833C02F743C6B3CC830BB2029BAA665931BDAA1E269F49F31D7DF46B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "5c82ecfe-27ff-4752-b561-62207e09a1bb", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8Lv3WnKClmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yr3WnKClmEwVOz+ucx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949204, "uuid": "ec89b2d8-a66b-4a1d-9dc7-6bbdeeddbcba", "value": 85005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949204, "uuid": "93c10c19-640f-41b5-90fa-dba027e4a97f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949204, "uuid": "b70ef55f-2a3f-4f14-a55a-48b60cbb6ac1", "value": "razdzn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ed888c-20cd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632882759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882759, "uuid": "cb3b887f-0f4a-44ee-ad62-d11668c4278d", "comment": "Malware payload (Mirai)", "value": "f8b6a889ee811c367de131159f710397", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882759, "uuid": "3e209a22-e700-4d1b-857c-78dbbb89c24f", "comment": "Malware payload (Mirai)", "value": "b4a7845ee454df3cafddb25583f1515c41c6c127eda0778702e4fc954bf3690f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882759, "uuid": "37f10809-7aab-4d59-a115-77c17fc0daa9", "comment": "Malware payload (Mirai)", "value": "38893bcbab1905b33e797546d971cbf4120a6b8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882759, "uuid": "5a051dfe-875b-4cfb-b114-5e404693491e", "comment": "Malware payload (Mirai)", "value": "7579e2a6f2e7cd5450af990e187049c429ffe6530e381e883b007fd20bc4d83522e1f54d3861cdf86c997de62296b0c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882759, "uuid": "30693f55-a7b8-4d35-ab0f-0ce1833c51a3", "value": "T11313F120D1D5994ACEBEFE302549E5DA16944BEE43B98D63301EA713B36AA34C8624F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882759, "uuid": "226186e6-426a-4e02-83c6-13286d893008", "value": "768:Q0VYo3qI6kjoasR6bVP9SXSksVUa+DGC/hFZNyknVQ3Svclp/TkPKiHNP4uVcqgs:Q0VYA6ioas89bUZDJ5TNyki3SYSXHNPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632882759, "uuid": "b9f81287-2f60-4509-b685-beb01c6bdccd", "value": 43168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632882759, "uuid": "984ee95a-c3b7-463e-af49-7675e3b1d0bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882759, "uuid": "bc4553e8-7820-4d17-a360-fe390d9f2440", "value": "f8b6a889ee811c367de131159f710397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa4456f-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632899261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899261, "uuid": "d0f595c1-e1d2-40b6-9721-23893a24a6fc", "comment": "Malware payload (ArkeiStealer)", "value": "16e64e7b842fcb8b72e9b5732f6dd18c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899261, "uuid": "fcdd58d7-8253-41ae-8ec6-0eea08c08588", "comment": "Malware payload (ArkeiStealer)", "value": "b4b9574d1681e6fa3fda139c0f58773c5f2850b25f345fd9d8b358cb02044189", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899261, "uuid": "92ccf28e-39f1-416f-a8fc-f4bb7e78f141", "comment": "Malware payload (ArkeiStealer)", "value": "d2d6917496ae956f09bdeb5b350fcca83f88da5f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899261, "uuid": "b495743b-2149-4171-a4f3-671d60958379", "comment": "Malware payload (ArkeiStealer)", "value": "346c42b96c411ad511a423791235e2b946c955d92087c530a9590b46677a68f90d4ea47dc093987e38cfcda746ee98d2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899261, "uuid": "70f9a692-8fca-4187-8de9-2a5edb0599bd", "value": "T1D414CF00B590E2F1C745113E6816CAECE92DB86DFBE09A773B58A2DF5E38193F521352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899261, "uuid": "2520d154-4c82-4941-a91e-3b3efadadfc6", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899261, "uuid": "a852f33b-c5b4-4b7e-9585-63dde3cb01a3", "value": "3072:Ya1qQA5osTfGOJdL3QkK5kOrcPI1Ze6TRkr8EuSzsz:YaM6sTJnLnIcPI1LTyuSz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899261, "uuid": "fe82d2f4-cbfc-4197-8878-86a40c162f8b", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899261, "uuid": "864077cb-2f8b-4fd4-b910-21e00d28d721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899261, "uuid": "33490b44-0fa6-4c4b-8f51-00f3b6515f05", "value": "16e64e7b842fcb8b72e9b5732f6dd18c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ac12cf-20e5-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632892857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892857, "uuid": "594ebbee-dcc7-4936-afe8-0875ce2544dd", "comment": "Malware payload (ArkeiStealer)", "value": "ce0ee9cc369220f390f1464dd76c510c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892857, "uuid": "2d24e024-177e-4f8e-849e-f98271e6dc1e", "comment": "Malware payload (ArkeiStealer)", "value": "b50c7130579836db25bf5264f66b21f4d182ec753ae19fb0a52b33f7ef36dfd4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892857, "uuid": "82025365-f2b5-4f40-8b1f-681033b82770", "comment": "Malware payload (ArkeiStealer)", "value": "85f4402a53b76521da3c611c5f67b8e797c9b874", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892857, "uuid": "0759a23c-539b-4f33-aaf5-f78d2e610f72", "comment": "Malware payload (ArkeiStealer)", "value": "717c4ac5c70673a86634e1eba1419cf959d21661bd04866e48cad93fa3ab0b1a8a9f6c180ce41853013b59295cd32ebb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892857, "uuid": "85fde9db-8739-4437-8a1c-1a6d68fa9370", "value": "T1CBD41204B441E3F6C365413F9465CAACE93D784EEBF9A2376B5097DF2A757832A12302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892857, "uuid": "408b1f74-6cc7-4c90-8574-21ba3d4039ef", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892857, "uuid": "8f7c8928-a285-43b6-812d-05db74ec3c33", "value": "12288:OI/DwsoviwLysbu1hAEMlGMJOgkmq+4JL2p4ZxPUybYp9S/MMZ/qQNI1Ewp+:OewsZwk1hW/ONJZDYpc3Z/q8I1Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632892857, "uuid": "0990b254-0ad6-45a1-938f-a70dcfa74834", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632892857, "uuid": "446e426f-f062-469c-abaf-4a1b3ff701be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892857, "uuid": "7cfb1cee-a6f8-4a4a-aa39-27cb8767c83c", "value": "ce0ee9cc369220f390f1464dd76c510c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0474077b-2101-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632904879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904879, "uuid": "f6440ae4-7c02-4b15-b31a-6261d03c3f82", "comment": "Malware payload (AgentTesla)", "value": "d6dc593c5d58d49cc3291abe28f28b38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904879, "uuid": "26460dda-67da-451a-8a69-f7d524a9b98a", "comment": "Malware payload (AgentTesla)", "value": "b5b8d6a657b8fba21600aedc5b9a4df3d93a09489185c8cad2b3c1353dd19ac9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904879, "uuid": "aeb60fc9-c0bb-4a28-9dee-1c213a35f8da", "comment": "Malware payload (AgentTesla)", "value": "6002d43829d7282797cf8c85928d0d82f7856f3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904879, "uuid": "c6719daa-a302-4fe9-8879-cced3597818b", "comment": "Malware payload (AgentTesla)", "value": "b6a1e1576c1097e1e8e349347de2f37407c7ddefd6191a628b3e506d076a6fe1b85579b488d4b28e5e9a2e747bff4d30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904879, "uuid": "98386ec1-1781-4bf2-8938-f471cc7ec326", "value": "T155B42385A07A60B3B1C1B8B35BE04B9AF1AB1106363631F451D7FA9BD4A8FC90745C9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904879, "uuid": "7d20844b-8aa7-4080-b8d1-63c2dea46d88", "value": "12288:l4E4NJGqutIvU6p/2IXwuugt11Dr+5JVy6CevDtQ3TmMGtBkNJ:lrEMZIco77DqR8Ai3TMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904879, "uuid": "a5ba91e6-026d-4f76-9722-33ff9d635b0b", "value": 538415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904879, "uuid": "c4f84b06-1aae-4e92-92f2-0d09366c6824", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904879, "uuid": "113358b9-f44f-4c9f-a219-f3f33fd09b34", "value": "SOA.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48eca4a9-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901128, "uuid": "7d615279-d630-472c-b7e0-e001ca9b0f9f", "comment": "Malware payload (Dridex)", "value": "46ea3b0d591a95745da4d9c608b6689c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901128, "uuid": "ba1de13c-91d0-4d68-8df1-cd6ab31d8e5d", "comment": "Malware payload (Dridex)", "value": "b5e5ca2bff30e70fc7e033161d4218852f050af0e2ad34bec534f1c1bf51f38a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901128, "uuid": "68f2336f-3b61-490b-9829-351aae43246e", "comment": "Malware payload (Dridex)", "value": "56f11887046950d3c43d6b4c964cb5f62e01ed09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901128, "uuid": "6b493197-85ba-4327-a624-f99a4b08d8ee", "comment": "Malware payload (Dridex)", "value": "32c18431e45ca68b9856faeae5c209f1b1f6440609d1b01393ec9af28da566113fade3fd20a37ae9cfff7f76b5f0d7f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901128, "uuid": "e6c128f6-50e9-4866-b6ae-f146057d4eb6", "value": "T18C85D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901128, "uuid": "93e157a3-d993-4881-b881-2493e2caabf3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901128, "uuid": "99f9ce98-b55d-4196-b829-e50a007fd638", "value": "12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901128, "uuid": "1d4707de-4f2d-443f-bdcd-2779827505fa", "value": 1851392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901128, "uuid": "41745bf6-f8b0-43e0-97a1-f53ea2ee34e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901128, "uuid": "2491a8e9-ab64-4957-87e3-9b8edd055c3d", "value": "b5e5ca2bff30e70fc7e033161d4218852f050af0e2ad34bec534f1c1bf51f38a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fc4f8c-20ff-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632904425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904425, "uuid": "d50a9fa6-5abe-4171-af8d-3262f87ffc8d", "comment": "Malware payload (AveMariaRAT)", "value": "2d92a7b054d2405b0c32c60a3936c23c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904425, "uuid": "30430936-465a-42ae-9b6d-0502dbee3fa6", "comment": "Malware payload (AveMariaRAT)", "value": "b6045e4e676cd38fe137fe5ef23d02f7ecc423074d01bc3d6b48043d7daae2b3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904425, "uuid": "aaeba0e7-9b0b-44d4-8fbb-cfdcd0ce2af0", "comment": "Malware payload (AveMariaRAT)", "value": "eec6ae7283dc9bd702c0cd362117a5774fb2b893", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904425, "uuid": "2f488e63-1765-4f79-aad3-a14dfa1dc264", "comment": "Malware payload (AveMariaRAT)", "value": "6e913e659d933d1175ee0898f263114427ef90809aa3e060994ea29fb32277c78393f52e39c207ccea2dbfad569c7cc2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904425, "uuid": "b7ee3471-4787-4009-8689-740fe4be76ac", "value": "T1A0F46C1AB60CE64AFD1433F02524BCC411F81C981C6CAA17B97676EAB4B9E27DCF505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904425, "uuid": "6f26fe3e-5a30-4c64-ae8b-30491740d266", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904425, "uuid": "69b16216-7345-4ad6-a94b-d736a8350529", "value": "12288:6D4VHfQe6ZyWshg+qbZxTZZWunAWvYz3M3fdlxbnOzxGxLWArkg7xNheLDO6KUfV:6D4VHfQe6ZyWshg+qbZxTZZWunAWvI3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904425, "uuid": "5493be59-bf3c-4955-a179-ae841e5c8a4f", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904425, "uuid": "1391671c-4062-4440-9428-1553c73a430b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904425, "uuid": "46dd66db-371d-443f-b179-0db815c9e910", "value": "Revised Invoice - UY445601 (Cancelled UY445601) Re New Sales Contract - PBM261120.pdf.exe.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00785ae3-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884686, "uuid": "37eee44f-fc84-4fed-a35b-ad698c40997a", "comment": "Malware payload (Gafgyt)", "value": "4f458c423a2d320318a9b0175ffc84ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884686, "uuid": "c4a27aa1-5156-482a-a9cf-3dc6d1903cd5", "comment": "Malware payload (Gafgyt)", "value": "b781dbda5e4ddc55ea39811b9a08fd7f0a6723c5f459d12a6b2945436f48d93e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884686, "uuid": "93384a4f-fee1-4b8c-aeba-fe499fd19fe7", "comment": "Malware payload (Gafgyt)", "value": "43d5b809cd545e3433ea5f48be4a1607e1293356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884686, "uuid": "7ad102a5-5128-43f6-b450-8d9614f5a1d4", "comment": "Malware payload (Gafgyt)", "value": "12d5775137f2ba4836fb091ab3bec83314244198fc00dbf9a35ad8f742109c3bab167cd46a2b1d93de00f642093d0485", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884686, "uuid": "01ea9145-2701-4f7d-a420-91ed61440eb2", "value": "T143C32B93B900DFFAF40AE67204D38735B670BB624F531662735B39A69D3A1D42827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884686, "uuid": "657cf2f8-b468-4d76-af76-02012a46c8de", "value": "3072:NRuHPZK0CT2pYk5Tw6clSy0rkY8RDfZmm2dczv2vcVrNO:N4o07pYk5T5y0ALDfZmm2dczv2vcVrNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884686, "uuid": "06f88f21-8299-4d95-96dd-4d6f74a357cc", "value": 119846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884686, "uuid": "753e4c40-122e-484a-bfc8-3796a6c49634", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884686, "uuid": "3094de56-f523-48f2-b0af-69e7bb65f797", "value": "4f458c423a2d320318a9b0175ffc84ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b7c21b-20b9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632874179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874179, "uuid": "945592b9-dba2-403b-b05f-dde281a07c95", "comment": "Malware payload (Gafgyt)", "value": "2d46b5a24d840d4af62e92f54431a92e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874179, "uuid": "45bf68f3-79e1-4ce9-b452-6ab454f9c645", "comment": "Malware payload (Gafgyt)", "value": "b782941c6e800b79fc50a3ebd0fbe9cad516d85fd71f10d4735b7ba69774a2a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874179, "uuid": "7c50f6b0-05ff-4e4a-a20b-6c71b5244b49", "comment": "Malware payload (Gafgyt)", "value": "612fa09bf2758eeb4800dd11515ffae2bc655722", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632874179, "uuid": "19c1e49f-7d58-4a2d-b398-b694eed34570", "comment": "Malware payload (Gafgyt)", "value": "6d9ec42b10a5f3c81ab57666ab278ed4a23cd56fc74a2836333f1b194e8db5012e9f707c40d8ba1dc0b456099a617402", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632874179, "uuid": "8d925e05-275b-4f8d-a5bc-1805918a2561", "value": "T144B3D96A3A21AFFFD06986310BF7AF2087D422D626915383F15CD7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632874179, "uuid": "5ea19093-8501-4ab0-8f17-9044adaae277", "value": "3072:0VW0fIHznlZZ5h50qBkxmkizF9GhsRiAe:0APT3Z5h50ZxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632874179, "uuid": "bdade7ed-674c-45b1-930e-1edc04190567", "value": 115243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632874179, "uuid": "eef28e62-78f9-4de7-9b60-5143403bdee1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632874179, "uuid": "b6a4f43e-11cf-451b-a3b2-8e9dffdf1f76", "value": "2d46b5a24d840d4af62e92f54431a92e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f59618-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632908747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908747, "uuid": "663f5b81-9907-4904-ad4d-ddf1c7a49294", "comment": "Malware payload (SnakeKeylogger)", "value": "28675ea63dd64d12b61ba90451e0146b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908747, "uuid": "b9ffed90-40e3-4724-84ee-6dea1cadaf9f", "comment": "Malware payload (SnakeKeylogger)", "value": "b8af46d9c0b7c5f29e6d69e42817f7f89573466afeae41a9af514a3fb69b2266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908747, "uuid": "daa5d782-90a4-4625-bbc1-f64559a6cfc1", "comment": "Malware payload (SnakeKeylogger)", "value": "8a3438e642c5d2e826f0982cc92d545faae8eea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908747, "uuid": "877e55a4-8267-40f8-bac6-24c347b0c265", "comment": "Malware payload (SnakeKeylogger)", "value": "04311708a14c01e8d4319713771d95e81581b0f895b9296b577a2022e1b8158e379a97a8e9072ddd4d71bc8a8ba739e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908747, "uuid": "85885fbc-f79b-43d6-a044-c3cc23745d59", "value": "T1C0C1D58197E88739F2B24B7E8CB7C3419235FF11D963871D24A4121A5D257588A63F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908747, "uuid": "0288eedb-d119-44b3-a1e1-d1293aee0efa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908747, "uuid": "1df843b8-939b-4aeb-98d6-1d32c88afb90", "value": "48:6tspF3P6VOVTGvIU5nuJSFPgZ8bM7hAQEhX9znHjKdWfodjlcSWMRqV2/XSVEnSu:1pt6U+PgZ8bMEhX93Ktda5V26VnzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908747, "uuid": "7d5570c7-d16d-453e-847f-7c6ca14786c7", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908747, "uuid": "966b40af-532e-4b1e-8011-fa43da707eb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908747, "uuid": "69d75bd9-6ee7-4682-b931-e67f60dd9204", "value": "nnnnnnnnnnnn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fcd376-20d1-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632884457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884457, "uuid": "eef3a5c3-72f8-4ccc-a947-3320a648f313", "comment": "Malware payload (ArkeiStealer)", "value": "60c2f38969bd847e011936cdf71e8870", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884457, "uuid": "36fd36ef-c1a0-4c1b-bfb4-7a76b053ab8c", "comment": "Malware payload (ArkeiStealer)", "value": "b9209d7d35e55f35a12503b6e8c2f2b5823436a6009d9920b1da00b7ef2bd9d4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884457, "uuid": "58ef5ec6-2bf2-498d-a6bf-d8e472296cf9", "comment": "Malware payload (ArkeiStealer)", "value": "3fa747614253f36b1ce84098a5fbdfc0867aecd3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884457, "uuid": "5a470d50-2f38-4cac-bbbf-2331685e1111", "comment": "Malware payload (ArkeiStealer)", "value": "f68f730703c6f6ffdce0502acf0dce893a1352a1dcc1bf2272ebeb30e48d7897b04ea5a45113ce1e7ab89350c3094ec5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884457, "uuid": "816118d0-7c3b-4a73-87ab-5c76d3706512", "value": "T1FAE40120B3E0C074F1B312F6457A93B9A82EBDB1AB2190CF62D11AE955757D0ED71327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884457, "uuid": "9ad5d4aa-f76a-4f0c-8643-1763920073ca", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884457, "uuid": "54ffd404-6f10-4e42-9723-e39e152b1206", "value": "12288:G+8/1kDg+ym+0x+brfS2HAaXKI5//M8pTSygzF2hM8s/bm:t81ktySurDHV6Sc1BC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884457, "uuid": "d1c35575-42d8-4ff0-8926-afb6065be9c0", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884457, "uuid": "fa8651d7-1035-4c30-b047-a6580fa804fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884457, "uuid": "90c64a7b-4fee-4ebf-92a9-eb824e2330ba", "value": "60c2f38969bd847e011936cdf71e8870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73723f4-2137-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1632928399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928399, "uuid": "0352b8ca-6985-4536-964a-659fcdcba355", "comment": "Malware payload (Hancitor)", "value": "32799a01c72148ab003af600f8eb40dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928399, "uuid": "f76ba27c-820d-4ed5-ab87-d696b626564f", "comment": "Malware payload (Hancitor)", "value": "b9bafe8645a4dba7b7a9bd5132b696c0a419998d4f65fe897bb6912c2e019a7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928399, "uuid": "13b84e81-0abf-4e66-bc34-ea3dd13867fd", "comment": "Malware payload (Hancitor)", "value": "4354221a3cf91f4827478be5c2ed2482fdb049f3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928399, "uuid": "9a929078-4522-405c-a9d4-3ae26f6e0a7c", "comment": "Malware payload (Hancitor)", "value": "5750539231dc7c67137f7b964368a509a8757b7bf6b58ddbe91a1436ef6e59b4183a8799e7cad47a07cfba5ef877c980", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928399, "uuid": "25384b4d-bb0e-4651-9031-54e263b6f6c8", "value": "T121448D40B596E832E5BD19350529E1A1093DBD204F69DDEFBBD43E2F1F312C25A30E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928399, "uuid": "ac13ccc7-ba93-4144-ad93-9ad2be168668", "value": "26d2f2df0a916a498a83a59770a0ba1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928399, "uuid": "3dd89953-2db8-47f3-ad17-643063425a43", "value": "3072:WEodghQxQ9N72yFTYkYPS2fp0dP2Oi0p7/vovkfoAg3EHcxAg0FujoTAYq7Duy+f:Wl8T2EYa2G3vpbPfYAOgAYqj+uJ4AfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632928399, "uuid": "fdcd06aa-9c26-4346-a46f-83838e31faeb", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632928399, "uuid": "0a5861ef-c46c-43a9-adf9-68025eb0d296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928399, "uuid": "9414f787-3f4c-46a9-bfeb-d1a3ea2f2fae", "value": "gelfor.dap.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d086b6-20cd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632882766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882766, "uuid": "945d8a21-d15f-472c-a2b2-3c7ad2916640", "comment": "Malware payload (Mirai)", "value": "1ccf7195a79d5499c2b15ad1e5e9939c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882766, "uuid": "e41fcdaa-e049-4ff1-a9b3-5948a9be0949", "comment": "Malware payload (Mirai)", "value": "ba030c5611cdd3b27da76ee70715b9b0f3548a105eb55cd57e80aefebd3e32c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882766, "uuid": "5c365a02-d3af-4051-8395-e599fd9edf29", "comment": "Malware payload (Mirai)", "value": "49fb825791a1540993f2a2b53945de0eb0a8e25f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632882766, "uuid": "25c6a43c-036d-42cd-baf3-e65a411bcd9d", "comment": "Malware payload (Mirai)", "value": "9e64923bae435db59d6dfcee2e10664ce6c6657772222650ade748518cb484ff2f9a6444bc8bed6e3566d39ce4ea9609", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882766, "uuid": "d053d4d1-fdb6-4cbe-9c06-418b83b51c0b", "value": "T19523F171B6BA2E80EDF064BBB4AB8981F0CC3739836FA4D513585715DD12D61287984F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882766, "uuid": "9e9b9c8b-842c-4b3a-b9b6-3735305a0a04", "value": "768:GaXflZxDS3l2LAFVkFdfR3HKCgeeC9saBe2UKSA/dXj9wwmCYWnD81ZyZf7NDs9h:p42LNd9HKC3fk7YdXLm5WD87yxZ1Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632882766, "uuid": "37889efd-30dd-4d3e-987f-3f52fa567328", "value": 48404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632882766, "uuid": "ade6cbf1-6af5-4fe6-811d-bce7b1775182", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632882766, "uuid": "106a71e9-9ac3-40ae-896e-dfbffc90f90d", "value": "1ccf7195a79d5499c2b15ad1e5e9939c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6b4f29-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900326, "uuid": "b9e4993f-7ce0-483b-b180-1ed22de01dd7", "comment": "Malware payload (Dridex)", "value": "7a81e664ab1e0fc32b949c2cf2b3c5f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900326, "uuid": "633ebade-c109-4323-bc32-142eec8c23db", "comment": "Malware payload (Dridex)", "value": "bae9d6084a97baae95bdb44f9911c3b7218cece02f8582a39d5dbc1bd419603f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900326, "uuid": "97c85312-e6e2-4710-a6e3-61732e44d847", "comment": "Malware payload (Dridex)", "value": "44f9f2c1d434d14cf30a87ebae4ac38d8099fa1f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900326, "uuid": "c2c7f413-6ded-4b02-a342-83cb211c73c5", "comment": "Malware payload (Dridex)", "value": "52ccb1f653abd0ec16ea190aa6e156f1da56501bf0757db96d2a5b4187d0eb4b8c719d0614153ca624e82c68e4f46545", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900326, "uuid": "d36e6bc6-0ac7-43cc-b4a3-28655a1d417b", "value": "T1C5B5E010EF69E1E6C6B89F3E9408352317F93D75110D608CD392608F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900326, "uuid": "21dec43c-4227-4514-ad78-588f1b8bdda4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900326, "uuid": "4fe8d559-c936-4aa1-94fa-a9b69dade4b6", "value": "12288:aVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:HfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900326, "uuid": "b546bb26-71db-4684-aedf-fc46006a1a43", "value": 2355200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900326, "uuid": "4ccbf8c0-d79c-4e52-a865-9b023d8e642c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900326, "uuid": "f053cbbe-0025-4767-ac22-39c6e898f75f", "value": "bae9d6084a97baae95bdb44f9911c3b7218cece02f8582a39d5dbc1bd419603f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287bc989-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900215, "uuid": "966d8ccf-c525-4f4d-b91f-ee0a74a87e53", "comment": "Malware payload (Dridex)", "value": "1247e206bee588b9ea709de94c170ec5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900215, "uuid": "2e9f66be-4e61-4228-9f2b-953fc2488c98", "comment": "Malware payload (Dridex)", "value": "bb050dbac61b29a7f350d9063c13d376c8d6f2ad37ddb879f720b5219963b538", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900215, "uuid": "6c316e47-6573-4c8e-9359-7f1eeb24edbc", "comment": "Malware payload (Dridex)", "value": "09f2f1f9e117ef1dd450e8513637dd561134ae0b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900215, "uuid": "fbcfa154-b045-4b68-9a7b-47781098c22b", "comment": "Malware payload (Dridex)", "value": "e2aad6d083224d57b469774e6415098c27aa84f3c44dc7becf6fbd3601db53de9f795fb785dc38fe47fc32175bb2e33d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900215, "uuid": "b4ab31f5-ea1b-4260-b5da-37c82a6df953", "value": "T154E5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900215, "uuid": "c02575a0-efd1-49da-a182-fe075122f807", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900215, "uuid": "ec59a0c7-6c94-4eab-8345-3833496fa5be", "value": "12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900215, "uuid": "e0c86f6f-19c2-42c5-91fd-b5d1ba4d4ac3", "value": 3092480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900215, "uuid": "ccfede90-8e64-4f0b-ae8a-61042f691491", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900215, "uuid": "dc0827ed-bba4-4695-9279-e02ea8b0b327", "value": "bb050dbac61b29a7f350d9063c13d376c8d6f2ad37ddb879f720b5219963b538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41dd01c-214f-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632938782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938782, "uuid": "648f53a5-d080-4a41-b691-289df4a203c6", "comment": "Malware payload (ArkeiStealer)", "value": "d0abb90b475c139f4efdcf826b67b1a8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938782, "uuid": "543b44ee-b05c-4808-9e8c-a338da76af0e", "comment": "Malware payload (ArkeiStealer)", "value": "bb826a7e963a520ca0db23551c77c508b682d3e691b23a627e091785247b841c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938782, "uuid": "7eae207b-bab8-42c3-9203-90b7bb6f0bb6", "comment": "Malware payload (ArkeiStealer)", "value": "f36452d8b59959a9df1e9213cfc01e4a7e841e41", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632938782, "uuid": "362b5896-561d-4259-a74c-30baff339310", "comment": "Malware payload (ArkeiStealer)", "value": "0711735c6aaad2f368cae02e5aa27ba3e3bc71f0a390eaf141b3f6de4549b6cd75742275c21c5b1768b3e555b7e98c4d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938782, "uuid": "999e860b-2c2f-4be9-9735-43210af86c00", "value": "T1EFE41211B042C5F2DB3401734896CAB4E92EBC6DEF2016F76B445ADE6F7E2D1CA12356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938782, "uuid": "b17adf39-1994-42ae-b845-bd4a1f6fc8f5", "value": "ca5041463b2dd933d009ca1aebe1423c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938782, "uuid": "edb3184e-e6e9-45ed-af61-dbe47e37a072", "value": "12288:A2jSyEsel0GudLIHE2fleGet8EsEJKASShONonkxzI1seW:AyDEvyLIk2fwGgs3ShgaGI1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632938782, "uuid": "a2dbbf42-cb2f-4e0c-aa0b-40e888c9a352", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632938782, "uuid": "2ab942bd-25da-4399-a2ae-1658835cee6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632938782, "uuid": "8775bdaf-e51d-460d-9e58-caa262a10aa0", "value": "d0abb90b475c139f4efdcf826b67b1a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075075dc-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1632898871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898871, "uuid": "22df0521-b201-4bea-a491-26a456a6254d", "comment": "Malware payload (NanoCore)", "value": "978092c99b8ca01137e5340112257432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898871, "uuid": "12090e2f-8912-4168-bf46-1f981dd6b5b3", "comment": "Malware payload (NanoCore)", "value": "bb9bfe8005ea5d29b91d9286c81ca934ce6fbc4fa0bcc5c2d404e08441775e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898871, "uuid": "2617ef77-0061-4bd8-94be-6eb74bc7accf", "comment": "Malware payload (NanoCore)", "value": "24739a6b70565a2042382ac83b8f36c2a637a58d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898871, "uuid": "5a503625-fd58-4b0a-a4fc-82e89cb048ed", "comment": "Malware payload (NanoCore)", "value": "0d556c10b19be0d5cffcb31e736779641af86669ff7ef93b0f5a3a4d2609e2307c64cd635eae1852804d0203d34aa63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898871, "uuid": "4ea73864-0f9f-4aa6-be36-574a3d971a8e", "value": "T1B7C4AF766D41BC9ADEBB0974CC0539D04C063E779263B088AE85369E5C77212CB7AD2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898871, "uuid": "0daa0381-5e98-4354-b38a-3c1a0599949f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898871, "uuid": "7dd48dc3-0065-48a0-a927-cfdecb25095b", "value": "12288:sbsaEuPjbITYEqJ5X1yyLZUzHxedJaOoMPP1StOA:s5PjZvXKMsPftOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898871, "uuid": "42c81056-e1b8-420d-94fa-bdcf107895ea", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898871, "uuid": "4e0e072d-7ba5-4fb0-a897-be8327467ec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898871, "uuid": "ece50de4-9641-418f-b47f-7d8c0caad3ed", "value": "978092c99b8ca01137e5340112257432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9997ee-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632908835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908835, "uuid": "e8087dab-0913-458a-bf98-8f672c13026d", "comment": "Malware payload (AgentTesla)", "value": "ef2993bfab7a239801296f2ed419a3cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908835, "uuid": "3a94db09-7646-476b-8c1b-b452d784d8c2", "comment": "Malware payload (AgentTesla)", "value": "bbc4a223ff1aa2330e937fe4090732ec2743957f01529bebbceef20a7db5a932", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908835, "uuid": "40c758ef-6569-4cdc-b7d6-2799864457a9", "comment": "Malware payload (AgentTesla)", "value": "8f5f77da4f028e378a0653494f58be52a370c2d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908835, "uuid": "671c7d76-0f4a-4125-bc20-7f79c58f697d", "comment": "Malware payload (AgentTesla)", "value": "dcad6b1d5390ac82a22961ceb6f93004e74a77c0d0f4c5163f435250d93ff8e3ab297db59776c011defc72535c653834", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908835, "uuid": "5c55e130-cabf-4c62-8693-71828a204af0", "value": "T187F49D69F60CE29EFD0903B021297CD425E80C6D197CF917BEA6B5E330AED7991F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908835, "uuid": "6469a73b-4f80-491d-95dc-e50fbaef83db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908835, "uuid": "1a0cddbb-2dbc-40e0-9aa9-2c9629f8cab4", "value": "12288:Z4D4VHfQe6ZyWshg+qbZxTZZWunAWv6Nvt3S+FhnvfLisBdu/KhpCtnRr1RasVlI:GD4VHfQe6ZyWshg+qbZxTZZWunAWv6dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908835, "uuid": "b086ae95-5ef6-452f-81d3-3eaf19c9975a", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908835, "uuid": "24b6bb33-076f-4fdb-8d71-46851ce2a87c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908835, "uuid": "1f9cbd50-3d8a-4c7a-86cc-faa081ff0667", "value": "DHL Shipment Notification 2151584805.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90f745a-2117-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632914631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914631, "uuid": "55c39fca-978b-4cca-b62f-25f6efc8618b", "comment": "Malware payload (Formbook)", "value": "cb98b8cb0d393f8139a8b472e1df64f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914631, "uuid": "1b550ebc-6816-42c6-b5ce-b72606e63fd3", "comment": "Malware payload (Formbook)", "value": "bbedcbe77cff074e73d9265b5cd4dfaba57b573065b1cb36e7944880a54239e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914631, "uuid": "364bfebb-6307-481d-b068-14c4a7e36956", "comment": "Malware payload (Formbook)", "value": "f57893ee437446d4fb40e6a0642d1cf05965fb72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914631, "uuid": "fef61c2a-4633-4d8d-b6b2-f69b0490e7d9", "comment": "Malware payload (Formbook)", "value": "569d1903415e2921940f5a2d043ae55202289ecddbcff818f857e29ea804174706942a07a20ddd5b3e657945351e2ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914631, "uuid": "c089d43c-0535-4d5d-a5d0-0a4fba33b273", "value": "T13454E150E180C6F1C702153E9825CBECA13F7D4DFBE8A2776B1526DFAE79193B522242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914631, "uuid": "922d3433-e263-4a86-97e1-dc484a8b3070", "value": "f249badb491e7862c803d80af2d74342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914631, "uuid": "abc1bebb-935a-4f9a-a88d-07aab6358955", "value": "6144:UurNbTll262Ad2J/JIpQSH1u1gQNdcpBnvhqcPI1+uSzy:XrNbTzOA01J581uiXBnvh5I1ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632914631, "uuid": "3bc9b1ae-29b8-446d-9026-5c0d5bd48cf9", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632914631, "uuid": "1cc75c55-88c0-4f87-a49f-7bf666dd2bd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914631, "uuid": "7ded6475-aa44-4a1b-991a-619a22f2572f", "value": "COMMANDE EN VRAC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e328940-20d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884414, "uuid": "22302e8e-5ded-4a82-a281-8e44ad422881", "comment": "Malware payload (Gafgyt)", "value": "fe74da4da700e9fa252c70ace8f10f18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884414, "uuid": "fe768e32-b176-4867-9fcb-4195cbb0c305", "comment": "Malware payload (Gafgyt)", "value": "bbff0cbb087d962a613a2b01a05e84a3489df4b675bcb69300e5de4e24806e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884414, "uuid": "ddbf95fb-48b8-41bb-8627-0a9c46d77502", "comment": "Malware payload (Gafgyt)", "value": "8654c7eaf0fa83e895b42533f5486e879bae0864", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884414, "uuid": "ad67d20a-4156-4d78-b608-59b645a2ed29", "comment": "Malware payload (Gafgyt)", "value": "eb82bcb730774302db7435b98a8826d558eb627d80e7aadac0e92f8dea2f3f178d4151b322f3238d31e250e9c074d616", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884414, "uuid": "984a74a6-f5d2-4cd0-a0b9-2d08d2f96e92", "value": "T1A2F3947E7E21AF7EE26887310BF76F70C395219626A19343E16CE7185E7124C289F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884414, "uuid": "f85113ef-e069-44ce-ba1c-a1f646b24eaa", "value": "3072:OmP4RbvVmoYbYHtHB9Mp7an9BEgmOTcuaWVw62VNO:zP4BhhY7a9LmOTcuaWVw62VNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884414, "uuid": "35aefc70-238a-41dc-b222-6c6822bba87b", "value": 164451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884414, "uuid": "290e4c10-6e83-428d-a37f-91228644c60d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884414, "uuid": "c0e8380b-63fd-4945-98d8-7dc0067e6e88", "value": "fe74da4da700e9fa252c70ace8f10f18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7ffeb4-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902799, "uuid": "f267dc5b-8eb7-470c-85bf-b0d339c4dc0c", "comment": "Malware payload", "value": "6ff264f56b8611221dd3d64938c4160f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902799, "uuid": "433d5fdf-f4c1-4d57-8828-c5c1660a70af", "comment": "Malware payload", "value": "bc7cfa3ad92fa44d404c4fba2a9cf9f959af7941f21262df4f4b26999869328f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902799, "uuid": "0dc86445-842a-4d54-ac9a-182762afd87a", "comment": "Malware payload", "value": "3c9feb3f200fc7e5588be99ef4e27fc360d98ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902799, "uuid": "2479e868-dc4b-4a37-a8ec-9eb661b83491", "comment": "Malware payload", "value": "8bb1fde87cf590bf5dced844130e813c1394557245430c1f2331d9ade50023ad6dc1e69a34d30822eb15e1c9888be58f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902799, "uuid": "d6297f57-c592-480b-a72c-8caca9b2962b", "value": "T1E973CF127F821D14D7F90F321ACC31CA0ABFB74E9A705BCA1C6E99980F37A5459E0B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902799, "uuid": "acd30081-ced4-4fd7-a4b4-7e7aa0a27814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902799, "uuid": "b48833a5-fe8f-4252-a55c-cce54be055de", "value": "1536:8RWV5jKLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6e9/uo12+:8RWV5j0E2EwR4uY41HyvYp9/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902799, "uuid": "239cd88f-a376-4091-9806-e2f1443ac08c", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902799, "uuid": "99847feb-85cc-4775-a27c-8a5ce9c7cea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902799, "uuid": "348449c4-9355-43f8-818a-136ae4caf7c5", "value": "bc7cfa3ad92fa44d404c4fba2a9cf9f959af7941f21262df4f4b26999869328f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98462037-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900403, "uuid": "2e57abc4-19ae-407b-9a83-e0571d1011ac", "comment": "Malware payload (Dridex)", "value": "19fcdeea428fd58a8cea07c8c4e17767", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900403, "uuid": "a89fefc0-6437-4d3f-829f-16cbbd3daedf", "comment": "Malware payload (Dridex)", "value": "bc81e080955bc01ce7add8716f4ecbd0eca2c0ba0602ac3f13e5db041c252414", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900403, "uuid": "6459fd1a-bc85-4241-8ddf-da829995abd8", "comment": "Malware payload (Dridex)", "value": "eb2217eb21284ccf52967836eaec3a27df396fae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900403, "uuid": "9b2a502a-984f-4f8b-9317-0588dc96c76f", "comment": "Malware payload (Dridex)", "value": "be676b7f55ad6ce2ff7a232cafde4098a9986374aa6df371b9d4eedf0f5db1784716b61f4ebd2a03ed8eaaa044317e62", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900403, "uuid": "a874dea2-70e0-494a-a5c0-b924fba0887a", "value": "T190A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900403, "uuid": "6cfe10bc-fbab-4ecb-8189-da281e0df63d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900403, "uuid": "5dde98ae-41a4-4175-80c5-137bfc57675c", "value": "12288:YVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:NfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900403, "uuid": "d8baff52-b02b-43c2-8572-9f54d14ae4f2", "value": 2211840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900403, "uuid": "f8b2651c-b636-40ac-a017-356ec88cac70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900403, "uuid": "57ac72c6-ff6a-4d68-82bd-490744cf5906", "value": "bc81e080955bc01ce7add8716f4ecbd0eca2c0ba0602ac3f13e5db041c252414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc2d26e-20d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884678, "uuid": "d8a9d569-1f45-4667-9083-6d2f73cc08f0", "comment": "Malware payload (Gafgyt)", "value": "2ac5c223ecfc5ed4f4c31d2484143284", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884678, "uuid": "7900452c-acc8-4722-b040-d60bbc58c5b5", "comment": "Malware payload (Gafgyt)", "value": "bc888818e40b52f80633f05d4b19752174b798c17b166cc499c95c69b89bfe79", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884678, "uuid": "aedaadd1-d269-4220-b9f8-ac61e76cf0c6", "comment": "Malware payload (Gafgyt)", "value": "62ec50bbae00a83d280d2618f0c3d56aa5a4869b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884678, "uuid": "e9488e91-ca2a-41f3-a50e-9c95a81ba884", "comment": "Malware payload (Gafgyt)", "value": "9ffa67f8db4d0f302fa747570c913d14ce19abbbcea0e097f08cd55e89d5fdb1e519e70222a92f00df567ae217e421cc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884678, "uuid": "b18d7715-246b-41f8-b505-2e8ee188e298", "value": "T1F7C3492767B1DA7BC0875AF227EFA5E2D413F53D1B32222733956DA52B198C81D2D203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884678, "uuid": "21c1a83e-c37c-482d-ac10-3b173f21a178", "value": "3072:whYHFiGOyw3lf4sSCb7vdSVLGRXzKDobAm7qOV/V0JKVTNO:P2+CXl5zKDobAm7qOV/V0JKVTNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884678, "uuid": "bdbac026-da10-41bd-8353-24d535aa4e3a", "value": 120112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884678, "uuid": "086d3bbe-b735-496e-9c8b-476d7f01b84c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884678, "uuid": "a0886ae6-b6e4-43df-8f3e-68e47cc733da", "value": "2ac5c223ecfc5ed4f4c31d2484143284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf8b85a-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901808, "uuid": "db8f4100-addc-4378-b8a4-f1db05b9e491", "comment": "Malware payload (Stop)", "value": "a416ec22456c12986fb2e9983b23afc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901808, "uuid": "88c30006-9954-4075-8f5a-65a6bdabfedf", "comment": "Malware payload (Stop)", "value": "bcaca8a95189a898417c977c42e8160fe81c68ca603557e3c30b38be666b808b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901808, "uuid": "3e8a6149-f13c-4d88-ace2-7c8ebc3642fa", "comment": "Malware payload (Stop)", "value": "8512223787c8d1367ba64f49316a3255c9aed8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901808, "uuid": "b76dabe3-072a-4ba9-9fe1-79c602ca1e64", "comment": "Malware payload (Stop)", "value": "4c18341a85eadfae0fdecce76f655554f28f017d36e6d03b8184a79f071f0e14db4d3e0c079ae4906d96136cda1b8cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901808, "uuid": "73807754-6727-4161-b333-de5f222d48c7", "value": "T1DCE412E176B0C832EBF355758028C2E01D3E7862DE6B514FF28C164B6E3D3869AD5762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901808, "uuid": "f96f2c31-a5f6-43a4-a8b4-440e80d7cd94", "value": "ce4c7ed44a96045386f2afd2e6f500aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901808, "uuid": "ea53774b-a0dc-4039-a52d-24dac7139e15", "value": "12288:1P6oVsI4JakFrCIGrYn3bqYREwC3zDwwq1QwudCxmG0ZlmvpYEWmRq9XcXvxdErr:FhL3kRXGEn36w2qmwSbZlAfWmRq9wvE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901808, "uuid": "f7778968-59eb-485e-ac9d-f0b039c43c58", "value": 709696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901808, "uuid": "804fc2d6-da05-4030-91b5-963b799e9f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901808, "uuid": "d178372b-0329-4edb-a11e-574f3470b08c", "value": "bcaca8a95189a898417c977c42e8160fe81c68ca603557e3c30b38be666b808b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d091237e-2116-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632914241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914241, "uuid": "53ffba05-a4d2-4638-8066-b4b4fc2fc799", "comment": "Malware payload", "value": "ab40d2395f7abeee43552ae6a750044d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914241, "uuid": "879e0d53-89d3-456d-8826-477fc0fef7f5", "comment": "Malware payload", "value": "bcc26c979a4d7b0afec88bdf7c864e965db3041616acea4cda1874ba476e74e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914241, "uuid": "be999b8e-4919-4362-93e8-fdaf32621c7b", "comment": "Malware payload", "value": "6d6a406e51934998567bb3318633a8f281dda509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632914241, "uuid": "8e1e2f3b-d852-459a-a124-8be4698414df", "comment": "Malware payload", "value": "1d33d06584f0b607ece653f166f4a122b3825f7d7109f06fcfc8476825c152623407d28347f7242596356ae6dc12a794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914241, "uuid": "9196d7c2-77ea-4328-a6a6-f3170973a6d8", "value": "T1014633287AF43FF7E7DBCC30DA4CAC18914CC1B3D6A994889D62F8ECE66B5152346512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914241, "uuid": "f5b14ed0-4fff-4794-ac5c-1108eb648288", "value": "fe4b72c1e87d00ec8a399de3b4432210", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914241, "uuid": "f022328d-2aad-42c8-bc75-8633ab3164f1", "value": "98304:MlVyw8BbPnvCR7znpN+gDn6Vj0mwLCZft9tDaQzLmXo48qBEt3730Z4e+Q:MlVyB7CFHDn6VjP+CZLVAXsq470Zr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632914241, "uuid": "0f1c609f-c2fa-4c74-ae8b-35adaf3ebe60", "value": 5443584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632914241, "uuid": "c40fa345-6891-4de8-ab99-8e6ac8c084b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632914241, "uuid": "42e85def-a17d-4fbf-954a-a54b660d996a", "value": "ab40d2395f7abeee43552ae6a750044d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b60654b-2145-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632934204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934204, "uuid": "7040f98f-a95f-4781-af3d-048bdb80bd09", "comment": "Malware payload (Mirai)", "value": "4f16e6c4e0c1c30a2f662514ddca02d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934204, "uuid": "eee56a20-b876-4a6e-ace6-c939174664e6", "comment": "Malware payload (Mirai)", "value": "bcdccfb42afbbcf3341357e90f6a90330e426408155c578e64623c4b8acb6eb6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934204, "uuid": "8c2751ed-1c90-47da-96ef-3192b6d338d3", "comment": "Malware payload (Mirai)", "value": "d5491cb4a10d4f475cb07ff8e88b191f225c05a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934204, "uuid": "15ec664e-e495-4d53-a346-3f669f45e76e", "comment": "Malware payload (Mirai)", "value": "705b1e3d9d9de830fa46d21b8445f942996034650196c72afda6e52847ec8d9fafb2605ea6c3246c2e90e613042cebaf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934204, "uuid": "e5c72f7d-e27e-4c87-87af-c91b4aad09bf", "value": "T1F0F2E03ED2998724F2A700F26EBFBA1B5514A014B258D8F19B84653F4AD3F6937093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934204, "uuid": "99f94973-ff3a-4144-824f-eaa0cfc87254", "value": "768:QkJ7X33ezMJV9qRt8g/wquuinltPEpcf8Xl5LXLjo2q4Au69nbcuyD7UHQRjt:QkRezAXgRuuEt8pQyTrLjHq4A99nouy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632934204, "uuid": "ef33e7f4-23b2-48d9-9298-5f6c0d1b0e86", "value": 36144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632934204, "uuid": "293d7bc9-cd21-4e88-8e47-655ca3a6dd32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934204, "uuid": "a0acf90d-d2e7-4c3b-a4eb-190dbe9f9282", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa4dd76-20d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632887736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887736, "uuid": "9840fef3-0c47-4058-a3af-fd00ae0af9c1", "comment": "Malware payload (Mirai)", "value": "291d9bbd0c737d600bf3bfa24ccd4995", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887736, "uuid": "fc90402d-a32c-49f6-aeb2-5a6c6881ef0a", "comment": "Malware payload (Mirai)", "value": "bdeb839c6a1da6f9e3f744773fc2e21be04cd0c053414b58c064ff0ca9624fac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887736, "uuid": "a2e64446-bc77-46dd-bd7e-3eceb1a7b684", "comment": "Malware payload (Mirai)", "value": "514c16380b2006feebd461d5749f27b6e57bda8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887736, "uuid": "8b57037a-982a-46c6-afcf-9c368d9c5246", "comment": "Malware payload (Mirai)", "value": "6914393238ff36a6b28d848c313e756fc689e96bd265d2cebcabfbc5f44d11b8ceb84f50bed28449e227c40222848b71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887736, "uuid": "6028837e-20fd-4059-b613-692d4644e2cc", "value": "T1EB230748A8412D1CFBDBA8F951638F5D8E526701A0939A0FA3EBFD832C3723CAF15155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887736, "uuid": "cbd0b711-8344-4edf-b4ad-8a0382628269", "value": "768:9JGXzKKLwkB3SjzcQNudcmPe3tcDEueOC+OPO0+T94g:9JGhLw83gYQNudcCKteCt20+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632887736, "uuid": "f47cabe3-e34d-4aac-aff5-f518f1657094", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632887736, "uuid": "4170ee1e-1333-4716-aad4-c618107cf6db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887736, "uuid": "0d69c1ff-306d-4509-9590-f6f37d12b823", "value": "291d9bbd0c737d600bf3bfa24ccd4995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc522e9a-2147-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632935306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935306, "uuid": "24a517e1-51a1-4d32-b28d-d3f0341643b6", "comment": "Malware payload (Mirai)", "value": "f3cd132b8369a42afddf2bf370a5c985", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935306, "uuid": "a434a6ed-8b62-45eb-8b11-f7d01dbcb0ae", "comment": "Malware payload (Mirai)", "value": "beb3cc11afbd46561f90825c212baaf8a00e5ea5439b0ebb10d23cd2da1af120", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935306, "uuid": "fc34132f-2592-4958-90ff-0c0a701a5b5b", "comment": "Malware payload (Mirai)", "value": "6f97141aad5a05da536031d0fed760ac7e2c47b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935306, "uuid": "5a22614e-5d9d-4316-8b8e-15dcdcc5916f", "comment": "Malware payload (Mirai)", "value": "d2bf092d352a8f445a1c3fd9716f233dd1db91f745cbc2ce7c49018278d2365a57f4a88a3b955466b6edebe3489b8093", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935306, "uuid": "706c816f-5346-4fe8-b210-5f4ea741df4e", "value": "T15023F2EFD3D0D906E43E3EF9219D17A69A6F658433CC0A4D73292D48F2194877B2D864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935306, "uuid": "b92cd7fd-6f60-4aa0-852f-3461091f37d0", "value": "768:vzVZHXaHTmXG8aVJ/Zo4pDhqOtYdDWHoQb8pO/CGAWHjJRK+3W5:vjKHTmWv/ZZhAIIQC0PH1RS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632935306, "uuid": "0e4c059e-5883-42af-afb7-0c3ab361e30e", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632935306, "uuid": "4c56136d-3e5e-4fd1-a1dd-703038ac45f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935306, "uuid": "6cfbf260-ac96-4799-90df-1ec9723a1eba", "value": "f3cd132b8369a42afddf2bf370a5c985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ccb00f-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902199, "uuid": "fd426918-320e-4a27-9e82-b61a4f625edc", "comment": "Malware payload", "value": "047eca626a9f8db4e83a75f21c5b59f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902199, "uuid": "e28c4739-b282-43d5-a83c-73ce5dcd18e4", "comment": "Malware payload", "value": "bfd766002bf021965cc18f6bf59799c027544a26d0754224ba2d2d6631157e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902199, "uuid": "b0ec6cb5-7480-46ae-a4b5-889099b8d9ac", "comment": "Malware payload", "value": "3f214c4eb91dff91a560b1994334cb8aed88816f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902199, "uuid": "1d4c9623-2c86-4fa1-99ae-222a963ae60e", "comment": "Malware payload", "value": "cd67b6dad02010bb59f877decb4ee757ac5b08020faceb05ad368ac28a4355d4ed6cce65eb26a908598a18a6247f06d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902199, "uuid": "252de8b2-dfa1-4808-910a-f3ad74f57e6a", "value": "T1F5B38E272AED38A2C138D771B37756E6E3198D110812EA5FA8C437A0453E76379C93CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902199, "uuid": "b64d3fda-1b02-48cc-9c8e-c8929e6a1487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902199, "uuid": "acc32b8c-9c8d-43a9-85b6-a01a38097f53", "value": "3072:kTTd5GzTXveGkSpG+nQ6XrxyRoTJttt/tttLUt9XI2EttLttttt5gted:ATdcTX2G9M1YU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902199, "uuid": "516a0886-18dd-4676-a357-b696dad3a3dd", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902199, "uuid": "962bd5e8-d40a-456b-b78d-ea27a891d6f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902199, "uuid": "a965d4e3-e022-4ada-a211-8869d7b11acb", "value": "bfd766002bf021965cc18f6bf59799c027544a26d0754224ba2d2d6631157e3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f25206-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632896476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896476, "uuid": "65c9f91e-8d1d-441f-a0c4-aad0bf14bad2", "comment": "Malware payload (SnakeKeylogger)", "value": "34a55cd33c80f02079e38ec15e233b9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896476, "uuid": "520a81a4-9b60-44db-8295-38f649de5389", "comment": "Malware payload (SnakeKeylogger)", "value": "c08c518495e8c95ce55f145f42da1b4dfcb56bed5540a70e5632d5e45ff6ed9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896476, "uuid": "1a058915-8b2b-4d51-a726-720e9919950d", "comment": "Malware payload (SnakeKeylogger)", "value": "fc24f0f295edcab5eee90d7d7cac0ac182aff060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896476, "uuid": "53852fbf-d9a3-4cbe-89f7-676271056d8e", "comment": "Malware payload (SnakeKeylogger)", "value": "d87163cf374f42384f4aadd7d48b7873c00dac8220c31d852cb667ae1f6f6aa9e932db8146655bed3160635fa58d2b23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896476, "uuid": "8b8948af-3ae5-4739-859d-df8793bc148a", "value": "T1140527394D2782F747EEC66CD08C1BCEEEA6A4837B915F1AC496D7C2025B70BE48855C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896476, "uuid": "991f85b5-4841-4bd4-bc43-e36722eb1c8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896476, "uuid": "bef225b7-f0ef-492c-90ba-f00820baaec6", "value": "6144:wTVjYQSQ2GhNq2GhNLe4BoFPi84iYuoyOYuWiiv12KsoLAWFrtTTDdCNYXKyxkc:wNt2iNq2iNNixAyv1TsJWHTTxmG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896476, "uuid": "bc816814-c620-4c75-9853-5e5cd65a5f2f", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896476, "uuid": "8d24cb2a-3066-4146-90a9-970532150f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896476, "uuid": "bcbf500a-0fb8-4078-8e9f-247c505271f6", "value": "34a55cd33c80f02079e38ec15e233b9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b39966-2127-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632921195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921195, "uuid": "54d6860c-21f5-487f-beea-a59d9d1179cf", "comment": "Malware payload", "value": "1c3abf8fe81053419f26942930abf532", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921195, "uuid": "b08c9e54-61ba-4007-a873-09d29a68aae8", "comment": "Malware payload", "value": "c1b4a0b9eadbf51e13343270b7ef85703b8a11ee736526f61193b821a72bef1f", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921195, "uuid": "19446351-5775-4a7a-b02e-ff47c0b54f16", "comment": "Malware payload", "value": "0107b0082ec18fb40db0fcb05573e23881bf175a", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921195, "uuid": "49eb6202-aec5-4e0a-977f-9201c3f6d4d5", "comment": "Malware payload", "value": "19cc48a93b71c1f9b8a7dea34652bf5ade8bd240b743c2243e2747a78e41b84a43087a3b8610f9f06085589987ad7fa4", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921195, "uuid": "7afad2f3-94de-47b0-a565-509aa4c0db09", "value": "T16545335AB1D31A20F1BE443443A3A752B8B77740FB7561A407AED2BB5871FE45C0CE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921195, "uuid": "62b9532a-535a-47f1-aae0-4bf002951393", "value": "24576:mljyqlwU8sQi+bnJmQIEtKjvjjDSwloHniuL5CA77M1YOK96gE:mtyCbAb9K7jjDSwlyo1YOY6gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632921195, "uuid": "cb139405-e464-43b1-9a71-1c7382c175e2", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632921195, "uuid": "4bfe5ad7-837f-457e-97ca-2a7c58580112", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921195, "uuid": "20e56b1a-7f1e-4fa6-a79d-2c7090f4121c", "value": "host64_sh.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdacf02a-211f-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632918075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918075, "uuid": "ef00af9f-28d5-46c0-80b0-d46be47b452d", "comment": "Malware payload (ArkeiStealer)", "value": "360cb327a6caf7770e028b43f7c6fac0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918075, "uuid": "fac471e8-33d9-4948-806f-f8f62d819f95", "comment": "Malware payload (ArkeiStealer)", "value": "c1bd58fd68668ebe88f915884711cfe3bf4cc99d33656021df4b744f8e7304a3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918075, "uuid": "d4d28fe2-8354-44dc-b139-72293c961e8c", "comment": "Malware payload (ArkeiStealer)", "value": "653a01da1782340a45812e4b2155528e998b6a96", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632918075, "uuid": "0e7a0a52-bcf5-4dba-98b4-193dbb58a806", "comment": "Malware payload (ArkeiStealer)", "value": "40ed323a78fcf69e928e7ea4ed6af7b0ee1c5dfe35c8cab7235b14a8ec5534961821f2e105b5bdac54a27b0814591f33", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918075, "uuid": "2115c747-2e6d-4297-bc25-adf60420c53e", "value": "T19AE40202E580D6B2CB45027E5828A6ACA93DFC9CEFD6E2732B543BCF5D3D1937525211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918075, "uuid": "8ed6cbdf-70b8-471c-bb1f-e6a20b531f7c", "value": "f249badb491e7862c803d80af2d74342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918075, "uuid": "d36300a1-5f06-495f-99f9-130f6c744673", "value": "12288:Rl0F7JHMjFX2niNAFTuHHEBA/sEHg+iYaTgJ6tcn0BBLI19aj:RiHMjF7VgAUWaTgJozBRI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632918075, "uuid": "d7fbf206-729a-460f-bf00-9bea50b696a9", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632918075, "uuid": "a74b77a4-66d5-4033-a3f1-c9614ff3b9d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632918075, "uuid": "b84edac5-7efd-4d71-9ed8-bb276989c952", "value": "filename(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08eee64b-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632908752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908752, "uuid": "d4f7b7ed-e4bc-405b-9c76-d257b01f6f8a", "comment": "Malware payload (SnakeKeylogger)", "value": "c873fe52733b8809946854e849984a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908752, "uuid": "7b27c252-462c-4b4b-b5cf-04879f56b671", "comment": "Malware payload (SnakeKeylogger)", "value": "c1cf31129faccb9b1dee06c573001e0dea1c69e3cc8005428fc16e95531a36a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908752, "uuid": "3c0092ec-b812-4d04-a8b5-e33d732da4bf", "comment": "Malware payload (SnakeKeylogger)", "value": "abd09c1303abb39063facdee6143625073eb2b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908752, "uuid": "bc936f9b-f9c3-444a-9074-ec56b6e04a20", "comment": "Malware payload (SnakeKeylogger)", "value": "6cacfffecdae093e53df6a28baab7fc1355a4592f16fb11f07467e6fe29b3caeb282d8449876853f3259e3fa7bb605d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908752, "uuid": "3dee5092-e31c-4ca3-9344-7fa8bedaa1c1", "value": "T1578412973D8498D2C0176E722AB7DDB9F2FF8B09012117138F912E7B27E548B1507A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908752, "uuid": "af1b6a35-3b32-43ab-8566-180228a629e1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908752, "uuid": "43051cbd-00e5-468b-b05b-6fc85e1ad2e2", "value": "6144:b8LxBBXsLkCI5jGobgGfRglMJQp/qASlTT9QyqsL+DfzMB23JYl+948LDw4nB+O9:ysLg5jhPf2zKTi5Xfqq40BbAIYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908752, "uuid": "b4d28f63-8334-4159-b69f-5ae96d97605d", "value": 376658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908752, "uuid": "e4cee4df-87b6-475c-bd78-f320e4d66de0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908752, "uuid": "8e9ed650-e422-4380-971b-7944ab5330ca", "value": "246787654223456090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974d4236-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902978, "uuid": "92ab5cd8-84b8-45c4-b3e6-296abf5e4242", "comment": "Malware payload", "value": "c91ff8b8da7ea9c9c5913e83295d784f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902978, "uuid": "92a68d09-a340-4222-82de-30744488ce54", "comment": "Malware payload", "value": "c2b1c14c1e60a484bc45e635abf8f81b68b717ed01a78c4993930ddee901157c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902978, "uuid": "f96eec5a-c58b-4d7c-b63a-915103329d98", "comment": "Malware payload", "value": "c2716c5c4d281c3196fdebfe7b0094893ef9fcda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902978, "uuid": "ab7a07bf-425a-4526-a33e-bce446578540", "comment": "Malware payload", "value": "d531c292122203554e3c44d2debd61e492f86a1367bee6c6a575baf81f34bb2a04fbe4bc561be11e46dc9729110a94ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902978, "uuid": "5b41da3f-6187-444d-b1a4-41301a329b2b", "value": "T1CF73CF25BF421D48E7F80B3369EC51DA06BFBB89993046CE296E9AD40F37BC056D0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902978, "uuid": "0881f180-ca0a-44d9-b8e3-6e2bf7b47d6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902978, "uuid": "3caf7fe3-317b-45ea-87ec-1433ed2e8ad8", "value": "1536:VcRWtHHuaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtLE9/bq:ORWtH/3ZAtWDDILJLovbicqOq3o+nLEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902978, "uuid": "5b93c886-39fd-4163-9bec-370607603860", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902978, "uuid": "8d75f864-6ea6-404d-8f60-94eba545a598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902978, "uuid": "5e8dea23-98d8-44e3-882d-5195f6414f62", "value": "c2b1c14c1e60a484bc45e635abf8f81b68b717ed01a78c4993930ddee901157c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7fa321-20fe-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632903899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903899, "uuid": "fbd5f98c-f8e1-4b6a-947c-1dafa599e5b6", "comment": "Malware payload (AgentTesla)", "value": "d27bc13f79eb09ca235e74080709595c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903899, "uuid": "9d31021b-ee4f-464a-91a6-9b7864a47e51", "comment": "Malware payload (AgentTesla)", "value": "c3430161cbc92a64f9b8c6b2fdc4cd5ca70bef6599de73de31234f967bd813b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903899, "uuid": "76d15e15-8132-47c3-8401-9d5512c4bde4", "comment": "Malware payload (AgentTesla)", "value": "2b919072dc1074e27c85b5792e26db6fa41a1d10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903899, "uuid": "96bc36f4-0784-4203-bc9f-85a497deff15", "comment": "Malware payload (AgentTesla)", "value": "ca251ffe198289651105e7b0292334c3c7ab5ec1d00fa68114631abe3ec749428a412a86c626d53aee2d5fe6e22e614d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903899, "uuid": "f2173dd2-b308-4873-951e-92082feb86fe", "value": "T15F755A1BB60CD65EFD1432F03134B8E011A81E5B1868A913B9F6B9DD64B9D2BDCB50CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903899, "uuid": "d7e12484-5ed3-44db-9246-8f36e3ebe286", "value": "24576:CD4VHfQe6ZyWshg+qbZxTZZWunAWvR3M37iY9QNL7PMyMWrHzx6:uF4GGQ5nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903899, "uuid": "c5faf383-2bc1-4ce8-ac60-12291aba2200", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903899, "uuid": "acd4176e-b3e2-42ec-a1b8-8dd82b8d1066", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903899, "uuid": "2e77106d-9068-482e-b0c6-1ce4b6f95340", "value": "RFQ_ORDER#09029021.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18680849-2134-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1632926817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926817, "uuid": "833963fb-4e2b-47c4-9cdd-89a8553529e7", "comment": "Malware payload (Quakbot)", "value": "ec8e028e5d905aebf954f2947f014027", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926817, "uuid": "825c7c2d-3cfc-44ef-bb4b-9b45285a00f1", "comment": "Malware payload (Quakbot)", "value": "c391f6bceacdfa48e878abfb75609d726be48e84e7663a4a68b9f5162ce8f298", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926817, "uuid": "303abe37-83c8-4ade-a8db-f01dd87967a6", "comment": "Malware payload (Quakbot)", "value": "0a55a2002dfd83a035b0b2f8b85258f978f6ed2b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926817, "uuid": "f7e0d91e-be73-47d6-ba63-147a42ac5310", "comment": "Malware payload (Quakbot)", "value": "8ac98cdf1cc7c3cce42994e9e451955f0fbb3b0f9253419733a304ffb247fece5cdebe18ff77f02a412352b3274f5910", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926817, "uuid": "2befa2cf-82d2-40a1-a502-55963116ab83", "value": "T120F47C403A55E521E6BC1A368F2AD5E807187D089FB5B4DF79E03F1F2AB98D3C621316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926817, "uuid": "fe60846d-a5cf-4a10-a877-6ac373060a4c", "value": "3a9ce6dbfabfc6032e0cfde571419746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926817, "uuid": "aacd0d4d-b4dd-4d98-bc22-5703996cc464", "value": "12288:6FbAcis08s7gQFMWC24/MFS+AWmdXWJIjJ5F3+DpEFs3H6v/+JoTN:6tDis0dFA24/MFSptoJKnx+NE23a3+JS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632926817, "uuid": "68459f4a-61e9-477f-93fb-b7a29c1e2c9f", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632926817, "uuid": "568f249e-4b83-4bb9-9b01-408d7990945f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926817, "uuid": "635fe52d-e3bc-402d-98b9-04c02499451d", "value": "ec8e028e5d905aebf954f2947f014027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd37eab-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898395, "uuid": "803bc1c8-18e2-4c93-a610-6a493b880e22", "comment": "Malware payload (Dridex)", "value": "36b227aaab7fd1c95b1ac3e4195cf0b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898395, "uuid": "e2c6d702-309d-4656-945f-4f9ad58a7ac3", "comment": "Malware payload (Dridex)", "value": "c3afccda37eef745802974a71fd7d4adc096ca8ca4226a32b5b05a113ef5067f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898395, "uuid": "6b100250-74ee-47d3-b9e8-4cab212683c0", "comment": "Malware payload (Dridex)", "value": "ef7ac1adb086e8aa844a75480e727d96545dd22e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898395, "uuid": "f785a7cc-7fa2-4d1c-98fe-fe8b063b80b1", "comment": "Malware payload (Dridex)", "value": "4f8df6767f4d13f697b31babcc5e43d6b747b7c1b36ee1f3fbe69d5388a4c6fbda5aa415ac43b74411928e87b26c7e02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898395, "uuid": "33fd93bb-5326-4eff-ad9b-3cc44a2a67a5", "value": "T1AC16D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898395, "uuid": "2f7eb2ce-af3b-4a89-99cb-ead75c5e7f68", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898395, "uuid": "477e7ab8-692f-4996-bae0-416d513437f3", "value": "12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898395, "uuid": "25e90e26-8899-4793-8156-b0c54e459415", "value": 4239360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898395, "uuid": "c5bbac75-670c-48e3-913e-fb6f81897618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898395, "uuid": "05876460-888b-46de-9fd5-ab710927d037", "value": "c3afccda37eef745802974a71fd7d4adc096ca8ca4226a32b5b05a113ef5067f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6ab22c-216a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632950182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950182, "uuid": "f951ef7c-e8a2-414b-bd47-8f1d62144142", "comment": "Malware payload", "value": "8b6c4905f8f93af27e60b502621e03f6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950182, "uuid": "636bb2c7-4b76-4530-ad7a-874926796197", "comment": "Malware payload", "value": "c4290560c6776b09f188deb80d27250bddaae123c201ac29391be4aef523f48d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950182, "uuid": "1d2adaec-ba69-42ac-9440-758a0fe8a991", "comment": "Malware payload", "value": "5e5afc1c4cb35a5c2236ee75caba1fd062079c2f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632950182, "uuid": "d968ec67-2f83-4449-bde9-2329ebd634ec", "comment": "Malware payload", "value": "c63c70d76e345f542264c914df83dc5e4eae2ae1333e7af96d5d4fe7c9948b49bc8228a5abbc7e3347845e1362f55744", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950182, "uuid": "3c45f590-3a25-4835-8a43-4409bd8b9d33", "value": "T18E162317FE9EE026D433E179D2699A47440A441A0A08FE1BAE27535C4EFBD409B43FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950182, "uuid": "8487894e-069a-4101-a39b-2126a0b14cd4", "value": "98304:VuI2jB0TbH87hFHKC+dcmGhQZC34dfbZjhwmWm8WLtkh+I:VuvV4buHd+dzGhT3GbZGVWLtkcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632950182, "uuid": "391b995f-cae4-4309-ac4e-7418fab5b3d4", "value": 4367296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632950182, "uuid": "12ccef7f-eb3e-4433-a5e2-424e68d4f4fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632950182, "uuid": "e39502c6-372b-43b7-9a47-37789e757d8f", "value": "sample.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ab92bf-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632884985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884985, "uuid": "2bc31bb4-6b7b-442f-85c4-f4a9a1cf7434", "comment": "Malware payload (Mirai)", "value": "672738aeeceb04f737660c52055eb422", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884985, "uuid": "3603ccc8-aca1-413f-9bb8-2588dbbb5567", "comment": "Malware payload (Mirai)", "value": "c492cf100af80334de0ebd6c900a0b2b0f9d7d1b963308ee97603dcd99c8b6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884985, "uuid": "f72fee03-e1bb-494c-9f50-e97cdc5f44a8", "comment": "Malware payload (Mirai)", "value": "5efbe010cfde2fa494a1153f5856105415094211", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884985, "uuid": "f4878ae6-b9e5-4074-a36c-404520eb2819", "comment": "Malware payload (Mirai)", "value": "cd077b52ad2f5a3ffa4bde716415c53ec8a23b02f77c512cffc1afeb73761c4e9b7f91efb97350d9713e85c8018e928e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884985, "uuid": "f67e6b73-c68c-4e9a-9a07-b93fc8e08ace", "value": "T134C31945F904875BC3D227FAF78E028D77365779979B3321A9385DB42BC0BA82D3A160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884985, "uuid": "21a17ee3-dec6-4fe0-a908-dd7c60c54aff", "value": "3072:q3cbi3nYsHx+8lpc5Hf40mKUq3rfm7267QpTz0E1wNO:W3JHx+gcBfBmMm7267QpTz0E1wNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884985, "uuid": "bcef2611-663d-411b-b3e6-b650142d202d", "value": 129851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884985, "uuid": "cd1d15c3-b39a-4020-9ea6-cb28851e337c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884985, "uuid": "f44ada8a-6cd0-44a8-84a3-48cfae5a6d66", "value": "672738aeeceb04f737660c52055eb422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa9d296-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632908970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908970, "uuid": "de9a5019-748a-42cd-9495-c5894d3ca21a", "comment": "Malware payload (GuLoader)", "value": "a1fed1f07c42c3ab2ffca5c08d7e4b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908970, "uuid": "54995347-9073-4489-85c8-339e9411c5e8", "comment": "Malware payload (GuLoader)", "value": "c4b5bedd3bdf3b0b21375511946191b78fa561e52eea5a1b0c3f028d50387835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908970, "uuid": "b9fd46ab-5f8a-4131-974d-617c9d0e9bc8", "comment": "Malware payload (GuLoader)", "value": "6515065c375ab839d91c9e8d88607bd081493f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908970, "uuid": "e7571281-f376-4342-9ca9-a7049c09f6b8", "comment": "Malware payload (GuLoader)", "value": "f9ad83007ce822137a917319ddb56a104202dbe40b85e6b978225fe4fd4a0880c52fecdee5369aeb6bfc49b8a28a9814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908970, "uuid": "3df8ea74-9926-4674-b8b1-6ddf80cbb4aa", "value": "T15BA3F532F684DFE1F88A86FFF323F5F694E2AD50D4524A1B1A443F1834F66C214A561A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908970, "uuid": "e9ccadf6-779c-452e-8549-9163b2c745b5", "value": "c8e60e2fb4b6c06af2ec95b1f57156a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908970, "uuid": "5fc28c61-4d8a-4e3e-b05d-46ff10daee7d", "value": "1536:tdNZ23lVYviyoGVXftuMjd3vpjjvcDgR:tL+YvietTZ3w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908970, "uuid": "87024a9f-be16-46e4-bc1c-34ae6870b252", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908970, "uuid": "c97e4e8c-443d-4427-b293-46445359655a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908970, "uuid": "d45e61e3-9740-47df-a344-2ca092ff1498", "value": "Zapytanie ofertowe (MGT 29092021).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26252ff6-20f7-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632900641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900641, "uuid": "ac2e8662-17b0-48b7-b719-f317f7700200", "comment": "Malware payload (ArkeiStealer)", "value": "164d4ec8b021d6e49156db38a6d8da4f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900641, "uuid": "223e34ec-a266-41c1-833b-2783a63e626a", "comment": "Malware payload (ArkeiStealer)", "value": "c5100d1bf69fec9ba16db2e5950ca974b65d97d5174a409ddc0a92715ebc3d7b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900641, "uuid": "92c827f6-54a4-4fcb-8c13-e927d592b735", "comment": "Malware payload (ArkeiStealer)", "value": "dc8efbc86dc7677eeaa33c9a7f004ce205bde401", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900641, "uuid": "af794a6f-d6c7-4c7e-a1be-5ff3d84fc4a8", "comment": "Malware payload (ArkeiStealer)", "value": "cf55e112650ee8393b3c1d47d2e81a3b015bca439f0a82aa48a60c066c9d9e50d673ab92dc1af1196be278913472f8cc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900641, "uuid": "7d0a5a61-135c-4f67-af8b-a6d66527b781", "value": "T1C3D41200B161C2B2CBA1007F9D24C65CA53DBB1CDBE9B27677912BDF2E352A37612752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900641, "uuid": "acec921d-1c18-4a46-b0da-fa55f820ba8e", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900641, "uuid": "a3ff1681-fb4e-4df8-96ea-35a70433c183", "value": "12288:Rtbjw59lXAELf4SY615THRmjT5Vd5u0GkFsHWja3L016ed0Fg3lI1y5+:RBghF9b6Td5XGdZLhGVI1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900641, "uuid": "4b79de7f-5fa8-4535-824b-8e7f12c096c1", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900641, "uuid": "5181a0f0-5d9e-4272-96e3-64858c3b4baf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900641, "uuid": "f9107c49-8480-430c-922e-fda819f2dfe4", "value": "164d4ec8b021d6e49156db38a6d8da4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc7046e-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902187, "uuid": "343263f8-e6e1-4ec6-b1dd-796ae60c140c", "comment": "Malware payload", "value": "2fc95f9baba185f9b9fed87a05af624a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902187, "uuid": "e5296d40-e437-49b8-add3-5207be8992f3", "comment": "Malware payload", "value": "c52cdbd406f61cfdd3ad2bfb4b22e1ca163b78ac89ffbfe292af7bf8f3f21460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902187, "uuid": "7aee8b24-f8bd-4a09-82fb-856fe973c8cf", "comment": "Malware payload", "value": "bedcb8f8540568667557fce7fd074424ff922dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902187, "uuid": "6e9566b6-adaf-4ef8-a726-b7856a2ea881", "comment": "Malware payload", "value": "6e15133a0ea4e2fab1c0f24fd225d4e7cb07b6ee9d4f83bf2c90d3053e03c6c4a203edb04a8aeb11f38c6f9c19829793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902187, "uuid": "d395e321-9d0c-482b-b82d-75abd28f7230", "value": "T1FFC31273E553C002DA9F2B3D565F6348716AAB0D5724E72497C2AC12F0FE6B1C8A53B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902187, "uuid": "0f97ee07-9a4d-42f1-be6a-8e12b9ed9f3e", "value": "7bef13f58538df84f5270fe7542e9811", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902187, "uuid": "7a4ed919-c3f0-436b-9e42-b03f39e16d79", "value": "3072:cq8f/oic1i9uTAlPQSDwEyWefHEvGdxETCpPJ:z8f/U1iF/sUGdxET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902187, "uuid": "17572663-a7a7-4588-8b7e-bbaf9d4d91bb", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902187, "uuid": "830d6a00-29b0-4b65-b9f0-edc74a83a187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902187, "uuid": "a2bd97bd-c214-4d6c-afd5-e0eab4b89a5f", "value": "c52cdbd406f61cfdd3ad2bfb4b22e1ca163b78ac89ffbfe292af7bf8f3f21460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327c53d5-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902809, "uuid": "38c46230-8cbf-4796-bcab-d978f92989c4", "comment": "Malware payload", "value": "aced58d209b42d63721ca5e45ad27e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902809, "uuid": "1727cf0e-7472-4520-9f21-500f7acb264e", "comment": "Malware payload", "value": "c56339fc62ebe94a6c52f320a57a10e87a76f9f826b4100e84407158f2a59d55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902809, "uuid": "e09cc3c6-2d4d-4ac5-bd87-ac1b0b8f520f", "comment": "Malware payload", "value": "5eee39b4ffb4cf16725605a34e5f344cf07aa470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902809, "uuid": "a24e2f8a-76aa-4426-b8b3-3a8e0b734b12", "comment": "Malware payload", "value": "b28094ee8e5816d3eb961075e02a0372ff7355d1aa887285465fdf1edc851083829afdf63dd3cd92e99c554bc830648b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902809, "uuid": "28b29bc2-1b73-43ee-84fe-01b6d6e2afec", "value": "T15173CF11BF812D44E7F91B3316EC25C606AFBB8E9DB087CB686D89D84F37A5084D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902809, "uuid": "571e62de-391b-40c7-a5e6-a0091b5d6c75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902809, "uuid": "88dc7581-644a-4f8b-964d-f3cfacb4b216", "value": "1536:JhSV5jLXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQty6h9/b01Ir:rSV5jLSyRxvY3md+dWWZyZ9/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902809, "uuid": "d79eb05f-47fe-40e8-8090-26c0e27e318d", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902809, "uuid": "55f28b60-d47c-4e9d-871d-ee51d630f37a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902809, "uuid": "fa113dc9-f78b-4ba9-ae0a-f2ac153af372", "value": "c56339fc62ebe94a6c52f320a57a10e87a76f9f826b4100e84407158f2a59d55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966f0251-212d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632924022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924022, "uuid": "f7b186f6-c1e1-4692-9a86-91bcc28e28e2", "comment": "Malware payload (AgentTesla)", "value": "ccfeb39a8ad3282623d9a8d191dd7f81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924022, "uuid": "f72f8278-c720-4474-9b8f-a9a6c96bddba", "comment": "Malware payload (AgentTesla)", "value": "c56b50c47467deaf443709b8e3c461ea0b89ae62d9ce47da2c4a96f2b0bc4ecd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924022, "uuid": "9d83ebc2-019a-40c8-a95c-0b50d3e3e694", "comment": "Malware payload (AgentTesla)", "value": "3a8fd1760d8a649c6bd99f7af9f89f762f811642", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924022, "uuid": "fd27278e-a317-499f-aef5-d3f89ff8783c", "comment": "Malware payload (AgentTesla)", "value": "2ab95fe1508a8796a665fee4bd5f2fdeec72ffe87ec8b36a655b5b29d6ac0162cd35c67fcca2c8b9885932ecea4b59eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924022, "uuid": "b7860ef2-db9c-4130-9127-b02c1abb9c2b", "value": "T11C158D2AB61CE65AFD1433F02524BCC415B81C581C6CAA17B97672EAB0F9E27DCF405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924022, "uuid": "4e37da51-60ba-45b4-9215-98d70e6f6588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924022, "uuid": "d2c8034f-9612-4fa5-b390-093b693bb5b7", "value": "24576:oD4VHfQe6ZyWshg+qbZxTZZWunAWv93M3C+0hKHUq8yjPb1Rxa:gh4C+0EHU5MpRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632924022, "uuid": "5d800056-f027-42e3-9aca-6c22e74e511a", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632924022, "uuid": "ca44d445-ea08-43b2-a5d6-c9c022c3d815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924022, "uuid": "a70b741e-9067-43e0-b16a-6e6d9b5b9e6b", "value": "Purchase Order NO202340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4982e03c-20db-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632888674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888674, "uuid": "af62a97c-51be-4340-96f0-837cd39f11b8", "comment": "Malware payload (RedLineStealer)", "value": "b99937ab52d789bf6a7d776e5e154221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888674, "uuid": "5400e865-8ca2-487f-a51a-a02ed766adb0", "comment": "Malware payload (RedLineStealer)", "value": "c5b20a9c143f3e6036a467b0805327997863738aae1de585c1a600fae122c11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888674, "uuid": "bdda625a-9415-4799-b9fc-3b774274729b", "comment": "Malware payload (RedLineStealer)", "value": "7eca8920cdbf07ab676bff5dfeba1dc191c531f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888674, "uuid": "de5972e4-3cbe-477c-8179-008dda0694b5", "comment": "Malware payload (RedLineStealer)", "value": "ce2e0f5376f2adffbee3af66200f8c1faba6007097028d80e0360133661db109b9bbaa60a169e70eaa13242c04cfc615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888674, "uuid": "837c1c46-da38-4567-9fe3-e6f8b4b6539b", "value": "T1B804BE00F1A0D2F1C715017EA825CAECD53EB96DEFE16633376825DFAE782A37521252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888674, "uuid": "8e3db9f6-c910-48a7-99a7-a31397c71b30", "value": "5dbcbed365563713c1a9bb2780528a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888674, "uuid": "dbf3d9ea-16e5-4c26-a84f-2c7d800f79ac", "value": "3072:56KmEM5iW1iikVK5crcPI1ZeRXH6I8EuSzsz:5RSijfLcPI1wXaMuSz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632888674, "uuid": "b48f5375-40a2-4a03-8577-844c1ccf78b8", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632888674, "uuid": "e9e4661e-3838-4dad-b7b5-b68fd3e27a17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888674, "uuid": "9d631ea2-8f5c-4f9c-8f93-d6f91c39003b", "value": "b99937ab52d789bf6a7d776e5e154221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30193d90-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902805, "uuid": "c039284d-cd86-46ce-8557-16bd74f3f1b8", "comment": "Malware payload", "value": "44158ea2acc62852645baf00823921e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902805, "uuid": "7bf17011-e65a-4e75-a3f9-cbaf2f4fe4ac", "comment": "Malware payload", "value": "c5bb1b0582dbd64394181c9e13966894d9e1217838c881f8febdcc47d0a0ae41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902805, "uuid": "338d02d2-d9a0-4406-94ac-4c9a5eab9b4c", "comment": "Malware payload", "value": "854bb00d3c195347e1df37fe191bbe32717d9f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902805, "uuid": "e5085610-4538-4bd7-8eaf-cd7481977651", "comment": "Malware payload", "value": "7c3a58f19f93753fe96d4c5a9881c6ef4381c0573c8d39ea528248f0f69331f3444d431464920794041aa00ccefa00af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902805, "uuid": "4102562b-28f4-4645-8055-c10000638911", "value": "T1A373D012BF811D08E7BA0B3726DC31C606BFBB89AD3197CB642E59D85F3BA5095D0718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902805, "uuid": "2e8784b6-3a06-441b-9630-5016354da3a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902805, "uuid": "56cc76c5-da89-42e2-b368-fd20405b2b67", "value": "1536:8V5YXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty6Z9/A1LA:8V5gSyRxvhTzXPvCbW2UB9/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902805, "uuid": "4b74a9fa-d658-4f43-9eb3-e5768a9cefa3", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902805, "uuid": "69a58699-0b4a-46ea-b21c-a8fc2be2699c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902805, "uuid": "9066636e-b3c5-483e-b1a2-c0423a82fe7c", "value": "c5bb1b0582dbd64394181c9e13966894d9e1217838c881f8febdcc47d0a0ae41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a36409-2106-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632907304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907304, "uuid": "c4566558-82cd-4f7d-aeed-e101d6d147d0", "comment": "Malware payload (RedLineStealer)", "value": "8baa6c1cadfa0a5b7a956e6c55d3d9d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907304, "uuid": "43f33a3e-0658-41b9-86ec-e43a121001a4", "comment": "Malware payload (RedLineStealer)", "value": "c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907304, "uuid": "d4567904-db93-48eb-9d7c-0b34c2ae353e", "comment": "Malware payload (RedLineStealer)", "value": "c219a61f1dad6eddc14f3fdb009eae8d76b58c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907304, "uuid": "10dfbae4-ffe6-475a-9e22-f2d697a04c1e", "comment": "Malware payload (RedLineStealer)", "value": "8fe222f72f1c0bd80dd770b69b530396b8b5dd58fd83315ce0213671956e38e669c95415f5a36a8d865d4f5af636eb15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907304, "uuid": "828c5d51-acd0-4c1e-b0ba-3e1bf4b8e7c1", "value": "T15D64BE10A7E0C034F1B712F5497AA3B9A53DBDB16B35D2CB22D516EA6A346E0EC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907304, "uuid": "92003183-73db-46d5-8a33-cd8d07a5cafd", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907304, "uuid": "eb7110f2-f7da-4b61-b58f-0467d60c9e2e", "value": "6144:r29NkYMoyqBoAOTnzmIzFldKYXHQvkTSH5AA24y7:r29NkloPoAOzqIzFGYHEkGH5t2L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632907304, "uuid": "af5fd80d-382f-41e1-8906-1a3f212b0ec0", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632907304, "uuid": "0835936b-76e4-41bd-bcf4-243e8d6f44b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907304, "uuid": "bf3a356e-ba02-4b2a-90e7-bb34a87470f4", "value": "8baa6c1cadfa0a5b7a956e6c55d3d9d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe3d71e-20d9-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632887745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887745, "uuid": "d276bba5-e684-44a6-b503-21e963665d1c", "comment": "Malware payload (ArkeiStealer)", "value": "14b02509f2ba30cfcc078432ed84cea9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887745, "uuid": "d637724d-74f7-4bea-b0ac-2cc105627b0b", "comment": "Malware payload (ArkeiStealer)", "value": "c625e0872eb2819660ca4866d6baf587f81312e0cd99e5c1c5e22b009f2e2e7f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887745, "uuid": "45a3c001-fbd0-4a83-959e-b9ac617c8e37", "comment": "Malware payload (ArkeiStealer)", "value": "8c696c9b3b854f24ba1d1bfbbb4f8036cbafacf3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632887745, "uuid": "712e2ce4-4803-4c28-aefc-c1a7663a0ecb", "comment": "Malware payload (ArkeiStealer)", "value": "b2454668127e2d7686e213cb7ff3420b40691003e0dd98e8f2d8ca214e876d66523f27a2beaadc05be7fae393f02d963", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887745, "uuid": "c0d0e2e9-5603-4f59-ac6e-b98fc92f1d60", "value": "T14DD41202BAE0D3B6C356067E2855C2DC952FB82DFFE076322A5432DF9A755A37B24341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887745, "uuid": "8d45b94c-42dc-453c-83cd-e61dc42a3afb", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887745, "uuid": "5d726267-0fea-43a3-98db-6473a766ee0c", "value": "12288:4MEB02uilCf8I4zta5LjxHguSs4WGQT0R8x2Izo/5cfFyjytyQdI1o2C:Ni5uVf/DSsTGXmx2v/5eyjChdI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632887745, "uuid": "661fe876-981a-48bb-aacf-2ffc747c7820", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632887745, "uuid": "dc5af264-51e7-426b-9137-e244b54c72a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632887745, "uuid": "80bd7e0f-8a9c-40f1-9d72-50fe673ecaa7", "value": "14b02509f2ba30cfcc078432ed84cea9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb4546c-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632901430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901430, "uuid": "e950b90f-fe8c-4d6e-84cd-e51f5a4a8c83", "comment": "Malware payload", "value": "eae9ea6d9df6840866d0f735e08fb4af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901430, "uuid": "3d73ec7e-0150-452c-ad55-958526430311", "comment": "Malware payload", "value": "c62ec84deed83d189a8428bfe2f0f25984340c88edef62702f651b49c46f5e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901430, "uuid": "33540ae8-ff21-4e58-b2c6-40b382042731", "comment": "Malware payload", "value": "0b67f3da7aed11fc2efef98274ac12c5f3544d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901430, "uuid": "4768b19f-d2e4-48b6-b33e-01b1b9b0da85", "comment": "Malware payload", "value": "83e0fa356311982c150ac8e473752417cb2cce2cc979fab84e08f9ee15e565ffdb49558a453bf635101c93d2d0244057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901430, "uuid": "d7d8bc40-3f53-4bc3-957c-69b70e169702", "value": "T17F45F752A0F575AFE8157D72217236102CB6E6337EAB20507C4C2E9F4CB654A5F8AB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901430, "uuid": "0c026dea-6802-4a54-a7bc-bf0f04a82ba0", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901430, "uuid": "1a325332-09ca-4e4d-9323-bb7ffb0c0be4", "value": "6144:PFKiOzC8VEXAouuoSdKhMNxzztaeQ2vShdRaLJuh0b3Y+Z6NOWeaIchS7trpnQb9:PHkVE/oSPv6n3Wk26rKdx10V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901430, "uuid": "b05b6844-db93-4d15-808b-8f03b63deb10", "value": 1174136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901430, "uuid": "0a7a0581-c3b0-457a-8109-fb469272cd7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901430, "uuid": "f2324a40-2895-4b11-884c-5744b6babea0", "value": "c62ec84deed83d189a8428bfe2f0f25984340c88edef62702f651b49c46f5e95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd3392a-213a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632929514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929514, "uuid": "a8f8693c-7ccc-4333-a532-bc76c7f020ce", "comment": "Malware payload (Gafgyt)", "value": "4c888b76e5c69a51a2459b6523eecd06", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929514, "uuid": "6af7f2af-b85c-4db0-af23-77e0954e9bc9", "comment": "Malware payload (Gafgyt)", "value": "c66ae7e0622aac90295c0a68bfa1d2598cb565b4d90d03c88d0a056e56837e8e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929514, "uuid": "407738f8-eecf-4a58-8f28-afc77fe7eb62", "comment": "Malware payload (Gafgyt)", "value": "13aa5d4517e5ba764e54e53e5aa98a06cc20978f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929514, "uuid": "80a41151-4dd7-4628-9110-848c716aac4d", "comment": "Malware payload (Gafgyt)", "value": "80fc5d86e403bfb916c04f72ad4097d2e1bbb1308702cf2a9d001c79775986b1b9c8d1808419c0d1a186c31784c67e75", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929514, "uuid": "a31ef2e5-00d8-497f-845c-78b162d941d5", "value": "T109D34A27B6E98DFBC05752B02EDF8AA29521F4FD0B32712733D46D902F6D9C54928A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929514, "uuid": "22f9288e-0a74-4444-92d1-bc99f89a2325", "value": "3072:kcB5V4FlMdejqw/rcqvmiKEOWm4t+5BphaY4dd9Jty2FUQmDoud2FHGtJogq:sdoquEOWRSphaYod9ydQmDoud2FmtJoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929514, "uuid": "baaf87c4-dc85-4c3e-80b0-5eec718f80a9", "value": 141450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929514, "uuid": "ec3ae3f8-5cf2-4b95-9d00-43c6ddeef5c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929514, "uuid": "29a28299-53ca-4337-8411-79857c4abea3", "value": "4c888b76e5c69a51a2459b6523eecd06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a56733-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901182, "uuid": "0f67c025-0486-477e-b911-b4e2cc3ecf5d", "comment": "Malware payload (Dridex)", "value": "f79b359db65eb71251bcf5213a2447ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901182, "uuid": "0c73669c-693a-4a5f-9e29-8cba57a4d3ab", "comment": "Malware payload (Dridex)", "value": "c69f6664d30830c488ccc93ba14eb8dd8e95a535e781ba519c703f24246c6a48", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901182, "uuid": "f2adcfea-2e3d-493a-b176-3de601a444fd", "comment": "Malware payload (Dridex)", "value": "5220263aadf02c18035f48ae9f80a32ef6b5ca55", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901182, "uuid": "38b38c2a-900b-4e5d-8d6e-71381632956e", "comment": "Malware payload (Dridex)", "value": "496d73b80827b9b653ec97bb71ddb203580f1dede6ffb7dba9f4dd651de70cf343a8476b4bd6799140c5b06b8821a8fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901182, "uuid": "0283746a-2f02-4a5a-a93c-7a172064bb84", "value": "T19985D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901182, "uuid": "49c8d975-2f36-49cc-84be-8ec718f8d559", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901182, "uuid": "b7032cfc-e98c-40ce-8f9e-335412ec6305", "value": "12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901182, "uuid": "164fc38b-deaf-4c2e-94fb-7bd52db6b2df", "value": 1773568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901182, "uuid": "77e65146-7e41-4ce4-92dd-3f257133e31a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901182, "uuid": "8b075d04-f4b6-4dee-93e1-c1d40f66f84b", "value": "c69f6664d30830c488ccc93ba14eb8dd8e95a535e781ba519c703f24246c6a48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82114596-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632919693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919693, "uuid": "3a17ee74-e5b1-4350-97aa-d9294ddb668d", "comment": "Malware payload (Formbook)", "value": "4dec431714d1aec5943625750500666a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919693, "uuid": "b30ac49e-8873-4cd2-832d-bd9831867475", "comment": "Malware payload (Formbook)", "value": "c6ac9c7f14e2fe9196fe5fdd2a30236a157d4c04c0e5c9dc84e8592984756717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919693, "uuid": "ea577250-3d60-4bfd-aafb-eef9c7127c61", "comment": "Malware payload (Formbook)", "value": "74017176d8a002d6195874649e80d335ca655fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919693, "uuid": "e24369b7-2b86-486e-96a1-2c438600c736", "comment": "Malware payload (Formbook)", "value": "e9deec755928be10180f607f9eb2001f1a822f334e7a188a69a53d39f1ce39d5ed0a3006e36c3d4b0691d9ebdf059395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919693, "uuid": "634917fd-c52a-435e-9d05-0394f83f2144", "value": "T1E7E48E59F61CE29EFD0903B021297CD425E81CAD197CF927BEA6B1E230EED3651F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919693, "uuid": "9af7d2d7-aee4-434c-9a9b-b38d3693a9e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919693, "uuid": "dab566ef-1b58-471e-825a-cf50959622b6", "value": "12288:5D4VHfQe6ZyWshg+qbZxTZZWunAWvPJJIQ/hbfMZXNUQNqnjl6Wl9xbjK1fiSPmx:5D4VHfQe6ZyWshg+qbZxTZZWunAWvRZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919693, "uuid": "bffb158c-41b4-4631-9c7f-bd379812dd55", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919693, "uuid": "4d964ee8-4899-4d96-a8e4-cb949687356d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919693, "uuid": "6c619ebf-d0f3-45cb-9549-fc9375e1cbb6", "value": "\u03b1\u03bd\u03b1\u03c6\u03bf\u03c1\u03ac \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2 02800921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480ff9e0-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632901556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901556, "uuid": "fc2900e9-1137-444a-8d38-e10ffb4e63e6", "comment": "Malware payload (AgentTesla)", "value": "4a32572abc1eac38797f674e28899b20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901556, "uuid": "c055dfc3-8c00-4696-a9ec-74542b8baa1d", "comment": "Malware payload (AgentTesla)", "value": "c6e0f429ee65b9d3ba84515435632bf2faaaf887d2abe5d0b141f92a19349c93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901556, "uuid": "fd7dff7a-32b3-4dbe-9b2f-4bb9759bd126", "comment": "Malware payload (AgentTesla)", "value": "79ccb2b476254c5f7a4f19bfdb5e116ff9a7b742", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901556, "uuid": "3189ff93-70b0-4851-9f8d-1b49e0ee2668", "comment": "Malware payload (AgentTesla)", "value": "205b68c15259e0f74c54595028fd3f905c30d8ffec813c7ad602db9f9a2f940cc9e725821445363d88679ecc6d1012bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901556, "uuid": "02cbcefd-c5b4-4708-9038-a1182435aca0", "value": "T18715BF417FBCBD06C1BF2679A3731ACA07B8E8066052FB4E185851AE1DAFB01BD15367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901556, "uuid": "34bb08dc-818f-4d48-bdfa-bb534932b07f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901556, "uuid": "ede952f8-fec3-4ffc-ad8e-03dd6edad688", "value": "24576:zcI4MROxnFj3qxXFHXRrZlI0AilFEvxHiiF:zcrMi1mRhrZlI0AilFEvxHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901556, "uuid": "fb0b0b15-ecae-4e53-8c9b-cd8df56d49f7", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901556, "uuid": "2e62af8c-7dc1-40ab-99a5-34b58af64cf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901556, "uuid": "558a8fa1-fba1-4429-8afd-f1f41a889d7b", "value": "c6e0f429ee65b9d3ba84515435632bf2faaaf887d2abe5d0b141f92a19349c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a3142c-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632908958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908958, "uuid": "7c220f26-2154-49d7-a650-d3df8076c7db", "comment": "Malware payload (Formbook)", "value": "340648352fb7270bf8d037c9c9a39206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908958, "uuid": "4ca236f5-45cc-466f-ba1c-a85791a5abcd", "comment": "Malware payload (Formbook)", "value": "c6f3b9901ead534a75aec6bd7f28f50535af887db5857e43848a0268a2e7b9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908958, "uuid": "0b521780-a243-4589-b8d7-1c1dbf58f767", "comment": "Malware payload (Formbook)", "value": "834b6a4016818640c887fde445c3415347ea7cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908958, "uuid": "78c36a05-ab6c-4e59-aed1-40e19353ade3", "comment": "Malware payload (Formbook)", "value": "18b66c75a67008520e6bcdceb900d00ffeadc35c074412e1de8ab7a9d91fcf06a4212e900825fa34db050c4fdc120dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908958, "uuid": "54ff5c59-e25b-4ebc-8c27-d58755a242ed", "value": "T168E48D5DF21CE29EFC0903F021257CD415E81CAD197CFA27BEA6A5E230AEE7651F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908958, "uuid": "6c889df5-cfda-49b7-92f1-919a8b7ab448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908958, "uuid": "37b975c7-4864-4873-9082-ca89e107dd09", "value": "12288:PD4VHfQe6ZyWshg+qbZxTZZWunAWvTjM0LvDe14CAZiy0gjz7e17u0l3Qb1jQO0c:PD4VHfQe6ZyWshg+qbZxTZZWunAWvTjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908958, "uuid": "78e45bca-b689-4155-abcd-2b4b47e432a5", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908958, "uuid": "feace29c-43e7-407e-b536-da75e48e482a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908958, "uuid": "36000228-d384-46e5-95f4-8ef5439da681", "value": "Yeni sifari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17713e4a-20f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900616, "uuid": "905d2f64-cda9-4b94-9512-42c468ad4c68", "comment": "Malware payload (Dridex)", "value": "1dd5177433173cee36879067cc0cd508", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900616, "uuid": "28a52a13-7e02-485c-8239-38bed84645bc", "comment": "Malware payload (Dridex)", "value": "c7eda0f6907d63f51706915c93656a570bd40d6f60493c6418dd49454b329e71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900616, "uuid": "5c75dcb1-170f-4ec6-abb0-46fdb9fcfc96", "comment": "Malware payload (Dridex)", "value": "7a57caba4c71598bd16f6e66fa364fbc224a2142", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900616, "uuid": "c23d1108-360e-44e0-b106-7025336966c0", "comment": "Malware payload (Dridex)", "value": "894036ae2c48516591366d1a700b8f394d5accf6a0a1747cc18b9d03536a817af544fda6d4766aeb4d4d815e0d794e6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900616, "uuid": "d9c65d56-d4eb-46f2-9c67-80a734c8be34", "value": "T1A695E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900616, "uuid": "2716f510-510b-4a01-a9da-238442050661", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900616, "uuid": "f16c5591-3b0f-4fbd-a926-8441474a15d0", "value": "12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900616, "uuid": "f803b25e-cb01-499b-9c4f-76f85e86b1ba", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900616, "uuid": "59eadc1b-538d-4ce7-bc1a-4ebe44ee1748", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900616, "uuid": "6009b2b7-deb8-479f-a028-52f350df139a", "value": "c7eda0f6907d63f51706915c93656a570bd40d6f60493c6418dd49454b329e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e67cf5-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632901013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901013, "uuid": "fcbdcc8a-ec13-4ed4-a683-2757baa79e40", "comment": "Malware payload (RemcosRAT)", "value": "5daf107161b273bb31f0c69cbaf8c7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901013, "uuid": "ee5cc9df-d095-4821-95aa-27615449611b", "comment": "Malware payload (RemcosRAT)", "value": "c84c8a5d9ea1dbf1b5af8d75cd100faadc54a5a83ab952e1ba03068d9287b32c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901013, "uuid": "b5c63d18-93ca-4798-962c-85de6edd74cc", "comment": "Malware payload (RemcosRAT)", "value": "b2741cf7481fa04afc457b078eb1ce0af074a0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901013, "uuid": "26ccd5c3-97c6-4123-8f0d-ecac01326790", "comment": "Malware payload (RemcosRAT)", "value": "feb24f5fd26c441ec33300226e20466c76434d48e1509ea09f0ca63f75a9f0abdcd2f29c7d700d9ae016fbbb174eae04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901013, "uuid": "e77ac1ea-7fce-4b4c-a20d-b267670a26bd", "value": "T101054C63E3E14CF2E21727B84C53762500756F706818688AABF53E766E392C1B476D8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901013, "uuid": "01a91567-4a62-4dee-946e-f5c69a2c80cd", "value": "f0c25cd198950ba1bc931e9bf4f4e5f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901013, "uuid": "6010fe09-081c-49b6-b689-0e5ff95f551c", "value": "12288:02DA+ebuMqQ/5KIXmdLwWZsSOarJsU0QLS7TnUEi/XNkYEQfC:C7FJ/5KIXmNwWZsUraU0QJfN7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901013, "uuid": "8491a5a3-0f8a-4880-ac28-8d129c73b5b8", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901013, "uuid": "772ac749-85d9-4b0e-8ff1-bf040e95c40b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901013, "uuid": "81327808-224d-4a6c-ae09-316fc49d4ccb", "value": "???????? ?????????? DHL 09-29-21,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c905c52a-20d2-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632885022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885022, "uuid": "ea9aead1-521b-404b-904d-ae1cc3f1cee6", "comment": "Malware payload (Gafgyt)", "value": "bb88a79ab28bda88f662986635872ef2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885022, "uuid": "de95575d-86c6-40e3-b524-9b36df3272ff", "comment": "Malware payload (Gafgyt)", "value": "c8e1542be194ad454a96491006600253e9214aceeace68a6f83348584b7422cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885022, "uuid": "b4dd708a-8703-47dc-b9c1-6b203386b6ba", "comment": "Malware payload (Gafgyt)", "value": "ecdd3a2d16d7caa52c99bbf6f1089ec7a6b6a35e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885022, "uuid": "973c322e-ac27-457e-aa09-162aa99e7250", "comment": "Malware payload (Gafgyt)", "value": "2606853edd46d3d0d96df81c01accedd3545332f45ed0237013a8c26d08772f35f3843812c1978c80222c1784e5898fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885022, "uuid": "91ee0241-b22f-4b60-9e88-6958f06feb0b", "value": "T13ED31905F900875BC2D227FAF78A038D7736577997DB33255938ADB42BC1BA81E3A160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885022, "uuid": "b0f73b24-d893-4263-a278-2eec95515306", "value": "3072:W3w7ibTcvYrM/nnm9BxmybnjmPtBaQRhI3EnKNO:+buYr/9BxmCjmPtBaQRhI3EnKNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885022, "uuid": "dcc3f756-d6d5-4ec6-8ca3-d2070bbe01d3", "value": 137397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885022, "uuid": "fe1da279-1aa2-4bd3-9ef6-af7769292221", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885022, "uuid": "d62621e1-f34b-492e-9f63-357b4bbfe24e", "value": "bb88a79ab28bda88f662986635872ef2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86912a31-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900373, "uuid": "f720d56a-dd91-473a-8b71-73def607bc7e", "comment": "Malware payload (Dridex)", "value": "60bb9eba2a7300c8a90e97179ee6ff19", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900373, "uuid": "10dda0cc-0d8d-4e45-9138-9761fac010ce", "comment": "Malware payload (Dridex)", "value": "c906ad92eaed34e49af5979cbc3a45c3c41463211d69493290a7565611b68b48", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900373, "uuid": "685bcb4a-ac5b-4c91-91eb-b8d93459e684", "comment": "Malware payload (Dridex)", "value": "d1822f5a49c9bef710d4753a4cacac2c8604ebf9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900373, "uuid": "5acedde2-da33-48ef-ab5f-4928056e11e8", "comment": "Malware payload (Dridex)", "value": "f7f61a9c65a16b0c9c95e31c86a0d7af878e0cd9d836ce56c0902bad465a0f95a95ebec11fb33d046a38a08abf264b4a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900373, "uuid": "08e146c4-13e5-47e2-a984-47b59eb97165", "value": "T1D7A5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900373, "uuid": "45983779-357f-4b38-9647-8ecd00b1f164", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900373, "uuid": "5e59fcfb-2c3f-46fc-bbe4-bc27e82cf645", "value": "12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900373, "uuid": "c7a010e8-d246-46bb-bb73-32805402ba6e", "value": 2236416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900373, "uuid": "52bfac9b-bf3e-4e01-99c3-bead8191b786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900373, "uuid": "cb2f6d95-7586-48b2-8031-5364b2c78b79", "value": "c906ad92eaed34e49af5979cbc3a45c3c41463211d69493290a7565611b68b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2573c11-2133-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632926672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926672, "uuid": "2821302b-e94c-4ea3-8e4a-c2241ac7fc9f", "comment": "Malware payload (CobaltStrike)", "value": "2d3f530afe2505a21271bb349ad5d073", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926672, "uuid": "7985f2b8-f2b9-4743-a406-4ae13aca4499", "comment": "Malware payload (CobaltStrike)", "value": "c915d4607fabbc8ad7f2758b98d3d7afbe4792cb1c843164021fc1d11ebd6f98", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926672, "uuid": "0d0db605-adc7-45d2-8ea8-f90f56deeb0e", "comment": "Malware payload (CobaltStrike)", "value": "ae40baa893a928ff1a5af59385aa38184af04c0f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632926672, "uuid": "26c27317-1545-4709-81bd-7d495dda0ad2", "comment": "Malware payload (CobaltStrike)", "value": "3fa0f3e0cd8bceb4d6fcf278e67f2ce077d0b65ee78b4f8621359e4549a4be75a8d205abff77b40af135998028137f2a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926672, "uuid": "56b6d43d-1494-4a9d-a03a-e8e47acd3d53", "value": "T17235330F6AF00631C5DA287A3A3F5AA594E36DAB223744CF12B374546633F81F879E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926672, "uuid": "83ff6fda-e8d1-4d77-a10a-eecb11deafc3", "value": "24576:fMynlSXu4UDldxzOdjUbZ2gFR5TkUWj672qNJAC:fMg4UtqUAQzJhNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632926672, "uuid": "343fd63e-3856-42e9-aa7b-d192fc6a3222", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632926672, "uuid": "9792e6b5-41e5-492e-bbfe-063c71fc0d17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632926672, "uuid": "2ea63ca9-f4ae-4e27-b7d1-5461e84f7cb8", "value": "host32_pic.bin.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f5abee-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901578, "uuid": "6ee522b0-ed80-4112-a124-f685409be6ff", "comment": "Malware payload (Dridex)", "value": "918d38921d91b26307f48c7335234817", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901578, "uuid": "f694b414-605f-43c7-b128-995f1d721a8c", "comment": "Malware payload (Dridex)", "value": "c94f7789215299282abe47ae342505234d4e8c46e1ab825f79ac1223078e6e1c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901578, "uuid": "f0519bf4-d28b-457a-b18c-200ef927f9a2", "comment": "Malware payload (Dridex)", "value": "c94af17ab5fadb1eae6b7826a336e98e7c68d1b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901578, "uuid": "b36ab87c-3850-47f1-b277-4190f027700c", "comment": "Malware payload (Dridex)", "value": "9041d0dde2caea2361ca90120128c9b79caa6b746a8c071e6b4834a140f20d3ffeb6fdab43fa7beccb85479155e7e27f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901578, "uuid": "3f5ba246-547c-470f-8a85-2d6004b83859", "value": "T11A15E094B677A1CAC4A76CF6EDF86D706A522CC3623047A1CE02D1861B751E4CDF2A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901578, "uuid": "c0652b5e-6dfd-4e53-b16d-81d9828d6d10", "value": "c6b4c2eec8a93016c63563421e15f011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901578, "uuid": "0191a9b0-64ed-485e-9267-d452b0dcae1f", "value": "12288:tdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:DMIJxSDX3bqjhcfHk7MzH6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901578, "uuid": "e6ea6533-c9cd-4f68-bd96-9f73fff3547d", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901578, "uuid": "d9176ef8-1e46-4aa2-a2b9-503b50672a98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901578, "uuid": "19a61553-f7ec-4092-8515-0c6e403f26a4", "value": "c94f7789215299282abe47ae342505234d4e8c46e1ab825f79ac1223078e6e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8151453f-213a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632929570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929570, "uuid": "aea15810-004a-460d-ae6a-7430f1cc7df3", "comment": "Malware payload", "value": "fd59dd7bb54210a99c1ed677bbfc03a8", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929570, "uuid": "ee189e97-af63-4141-be2b-e7fb060dfc73", "comment": "Malware payload", "value": "c9db4f661a86286ad47ad92dfb544b702dca8ffe1641e276b42bec4cde7ba9b4", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929570, "uuid": "7193fab3-8987-41d4-ac7a-f560baf58dd3", "comment": "Malware payload", "value": "292c3602eb0213c9a0123fdaae522830de3fad95", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632929570, "uuid": "16f789b2-30c5-4f2b-9e76-1ecf1f55360b", "comment": "Malware payload", "value": "65cb4db048c30b9884fbf40efe023040353f182fdf43c67349b22498a7fdfcc4eafcc6933abed140614ba1778f7c71ef", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tomiris", "colour": "#880546", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929570, "uuid": "adadbcd9-a124-4f10-8956-0812ae7555a2", "value": "T19C82F94FF20664EDC21BC17885DE6732E0F2783012672B1E2B74C7303E646A95B7EA19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929570, "uuid": "5cbc6a0d-0da2-4d34-b704-97000be2631d", "value": "aabbd2dbff7b6da570b1d10d91e56428", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929570, "uuid": "145e8f59-8604-4d90-849e-43d8ca4ec244", "value": "192:RsMd4AHkvEKy63YAXNJ0TMgRjcozXern/kNBOfvxRmRjxabNjpg5:td4AHkvE96o8D0FlciXSkLOHYspg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632929570, "uuid": "cedc7e19-8855-4de9-b758-aacca8c20bb4", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632929570, "uuid": "f0be8741-cb95-4eb3-adc5-6c1eae3e4ce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632929570, "uuid": "71d14af0-3c25-4c6d-a50a-16845a69524a", "value": "c9db4f661a86286ad47ad92dfb544b702dca8ffe1641e276b42bec4cde7ba9b4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35395f23-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902813, "uuid": "d3c9558c-87ec-456b-8159-90901b4fbd9f", "comment": "Malware payload", "value": "85889424562f390028a432d07e478971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902813, "uuid": "43a96078-93f5-45ec-8108-a3874c46c9cb", "comment": "Malware payload", "value": "ca034d3db83c8eb68d6a4a376fd71a5dbbf7d8b1f512f684cc12f36f22ec053b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902813, "uuid": "2e760041-21fb-45aa-bc30-a1b852af0d82", "comment": "Malware payload", "value": "0e1516b2c3e2e39384b97e25a8d9ed2087581454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902813, "uuid": "2a913dcb-1ace-417f-a67d-4ee6464e5d58", "comment": "Malware payload", "value": "04e35fbeb8fe3f628c19fe4da68d60af63cc5d1ff559fb1e182572e49469671fd30ac3c3d0d7c0520ded7a31afa921e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902813, "uuid": "4ef2967a-1ec2-476d-9f8c-d0c99ebaebb0", "value": "T1C173BF11BF811D58E7BA0B375AEC31C606BFBB89AC3193CB642E69C85F37A5095D0718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902813, "uuid": "7f16f434-6f89-4c5c-9c39-2d0ad3d27cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902813, "uuid": "1e801784-375c-4566-addf-256a5d115041", "value": "1536:CtHFo6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt1M9/v1we:CtHFonhASyRxvhTzXPvCbW2U1M9/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902813, "uuid": "505d4124-773b-4bc4-8078-c2285164b6c5", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902813, "uuid": "04e21d2b-cc73-4f37-a5a6-e872f8b6f791", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902813, "uuid": "4e4c7988-ab4a-4943-ab9f-156d59f9bd19", "value": "ca034d3db83c8eb68d6a4a376fd71a5dbbf7d8b1f512f684cc12f36f22ec053b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfda0173-20c7-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632880309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880309, "uuid": "eaca3e40-03df-4f8e-849a-1b816b6ddfbe", "comment": "Malware payload (Loki)", "value": "bd7ee8760eaec7ed129ae008ceb392c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880309, "uuid": "0faca510-21ca-4a6a-8681-0d31f5a0aba6", "comment": "Malware payload (Loki)", "value": "ca2a2f4bca3b9c9c14c37042a8585638c495f25fc4cb6f36d3f14c0a1027c325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880309, "uuid": "a261f0db-10c8-4b81-8d79-3c2989d0ae0b", "comment": "Malware payload (Loki)", "value": "8284a2d125ff57d749debaf9057b41ad2716957f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632880309, "uuid": "e94da6c5-3422-483f-b08f-31379de2b47c", "comment": "Malware payload (Loki)", "value": "0934a9c79211e5306dfcd6daf49b0339cd0d04c5693248387415be294f71b1a4e437363cd05d11c33b73ccd7dd0a905b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880309, "uuid": "a3c0e1b3-1d03-4353-83df-4da88b253189", "value": "T18A34124A72D1D9E7F6D21B3108FBB674F3BAC809403316174BA46F7B7B607E68A1A501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880309, "uuid": "baae3a4a-46c4-467e-bd2c-2164e9593d0b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880309, "uuid": "8551ccda-18e3-4b9b-a01c-44dd03564db9", "value": "6144:F8LxBsAXYcUkccIdkeINKidL3lZ3p9MFKM4vBsrT7hkPFbNH:/YpUkcxIBBZpGFvdrXuPvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632880309, "uuid": "d0d59371-96a5-401e-ac68-945802504ed0", "value": 251986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632880309, "uuid": "05072577-4163-4a51-a215-37e6446d7a0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632880309, "uuid": "7648be59-82df-4a41-a6db-0e5f6f06df4c", "value": "payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61962277-214b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632936818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936818, "uuid": "e928f833-ad95-40de-bfd2-9893e351c6ad", "comment": "Malware payload (Gafgyt)", "value": "8f26d68df11368af50aa6c55abbc8dea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936818, "uuid": "594ae498-09f0-4fe6-bf77-33fe73291b46", "comment": "Malware payload (Gafgyt)", "value": "caed559f43f96c6f7e6b75453ce749c133bfbab83adf76bfc69d6b48b49b182e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936818, "uuid": "0fdadcb8-253a-48eb-86ee-ca438a86e58f", "comment": "Malware payload (Gafgyt)", "value": "ea48dcc729f13435fac2cdf8a3f02d7dae6df1cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936818, "uuid": "4d9067eb-83c5-489d-bff2-0dbd83c75542", "comment": "Malware payload (Gafgyt)", "value": "29b02f1309020ea711f06deeb640303f184516299b5a144a4025016409a5fe8ab5d44316a9bc333574477aafef24a620", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936818, "uuid": "4c097404-04b2-4294-8e49-120ec5892ec6", "value": "T13F14837E7E21AB7EE268873207F76FB0C39521D326A19352E16CD7185E7524C184FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936818, "uuid": "8d141032-11bc-47c8-95e6-58dd23a28d55", "value": "6144:GKv3mNeR3Xz/9tmzn3DT3y+aZWlWcWyWOW5WeTg8jF5hUPOzDWmKz6FhdzHWlwq:TgAF5hUP4DWmKz6FhdzHWlwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632936818, "uuid": "db0de124-7bb7-4dec-873d-029b953ab170", "value": 201424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632936818, "uuid": "0e315b51-5648-4514-b2a0-07dee4aa7412", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936818, "uuid": "a2643607-09a0-4936-afbb-bbd5cf2c1746", "value": "8f26d68df11368af50aa6c55abbc8dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3348edbc-2119-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632915265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915265, "uuid": "f2eb5702-8c0a-44c1-88b3-7f81fddd8df3", "comment": "Malware payload", "value": "ef50755f551efe8aececc4bc6a99e9e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915265, "uuid": "9bea0409-364c-41f8-88c8-779e06a73da8", "comment": "Malware payload", "value": "cb14f90c837063f7a2dee749306b1259579757ba73d7eb256defe08c254e3f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915265, "uuid": "cc8759c5-50f1-4b68-ac38-01d72e4ea813", "comment": "Malware payload", "value": "83f1d643adb762dbd8c938dd1c8585336f447a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915265, "uuid": "dbd23069-34a7-443b-85f9-a93f9f34cff1", "comment": "Malware payload", "value": "0cd94e4553ba73c85b44fb9a5d12b1228d2e179706f2d53d5f68a5548836241eabbcf20757c437280fb8e08fc2da2ced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915265, "uuid": "74e34bbd-1ca6-4ff2-8ef4-3bb92f43aedb", "value": "T118034B0033888777D2BE533B4AA7504113F5EA227672EB1EAF84728948E77650F52F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915265, "uuid": "33f02147-f5eb-47f2-be4d-4f3681851af0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915265, "uuid": "b6582ed1-2c4b-43b2-bccd-a94e01f64208", "value": "768:Sx6QS0McU2koGE4DfZQPqWZepQMj4eMFNHiP7zBMtr:Sx6QFMd3c4DB0+fyFRwzBMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915265, "uuid": "0e59caf8-0097-417a-bd3b-4ff97343f9c8", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915265, "uuid": "b01f153f-7f83-4363-8e20-3f78804f14f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915265, "uuid": "2edf8209-b716-4122-84aa-702cebbcb455", "value": "ef50755f551efe8aececc4bc6a99e9e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e09d08-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632896474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896474, "uuid": "bc81264b-c109-4c65-b43e-3f7f5d7037ac", "comment": "Malware payload (SnakeKeylogger)", "value": "6a0506db05638b0f7632ecb3f38e0c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896474, "uuid": "b724f5b5-1794-4582-ac76-1314af68bc75", "comment": "Malware payload (SnakeKeylogger)", "value": "cb6c874b472f621123fb23f7500d8e5b97c67e125eae652f6cb37dd6138c523c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896474, "uuid": "e0374052-0be3-4c79-92e8-c736419a1a64", "comment": "Malware payload (SnakeKeylogger)", "value": "3610f2c07765b0516fb2db50a073eff161195b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896474, "uuid": "b1bbf7c0-4bc1-41bc-8b5d-61dbfc87c09d", "comment": "Malware payload (SnakeKeylogger)", "value": "73126d54c9b7a1510f7460e90c00fd748db209035765961e4301e319acf7a3a6aebf2204591aa1767a7cd3dbe55a564e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896474, "uuid": "89e0c83d-f62c-4f1c-962a-d5205ec94c60", "value": "T10794E09063DCEF5FE3252AB158546D0096B6D38E2193DE4AEC5E05B13CE621CF762AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896474, "uuid": "32d04a23-9c67-4920-b92f-273311caaacc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896474, "uuid": "04ca9a3b-82a0-4072-bebd-32c54482f424", "value": "12288:ceYGEbQF2bH2b4vaN3rmwh6/coHQfMnBDA:XLFYW8v4MUoHvnBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896474, "uuid": "39980611-60e8-44d4-824f-94cc699e4d02", "value": 425024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896474, "uuid": "92e4681e-5ea5-4e7f-b58c-5860be7b81b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896474, "uuid": "150c7fc8-d9d1-401a-832e-d7ecc954810b", "value": "6a0506db05638b0f7632ecb3f38e0c59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf206b12-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901327, "uuid": "aac96efd-fde2-44af-ad9b-da65d2968030", "comment": "Malware payload (Dridex)", "value": "e75ea8d24a7195a84733f8abe682ce1e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901327, "uuid": "945a04d0-4420-496c-a069-9ae748d05278", "comment": "Malware payload (Dridex)", "value": "cbdb425649048b009dc80a94a56218ce49737dc0fa90cba22d70cddaafed8f5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901327, "uuid": "1691a02f-5069-4bd6-98ec-6247996544dd", "comment": "Malware payload (Dridex)", "value": "cb101e97aa521ffb6cd00a9b4029db8d0a9371f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901327, "uuid": "69a6af37-eca4-4611-a335-15bd8faa0380", "comment": "Malware payload (Dridex)", "value": "31d3a5391f95110da60c1af406fbbb10c905acb88b4136a48ef1a460f666bba7201013351be7f6e51cfc075ffe0d9541", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901327, "uuid": "659e7752-5656-4d0f-81c8-aee791b29b94", "value": "T15685E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901327, "uuid": "d0d0013f-7ffb-4fd6-910b-80b1f28a7d64", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901327, "uuid": "7b798f16-1807-433f-9e61-4d9a10ddb26e", "value": "12288:GVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ11:bfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901327, "uuid": "954526dc-5dde-443b-9d41-a82a9d5ba790", "value": 1708032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901327, "uuid": "a05aeeab-9dd3-47b2-a6e4-76dc48d8ebcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901327, "uuid": "11b60cf0-4590-4a73-ae40-c05fa0ca399e", "value": "cbdb425649048b009dc80a94a56218ce49737dc0fa90cba22d70cddaafed8f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cea426-20e2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632891943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891943, "uuid": "3124cc15-4166-49f1-8506-7887336d403b", "comment": "Malware payload (AgentTesla)", "value": "c9138bd31272e55851a3df966ab1e15f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891943, "uuid": "cd430a0d-4865-40cc-ac8b-1d166166c470", "comment": "Malware payload (AgentTesla)", "value": "cbe2ee05ab01683b4c67f3ea4e4a3d98381ee9de99f8b38a911268a013aadfda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891943, "uuid": "f2de9e19-840e-47a3-b43c-511ee38c3740", "comment": "Malware payload (AgentTesla)", "value": "92da9c5d45b5792cfe5f71c8096865a9ee52aeea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632891943, "uuid": "d547c759-a6b1-47dc-8dcb-3aaef6162596", "comment": "Malware payload (AgentTesla)", "value": "1491e80ed8eea6d404bd7885e324fbe24dbe529c111fc861d64837ba9edb572f4aead7abda6f24819e204602af1dc3d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891943, "uuid": "28c112aa-8348-4a41-8a28-2a195a8b69bd", "value": "T12BC423A9A3A11E9F12DA6225739CC3FD7C075C6E943B19F6980A4958E7781882F0CF74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891943, "uuid": "a3e0fb15-8ba3-4311-9572-cf3b2d981464", "value": "12288:wBnTGvms11XzfPpsD4h6PFuxe3WUNT++B96q3CzXq7Rd:wBnTLs1ZzXpsD/ug3796XOdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632891943, "uuid": "8cb52001-a89c-4d4e-9dd7-16ffad2e03b2", "value": 589384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632891943, "uuid": "9ad94636-a79e-4a06-83a8-6e3b17a49e7f", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632891943, "uuid": "64ec0b66-e99d-49f2-bfd9-c2d8d9593806", "value": "ORIGINAL SHIPPING DOCS..exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e199c8-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632899912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899912, "uuid": "a613c0ec-e4c5-4f97-9aa1-d58e5f9ae771", "comment": "Malware payload (Dridex)", "value": "b451942629988008c7d0500f81db4ac3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899912, "uuid": "5868cac6-a3b9-4a47-918b-69f4ce3435b4", "comment": "Malware payload (Dridex)", "value": "ccbeccc02030efc9005f3d8abc23d768fcc1f4fabc15755f0d02adc48c79f0da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899912, "uuid": "bc0c0e06-ce80-4454-add4-91dcd19a22a2", "comment": "Malware payload (Dridex)", "value": "4cbe74e3a6385ba346755187f87c2b9ce35fc1ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899912, "uuid": "608980a7-7413-4fc4-9989-9e776205abc6", "comment": "Malware payload (Dridex)", "value": "d6e7137e24fd5715f69f49a2fe980834cc7e4cf4fdcbe97c3b7024c089cbab5969208494c906a5ffd3dca04e25cdfe8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899912, "uuid": "3d832270-5c3d-49f8-b2f5-85ab24424def", "value": "T10E066B10FFF645C3C09DF73A788D3415B2B3AA65811F8A1C824F131E6CA5B912E6E95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899912, "uuid": "8654734d-aa63-48ca-9568-534371d3fe4f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899912, "uuid": "d37566e9-7883-43b6-b6a5-df7fa9a7f161", "value": "12288:wVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1qA2Y:1fP7fWsK5z9A+WGAW+V5SB6Ct4bnb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899912, "uuid": "cc6524eb-6190-4159-b575-fe0ccdbfd4ea", "value": 3739648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899912, "uuid": "cbfe8421-3a51-405c-9192-d2d997c161b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899912, "uuid": "4aa2807b-b046-4ec8-95bf-b257e1cbcf0b", "value": "ccbeccc02030efc9005f3d8abc23d768fcc1f4fabc15755f0d02adc48c79f0da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe94e13-213b-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1632930131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930131, "uuid": "16f0562b-15fb-4d9d-bf4c-c1689cfce97a", "comment": "Malware payload (Vjw0rm)", "value": "fd8a5b4a046af44f3523c7ad813c1359", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930131, "uuid": "56c05284-f64e-421e-9d99-96e62ef35aa8", "comment": "Malware payload (Vjw0rm)", "value": "ccf62720b856ac64a61f9e1266bf401054738fdd309a57d13787f43dd410a608", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930131, "uuid": "fbb561ff-3b7c-4cb6-aa3d-d7dae262b886", "comment": "Malware payload (Vjw0rm)", "value": "ab2f505db0516fe75dead0010db6f7d30b1f6d84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930131, "uuid": "2385f4f1-20f3-4aa2-b246-dd3ad719cb93", "comment": "Malware payload (Vjw0rm)", "value": "012cf9c6b0580a07cd2d48484e1dd26b9173f13d5c536ee06d2e2f0d34a777b4bd18b76bc436df5be715e3a66019a18e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930131, "uuid": "d09a1f7f-c59d-4acc-89f1-c95b531e7e78", "value": "T1A912AF5B516211BF5072837E021C0A9DB9C9AFA175CDBBDC8B026F71396970BFED4800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930131, "uuid": "6bc726ad-cc04-4ca8-81f1-878cfb5dc6d4", "value": "192:Qbqc4jVl9pBX/HPbVO5puPMmG7NtIrRDQD2QH4KTqCC:QSjZpBXvPbVORF7NGhQD2yPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632930131, "uuid": "77bc8521-4009-4416-8753-2a6b835f953a", "value": 9631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632930131, "uuid": "ea80f5f6-89cd-441b-aabe-82c44cc82507", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930131, "uuid": "a94ef026-1049-4824-bf49-bc59e2b78142", "value": "#00971.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ab6ecd-2146-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632934780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934780, "uuid": "977cacbd-c566-4699-be6a-6500b75c8f0d", "comment": "Malware payload (RemcosRAT)", "value": "d51f8036b14a72ad278e0c0d1202ebbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934780, "uuid": "b787448e-f852-4d62-847e-747cd5097462", "comment": "Malware payload (RemcosRAT)", "value": "cf6ce67191cc8560c728cef61aa68026540656dc1eb22ce646fc67280bbb7316", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934780, "uuid": "173adba0-b079-4c7b-9224-86f8b0dc6eb3", "comment": "Malware payload (RemcosRAT)", "value": "8a236fe3412ff272e1b43ef58a2a9f7b7c04e658", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934780, "uuid": "54b67482-c425-4361-abba-2d3321b8b655", "comment": "Malware payload (RemcosRAT)", "value": "397be9ebe6c0b36ecbce6fad13367d9b9979147579d06b9811094d3ef02fb63f35602d4614ee77c2dd3c303b870356cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934780, "uuid": "f6417976-59d7-4234-a31f-a10cdbb790c5", "value": "T15B25BF6DF61CE29EFD0903B122297CC415E80C6D197CFA17BEA6B5E230AED7651F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934780, "uuid": "57ba030c-6015-4a3f-9f56-870aeb901fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934780, "uuid": "7c9944bf-c52c-41f0-a535-2e8f19c9eb08", "value": "24576:8D4VHfQe6ZyWshg+qbZxTZZWunAWvGPSg0Q0ctsT0h0acLJfLWaJHCZ/L:cmag0Q0ctGa2f71eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632934780, "uuid": "83def76d-667e-410b-9cfa-cf48916bc849", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632934780, "uuid": "ed05e550-142c-44b8-b608-bef84a6050b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934780, "uuid": "4f8fd667-ab29-41f7-8071-561cc70128ab", "value": "d51f8036b14a72ad278e0c0d1202ebbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8abf1b-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632898210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898210, "uuid": "85f6c1c2-d0dd-409b-bab6-43aa18f3a33f", "comment": "Malware payload (Formbook)", "value": "8fa13ba8c6d0f9f43eb25cb519e55514", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898210, "uuid": "8e26f3f0-33e7-446c-9544-1ade5dfe3f35", "comment": "Malware payload (Formbook)", "value": "cf85c3511dcb11fc479d7daa47a350a298f69df7fabdf6238b6e6e95a324abdc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898210, "uuid": "4b5682a9-70f9-4591-900c-5f8d3679ea0d", "comment": "Malware payload (Formbook)", "value": "b2c8a5c93add1fd9841244e5cb36d0a92b8a86b5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898210, "uuid": "3e90415e-3912-4166-9a58-2363d1a15a6a", "comment": "Malware payload (Formbook)", "value": "8d5a925c72f316e861d7b2ebf23e3fcfdc25abd95b7f31a31f17d535c3ad95d794ad759bc00c04bfab88ab13681b66e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898210, "uuid": "e16d9cc4-189e-4ea5-8118-208fb02d8e89", "value": "T1A59423DD7BECC451F4FE5658A3E630472086CAA210E658140FA9FEB1DC8E13BA2E55C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898210, "uuid": "c385941f-9824-4a55-8a62-f39863d709b9", "value": "12288:LDw+jme0iHs1NolElGyLC7eFWMFh9Y2td49zeHHdE00f:LDwVe0vola+7+WM62td4zCHWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898210, "uuid": "b0bbacba-dbd3-40f4-a23d-16a9586bbd32", "value": 409848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898210, "uuid": "08d97f4a-5058-4347-a488-36dca4c0103d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898210, "uuid": "70698c5c-8ca4-4736-853f-c3251558ade5", "value": "Invoice & Packing list.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1321771f-2106-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632907051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907051, "uuid": "9358b26f-3c95-4ef3-a8e4-24493d22a578", "comment": "Malware payload (Formbook)", "value": "da46f894bfb4c008ec86332694e96c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907051, "uuid": "d864f60d-d810-4228-b5ae-7f2f2123813c", "comment": "Malware payload (Formbook)", "value": "d079479dd85fb94fe08f6cd70cfff35e39c14294174a8ed6f9b480ffc1cbc9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907051, "uuid": "fad07aa6-82fc-4dd7-95b2-78912fc13f5d", "comment": "Malware payload (Formbook)", "value": "711061b453fdad42741ffb94e8dd4bc88c843c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907051, "uuid": "88ebcb87-1464-49a9-bd91-6cdaddf0eeac", "comment": "Malware payload (Formbook)", "value": "bb7c50b7c1a181bccf02b8323b0daeabe2ebedfede39d8cbde147103a4dc9962715850d68baf654f7c54bbf1ccd0c3cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907051, "uuid": "b3fc0f07-eae9-4569-b000-b39bc59b7b69", "value": "T15374BFC67BB05852CE04D63DC32E5F19A42B2F346BE4A24BD65178736BF368D0C17A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907051, "uuid": "c3430b78-7b58-468a-be2e-a4d501cec757", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907051, "uuid": "9330def3-f4fa-41b2-aab4-2c1c48c4813d", "value": "6144:78LxBBz+3meeKNf5Pu5P1Wk7rs8KU/DPP6tCJYdaoXUm:TmeeKrPQDvxK0PPdAaoXUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632907051, "uuid": "47c4a3d3-4312-4b06-8e94-5ed2299a87f7", "value": 343798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632907051, "uuid": "ebc4a80f-db67-41a1-8c6d-165615c9264d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907051, "uuid": "addc6b1e-f77b-4f54-b255-d27aba3d1227", "value": "PURCHASE_ORDER_QUOTE_08974_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bfc48a-2124-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632920001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920001, "uuid": "2b0e6bc0-8096-4806-9634-36e2c03c8eb5", "comment": "Malware payload (AgentTesla)", "value": "b9660b8b34d42c61b29c8ef48a0ce5d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920001, "uuid": "510e6762-6bfe-4744-b568-65a417799b62", "comment": "Malware payload (AgentTesla)", "value": "d0f903248ef8d04bc3f51ec058656ffedc3c72beaf65c9142f4f1978c55829d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920001, "uuid": "f9a86018-3d64-4a6d-90e2-8a104d02b287", "comment": "Malware payload (AgentTesla)", "value": "198a8d25f749353b24d5d1904e4f9b2eacf3da56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920001, "uuid": "1364d875-36ee-48e6-8e6b-17ce70158510", "comment": "Malware payload (AgentTesla)", "value": "459c86d40617ee51b01b4160871b59e3619e40252a51bdc8ceee7be0ef7259ea354f3899913d963fc92612a9c4927d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920001, "uuid": "54c8db3d-8123-4ba2-90af-b301a4b8c5a6", "value": "T19BF48E5DF21CE29EFD0803B121257CD411FC1CAD196CF927BEA6B5E270AAE7A51F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920001, "uuid": "3dc8f158-88f5-44e8-a20e-f236e745d605", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920001, "uuid": "ae36cfa3-f06e-4d7f-94bf-38ee56c557c1", "value": "12288:rZ8eJsPAXDbwsUP3gwKZFdUsR1vbBIKKA3NMFTY++Tq0cmD4VHfQe6ZyWshg+qbH:OPWUP3+UsvlIKKAdMFs++D4VHfQe6ZyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632920001, "uuid": "1a8a1df2-27cf-4535-87b0-5aeef839d6f8", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632920001, "uuid": "0a87622d-c2c0-496b-ae1d-866bae890c07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920001, "uuid": "13ec502c-9591-454e-956d-a136e0178f4f", "value": "PO098765KJHGHJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18be0367-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1632898900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898900, "uuid": "3d91c136-6113-42dc-aa81-5daca89d6104", "comment": "Malware payload (TrickBot)", "value": "8cc1c676916c353c3c1a80d9586789fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898900, "uuid": "2fa37c40-e0e0-4849-b945-e01faf316d6b", "comment": "Malware payload (TrickBot)", "value": "d123ffe07c4db0343645678c0ea21a4201debded89f22ca043cf336a77f6a082", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898900, "uuid": "02b0c3a7-6cd4-4f16-83ff-474971fcf2ad", "comment": "Malware payload (TrickBot)", "value": "1bf787e8b76ecfe09aecf6b3267f3a405ce1b0b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898900, "uuid": "bb8cc172-96a6-452d-865f-948416d4cd4a", "comment": "Malware payload (TrickBot)", "value": "3616a022d3aacc449689ad02772691de0a402e9a2495831c01f0a872293603f8bf39c6e9cbbd326175a03f37e28cb6a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898900, "uuid": "b10d26c6-2f7c-4b3c-8014-9e65dbb1635f", "value": "T1A2A4E01232D090B7D5A76A708EF55BF9B3BAFD104B72CA4B93D41B0C1C32593AA27365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898900, "uuid": "1c73026e-411e-4fb8-a9eb-35d35bf27986", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898900, "uuid": "b7406ae2-15fb-4b88-a466-eda049d15199", "value": "6144:ZulNLvVbERG/tUxEHQk/kczyUwSg+8FPo49RP1dG80/JM+UsInyAWIBNPe4:47V4RUtUxEHQk/7VM+5eZ1d3uFInBN24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898900, "uuid": "a26d3355-7b8a-4439-8dac-1cabd67bf31d", "value": 462907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898900, "uuid": "876faee1-b03c-42b5-9225-3b8e3c6896a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898900, "uuid": "250b9329-8ebc-4af9-9022-3a9183666abc", "value": "8cc1c676916c353c3c1a80d9586789fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093aaffa-2136-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632927650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927650, "uuid": "3e25065c-c2a6-4d1a-bb1f-ad1e1a1936ce", "comment": "Malware payload (RaccoonStealer)", "value": "5021c0258bf60f4ffe914b6955310b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927650, "uuid": "a565f9d2-424b-48f4-8a12-243e65ff448d", "comment": "Malware payload (RaccoonStealer)", "value": "d14036b4ab78b2c6121138471582c33a4bf0dbd2076f4c9e640d34a994fce2d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927650, "uuid": "918ccf6e-affd-4db6-858c-f4e26aaa38a3", "comment": "Malware payload (RaccoonStealer)", "value": "dad0442eacc757ecba05d60b9c76f7e63c2d392c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927650, "uuid": "5fdc25d7-b0df-4169-8d31-47566f0ada89", "comment": "Malware payload (RaccoonStealer)", "value": "7693f69fdb2973c980de4b084874a1df6f41a56b46eea87c8b414c761135ce391cce8c49596e07ce74d6e1789e7b2f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927650, "uuid": "1b116be4-05c9-458c-a2f2-af12372c002a", "value": "T102D39D1175A0E3F2C45215313835C6A4693FB8793F61DE473A2826EFDE7D2E18A26317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927650, "uuid": "b03752e9-6a7c-43a0-8a7c-3e174a283a99", "value": "2966ac92acef7bd43000e50be4b3a82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927650, "uuid": "2c023927-032c-48d3-9739-9ac24cc53b5f", "value": "1536:Hzg1TBYAt4Pv1uP0Y7NKQvufR1Ct/3o+xhOZJAj5qrW5P0skf1ZfYv/yYAXadnXY:H61Yl9HSNKQWu1WJW5qrcPI1Zetyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927650, "uuid": "bc32421b-262d-4866-bd47-6ce250a319af", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927650, "uuid": "14104ad0-0fc8-4cb8-ac41-5583ef02baa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927650, "uuid": "d7a59752-b4cc-47ce-8564-07fd4b48585d", "value": "5021c0258bf60f4ffe914b6955310b6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d68e787-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901646, "uuid": "63b86128-3d91-4c42-aaaf-c413046a137e", "comment": "Malware payload (Stop)", "value": "ab20c0dad759a7fbb356eab80383a6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901646, "uuid": "e347cae5-0cbb-4d1e-9ab4-48e6a5afd428", "comment": "Malware payload (Stop)", "value": "d34b0333afa76522d268ba1886698f7f98550fa0da5cae603486127bae326c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901646, "uuid": "833b11c4-f4bf-47f7-b8b6-3f6ccb974988", "comment": "Malware payload (Stop)", "value": "e3b2b35960cc8ef3fbd73ea25e48d13439b1cc93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901646, "uuid": "081cace5-f311-4526-90d8-5c968c69a378", "comment": "Malware payload (Stop)", "value": "da0b72b75b573afac3b45be1d4195c709070cf276641ccd18ba6a526fb176e1c1b26266589453c8aa7cc4534caa8ba57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901646, "uuid": "2c820fa9-2a97-4310-b5e8-d773cb9175b1", "value": "T1D405022167A0C038F4B706F999B697B8B92D7971AB6861CF53E51BE91231BE0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901646, "uuid": "70010d47-1537-48a8-baa4-cbe45c043713", "value": "cc55eae86408874fd9cf40c59e028154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901646, "uuid": "58269436-373e-4795-aefd-529ad144b524", "value": "12288:kCzyUFywqcHrcFv2HrllsJLsW/rZG8SHqbLnD2xIinN1inBIuoeZ9uO:kc5y7cAN2EJdkFKbLqISNMnug8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901646, "uuid": "84de973f-26b3-4ed0-a8eb-5489dc4fc500", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901646, "uuid": "dda34867-7c5b-4c23-a62e-9fff187e53cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901646, "uuid": "5eecf58c-5772-4806-89d7-eb2df9f65b96", "value": "d34b0333afa76522d268ba1886698f7f98550fa0da5cae603486127bae326c59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e387edd-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901674, "uuid": "1e831ef7-f8c3-4ba5-95b3-b198c04a9078", "comment": "Malware payload (Stop)", "value": "bd2942cdd22e0c2cfd80a677f07fafa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901674, "uuid": "aa8798fe-dce5-4f7c-b58b-3d2dad9132a9", "comment": "Malware payload (Stop)", "value": "d4a30f137e41ba8ea5fffa89ae9fc3b01364e4f880584946d0067c4b8532a384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901674, "uuid": "5ab36f6f-a9f9-43b6-a79a-cc90da1ad5b8", "comment": "Malware payload (Stop)", "value": "7351adfbeac9deebccd325d2ef688798b76f0923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901674, "uuid": "68b52bf1-3498-4eba-a9d4-d390f11bb42d", "comment": "Malware payload (Stop)", "value": "5f4c3fc909231c6172b1f891a7e6036008b029c380cc45d8fec2d5f2ef450f60750fa8d8d97d492629fad92780f761f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901674, "uuid": "d59b84fc-7dc3-4d5b-b66a-8fb87575059a", "value": "T11EF40210A6E1C034F1F726BA9975D3B9A82DB9B05B2091CB63D447FA4A747E0DD30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901674, "uuid": "e5199619-0f60-47cb-83f6-34cf89045600", "value": "1435fac27cb0e146b6806556c822ef8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901674, "uuid": "5dc53212-e3da-4d0f-8948-c21e0cdf26e0", "value": "12288:7u3osY1PUfgIq8C857ezGUf7MdpDNgOaklagDiOF7AwW+Ebgcyjh3/Mm:a4sYifXifWbgdWVF7AwubpW3/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901674, "uuid": "1ebd00fd-6901-4984-8edb-a96656beee85", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901674, "uuid": "8f5cac8d-c260-42d3-86dc-de1a72545374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901674, "uuid": "646ae42a-9d72-42b0-a8ad-7631958d2618", "value": "d4a30f137e41ba8ea5fffa89ae9fc3b01364e4f880584946d0067c4b8532a384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95709c6-212d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632924134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924134, "uuid": "0621a088-efd9-41c6-b947-fb95617cc321", "comment": "Malware payload (AgentTesla)", "value": "05efc5e702b0c8597e094faf42f54f65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924134, "uuid": "74e30a6f-1258-442f-8dd2-937bd49329b1", "comment": "Malware payload (AgentTesla)", "value": "d52c6113caf822e0d980a02dca0fe6d6b4e8ecca7baecc9ef250f6a25008c99e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924134, "uuid": "7d3cf04c-0418-4444-a9b1-74d264f9ec3e", "comment": "Malware payload (AgentTesla)", "value": "629fcd21e8b66c196b3e29cf1cadcead082a3197", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924134, "uuid": "cbe410af-0734-4525-931e-7866552c7f54", "comment": "Malware payload (AgentTesla)", "value": "48c8bcf19f2a49cf748edccdbcc40cebbebdd77a1af532d844ecb6517920b221b23c8300ccc693e8045f57461148e56c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924134, "uuid": "5d465c71-2375-4f2d-a3b9-b1f23c99f04a", "value": "T1F3B4231F684B4D46FDCD671EE912ED0D1870FFB24AD6428358CBC1A9D605BCC62D22AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924134, "uuid": "b54a1191-bef5-4cd6-913a-fb9ce305f0b2", "value": "12288:7/1hNEG7WXopRTxEoUpiNXMrYt2gW8UCPR/DT75/:7/1hSG7WG1UU5SgRjPxT75/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632924134, "uuid": "c8e7f8bf-fe69-49d3-a02d-b0a6b859c335", "value": 539846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632924134, "uuid": "d2b3bfec-2e2c-428e-8710-932b1fdb7c75", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924134, "uuid": "78e715e0-f49c-47b6-81b8-d975a7be0476", "value": "New Order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfd4959-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902825, "uuid": "80d6f55b-f34f-42d5-9701-99e6c5fe9e03", "comment": "Malware payload", "value": "ed8f1b6831bd3557185f20d1a3048825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902825, "uuid": "b5338f2f-d3be-496d-b9e9-717bd1e19b95", "comment": "Malware payload", "value": "d53137f407ad26e8f631aef6be93cb3a9720434fab0f1391c52c4d17cf3df105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902825, "uuid": "10e8653d-547a-4457-881c-5c91806cb754", "comment": "Malware payload", "value": "46cb314b711de3f919e59534bb33bced21ace5d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902825, "uuid": "30e45028-3441-4225-86fa-c02cc9194610", "comment": "Malware payload", "value": "489bfad58f95923a518cb7c027c5b81c1a035dc705d78b3242b5031ec6c8ab63c2b3d9b5f778882f2904a96b222b8053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902825, "uuid": "1a5795db-722b-4ac1-8204-3cf406f12991", "value": "T14973BF15BE810D08E7F80B3205EC25C6067FFB4EEA7056CA5D2E65A82B37B9099D0764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902825, "uuid": "0d0ff6b2-8d15-48c0-a7df-908ca271546b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902825, "uuid": "a7e72a9d-26b6-47c4-8a10-a8211de8df85", "value": "1536:j5kdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6Q9/pf1A1:j5Tn7N041Qqhgo9/p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902825, "uuid": "2e579537-836c-4a8a-9e98-fad7f6cceda3", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902825, "uuid": "9bf96f4f-4d97-4554-b698-08c663bda6c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902825, "uuid": "77228a74-7022-48b9-9f50-ee082723ad39", "value": "d53137f407ad26e8f631aef6be93cb3a9720434fab0f1391c52c4d17cf3df105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d0b9d9-2151-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632939263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939263, "uuid": "860d2753-a106-4aea-b6da-140ae3fb25ce", "comment": "Malware payload (Mirai)", "value": "b90fd953a9d144242d30895285753f72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939263, "uuid": "78d23631-c030-46d8-9ace-71d3b07735c2", "comment": "Malware payload (Mirai)", "value": "d55b0d4b47928836dab18856b1152986203965990f13aa1fe51cbf133fb96f94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939263, "uuid": "529b274a-53a3-4334-9539-1e58eba28fb3", "comment": "Malware payload (Mirai)", "value": "28929e32d1a9de50c1d5351921de44fa80a8d23e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632939263, "uuid": "a1738d69-b278-482b-bf86-b8caa715b37b", "comment": "Malware payload (Mirai)", "value": "df16c09efabf9521cbe7765272d5bad7442bd3a08d3701bc081760ffc74a1ee72e866202c656a79d44b3b30d3de8a000", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939263, "uuid": "58225168-5442-4d75-94e7-73067a7d24db", "value": "T133A35BD7FC00EEBDF84ADA7641570A0AB130A3A10E921A33B2536C67FD751D45A37E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939263, "uuid": "3bca1973-e59d-46a2-83cb-b341574116e5", "value": "3072:7iYlNff1SSna4LlNGeR+IM6D2ybGO8bhB7J3/h:7931ta4vGeRrQybCbrJ3/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632939263, "uuid": "329e108a-4c07-4907-98f2-0bf92a5308a0", "value": 106632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632939263, "uuid": "256be674-c79d-461d-893c-ceb91accadfd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632939263, "uuid": "32397a14-68be-48a9-8cd0-2327416d860d", "value": "b90fd953a9d144242d30895285753f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdd5fcd-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901650, "uuid": "abd309ae-0d9d-45da-ad40-8e535df16e56", "comment": "Malware payload (Stop)", "value": "294aa34a352a6bd8a4c623988b4d0509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901650, "uuid": "4cb17dde-479f-47a5-8bcd-adbbc23270b9", "comment": "Malware payload (Stop)", "value": "d58fb2c3a56ea6bce3e4d7979a1e6860db641e53a4821005ac4a58cf447ce876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901650, "uuid": "e9b03a8a-7cb2-4aaa-833b-e2fec9873404", "comment": "Malware payload (Stop)", "value": "5aa054b056580a9ea76a77f35885a768170fedef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901650, "uuid": "7132341c-31ee-4854-a0b0-9f1db31860dc", "comment": "Malware payload (Stop)", "value": "afc2ed4f98cddee4894658358c6ab3074d34d4b24dc689975739147840047a78c0c582b6f7c659203ab68232f74bd7e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901650, "uuid": "baff2f13-c97f-4302-bcce-f0b5acaedcca", "value": "T19C050220A6A0C035F5B352F559BAD77ABA3EBA71A72490CF52D116EA4734AF0CD31343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901650, "uuid": "4afe375f-f0d8-47bd-b9b0-f580ba7ea9bf", "value": "cc55eae86408874fd9cf40c59e028154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901650, "uuid": "f148b80e-23f4-467d-bb88-34e1298dd024", "value": "24576:C69y86LAE5ukyERTXpPaB/hw8Po+sJ8n2V+uYQGJM:C6dE47ERTXxaO8glQ2MuYQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901650, "uuid": "65ea601d-5632-4099-8ec8-d359b3d20306", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901650, "uuid": "f286573a-025d-4b5d-bb28-3c82826943e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901650, "uuid": "3ffb8dfd-6c1d-4df9-a4e7-f8dae0e3f767", "value": "d58fb2c3a56ea6bce3e4d7979a1e6860db641e53a4821005ac4a58cf447ce876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c724b6b4-2125-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632920668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920668, "uuid": "6d0f737a-3a1a-4195-90b2-80b3383ef67b", "comment": "Malware payload (Formbook)", "value": "61498fdfcfdec5aa4d99e775e58142e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920668, "uuid": "be842a79-58bf-45d1-ad6a-6553cbac33e8", "comment": "Malware payload (Formbook)", "value": "d5a3b850dc0e753c98a4ff8d4fdf8c8cdd58b0e134e741db5a34b47e7accf0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920668, "uuid": "51884615-252c-4bf3-992c-b68cca71cf3b", "comment": "Malware payload (Formbook)", "value": "7fe70bb27f8d899b9acf3765fdb92782f9c0a9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632920668, "uuid": "ebe83260-1065-40c8-988e-9374043a1f14", "comment": "Malware payload (Formbook)", "value": "4baa1a2c41d1ac3a022a5e8e1616029128d732b2c98a016cba388cc44915089110ab5d7af7428563b03a13ad933e1a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920668, "uuid": "23ef5c34-439b-483c-b528-41f5b9ce2c38", "value": "T1C9E48D69F20DE29EFC0903B121257CD424EC1CAD197CF917BEAAB5E230BAD7651F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920668, "uuid": "82c15c2c-35fd-47bf-b774-21962d818c96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920668, "uuid": "ba486eb2-cd52-472d-a6e3-cd2e56c4a9fd", "value": "12288:0D4VHfQe6ZyWshg+qbZxTZZWunAWv2rtcQqw1zmrVKAr/ctQoG4LCeoGgWABJkHY:0D4VHfQe6ZyWshg+qbZxTZZWunAWv2a5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632920668, "uuid": "a0ba348e-765d-425d-a038-81dcb470d637", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632920668, "uuid": "869e913f-9cfe-42cd-a3da-d6f1e2bbb46c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632920668, "uuid": "a5850cee-c354-4f8c-9c48-25c63543a528", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138c6de3-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901039, "uuid": "785ea12b-113c-4957-b5c3-ec1fbaa185f0", "comment": "Malware payload (Dridex)", "value": "d543ec7cab23e1b5c9597cd70f82f7f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901039, "uuid": "930b02b3-0ea1-4069-9033-bb9a38e96ebf", "comment": "Malware payload (Dridex)", "value": "d5cb49a8f3887d0cf03bcff1edd3e30ed57b4b2e4a8c43e9b82f3202e85f7f35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901039, "uuid": "0956f900-b071-4b2e-90d1-982d815f6d94", "comment": "Malware payload (Dridex)", "value": "04a4ef1a4482b8690cf07e85064e44e2e5fa3c54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901039, "uuid": "92cb87d5-ae76-47a6-8199-11bb79283d69", "comment": "Malware payload (Dridex)", "value": "1dfc333b1821e66ca42fc3d982339400a5e360545aa17c4e51d9f53799f642b628b956efec80a885e543a713c58c3263", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901039, "uuid": "63e9f5e5-7fe3-4f7f-acc3-1987c65e399d", "value": "T12295E010FE69EDE6C6B99F3E9408352317B93D74130D618CC391604F5EF82546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901039, "uuid": "551a14ec-af51-476d-a923-320fb538b407", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901039, "uuid": "6845a97b-b100-4ed0-b655-23c16bb7d19a", "value": "12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1RH:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnbRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901039, "uuid": "d6d46759-e6cc-4e37-8762-16c723055d25", "value": 1949696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901039, "uuid": "dd5aaf2d-ad80-4b29-854e-dda2f102550f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901039, "uuid": "6a326b3b-0d0e-473c-8281-24e90bfc5ed2", "value": "d5cb49a8f3887d0cf03bcff1edd3e30ed57b4b2e4a8c43e9b82f3202e85f7f35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6f1387-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901349, "uuid": "605893f5-1c89-4741-be12-0efefe07c3ec", "comment": "Malware payload (Dridex)", "value": "5274b3e8f140a70a9e7365eeb37b10c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901349, "uuid": "74c5b329-3483-4440-a0ce-6196e78619c5", "comment": "Malware payload (Dridex)", "value": "d5feb21b24b2582d2946b0d875843e54f6be40a74530a47a70e71afbb1d91f55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901349, "uuid": "195d8064-9fa6-41c7-875f-448e0ec4e23d", "comment": "Malware payload (Dridex)", "value": "89e128b01dc2f6f169dcac7ea1e7fe3f743ca8c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901349, "uuid": "3b92e0f7-2e16-4d43-99bf-6e26daafe1e1", "comment": "Malware payload (Dridex)", "value": "c60e6f12bf9a89ca0de2f25763ddab1d49a726ec6a4b437c3881e3c27570865bbd74705b4a505c58ff311764e173e51f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901349, "uuid": "ec5eb306-a512-4e46-9cc0-abbf650f8b9f", "value": "T1EF75D020EE69E1F6C6B89F3ED408352717B93D75110D608CC392604F6EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901349, "uuid": "d7166e1b-5d93-43c2-b90a-4a58b05a9301", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901349, "uuid": "16d9bc3e-51ce-4370-8b56-4926ddf0fd01", "value": "12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901349, "uuid": "cc6a8074-fd25-437c-96e6-ba86db953bdb", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901349, "uuid": "7038916f-bfe2-44bc-acaa-d29e06204d49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901349, "uuid": "1785ea65-fe28-45a3-92c0-5560974626dc", "value": "d5feb21b24b2582d2946b0d875843e54f6be40a74530a47a70e71afbb1d91f55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4f4300-212b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632923196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923196, "uuid": "d10e7f96-67f8-4d0b-a09f-d28b6fd51657", "comment": "Malware payload (RedLineStealer)", "value": "8b950c7b5909bc6ab5169492645d58c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923196, "uuid": "d9e52681-541a-453a-a604-ea2fe69e486e", "comment": "Malware payload (RedLineStealer)", "value": "d61d33074ee4ad694efb6573a5f40923cd31c96d78a9a54934c11e0671766b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923196, "uuid": "9ce2c4a2-da67-40cd-be7f-cf04deeffeac", "comment": "Malware payload (RedLineStealer)", "value": "987eb726373c3c8d23c7a60c16a7134f9d112c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632923196, "uuid": "a37a49c0-94e3-4be5-9122-6b466ac02ae9", "comment": "Malware payload (RedLineStealer)", "value": "13474070c62b7b273d7e271c4899f31d0645499625807deeb74ec726a664fcc2e4009cf79f30d7be0fc18050b8f9424e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923196, "uuid": "e06282c5-9221-4674-8334-ecfd48373cca", "value": "T1D7A4F16672E02158D6B682F6C9921746EA3170721B15B3DF27B853B21B2F4DA8F3D3D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923196, "uuid": "49f710a4-6410-440e-ae1f-7e4108c3d444", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923196, "uuid": "df3cce4d-c455-4e9a-89d1-420c902fed06", "value": "12288:IbjDhu9TlMgJ/lyUz81DWkqO5NCex1y54O3sk:21eTlMgJ//89RqO5NCefy54O3sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632923196, "uuid": "5dc55cd8-48fd-4d7e-b5f6-fd22e3a0f4bd", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632923196, "uuid": "db534331-ddfa-4870-ae76-a02787dc3d83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632923196, "uuid": "22ec3c8f-22fe-4d20-be2f-ea41f56f872a", "value": "8b950c7b5909bc6ab5169492645d58c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7f45a9-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900381, "uuid": "cd0c36af-d491-45be-874e-01bc4964cc83", "comment": "Malware payload (Dridex)", "value": "c6598fcf62721fced163e5348521ca7f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900381, "uuid": "a5533ffc-3311-4426-bcf9-032a13b9d4b8", "comment": "Malware payload (Dridex)", "value": "d61ee3efd763eeb2020f8a0a54481ed29cf56993a256fd51924c18dc62887c2b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900381, "uuid": "830dc1bb-9b50-4142-9664-754a8b0b0ce3", "comment": "Malware payload (Dridex)", "value": "83fa189b3bec149927dcf2487a9f0bd821f1e2ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900381, "uuid": "c264fa54-e958-4a35-89e0-facf5e6ffb54", "comment": "Malware payload (Dridex)", "value": "007509bc31e452ea6b7bd76b21b259fd6e6c4b902046eb0cc1305f6b72324dffe9aee69b84acff49ac8ea2e8cc288034", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900381, "uuid": "b10a97dc-73cf-44e5-ac82-5b7faa5093ad", "value": "T190A5E020EF69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900381, "uuid": "fa1ee95c-ef43-434d-836a-5b3a2dfb05a2", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900381, "uuid": "62afcd8a-2a21-4c12-9052-03e43cac591b", "value": "12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900381, "uuid": "e237fcb7-7e64-41df-8eeb-3848b3e9a399", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900381, "uuid": "6f93ee77-7078-4442-a881-fa18432614f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900381, "uuid": "0887e6d1-871e-4bfc-831d-6b224307e96b", "value": "d61ee3efd763eeb2020f8a0a54481ed29cf56993a256fd51924c18dc62887c2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06800b74-214c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632937095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937095, "uuid": "82a9b8d1-c095-464a-a675-1e793d26187c", "comment": "Malware payload (SnakeKeylogger)", "value": "79bf6390188547b6fbbd29d5f39da430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937095, "uuid": "200f6b74-9000-423f-9fde-ec55743ded18", "comment": "Malware payload (SnakeKeylogger)", "value": "d6b78c3a27c677d6a47a8f2b3946404a6b82a108618f124f3d73b306218a3bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937095, "uuid": "733fa1c7-a35c-4abe-9b29-1b38b797a7b2", "comment": "Malware payload (SnakeKeylogger)", "value": "92d1d047a08e3f77bc915f256b6c628527dff865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937095, "uuid": "a147953b-b8ec-4871-81a4-9f7f68dcc170", "comment": "Malware payload (SnakeKeylogger)", "value": "a7ddb306f5df51466fdcbd629d3058184510acb00c2b8838adeeec56cfc46b712bf31e9924db7d943f9aae551d15e99d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937095, "uuid": "4d08cd75-8738-48c8-86dc-0fcaddd176e0", "value": "T123C4BF873940C5DCCF6D51F7A217855473A9CCFFCA08A60A6FC837579EE5AA2082271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937095, "uuid": "6ad89bef-dbef-4e8f-a087-4975d944d923", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937095, "uuid": "c1f55b84-0cbd-48d6-b268-fce69e6cdbd5", "value": "12288:f6nvmjqKoeWxtMkouctOQbBjbhvAquoM/e:f6nujqKoeWEtn9jlvAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632937095, "uuid": "209e305d-ae6e-411b-a75d-8207a9977191", "value": 544441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632937095, "uuid": "a3b902aa-a329-415c-9499-49775eab12f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937095, "uuid": "d67d38ad-cf6a-4a3a-9111-d03cb04d708a", "value": "Nuevo pedido # 765-3523663 ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8a301e-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632901856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901856, "uuid": "9fa87113-22d9-4876-b871-12227dc19ed4", "comment": "Malware payload (RemcosRAT)", "value": "bc9d4feac55d2bc2a7721db06aa4597c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901856, "uuid": "77f4fe1c-1798-4413-99a8-700680864a51", "comment": "Malware payload (RemcosRAT)", "value": "d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901856, "uuid": "4d69d680-3bfe-4377-8891-30b49ad10836", "comment": "Malware payload (RemcosRAT)", "value": "109364c2ded28d6e5ab61c49fa16e744905fc4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901856, "uuid": "1b838252-b6f3-45ab-970b-e06d5d9bc0de", "comment": "Malware payload (RemcosRAT)", "value": "85cb0db71c63e6e2ff78ce1685e92bf281597f34d8614da279b6ab0387e3677afea8717d109cc454782b0305c58ba017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901856, "uuid": "73ba28c4-e569-4874-8065-1146c9a1e406", "value": "T1B4B48DDA1EB457CBFB4E01F8F9792B8813BA9028D59BF3C2CA45B0B351367644920DD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901856, "uuid": "d53beb5f-4fb3-4830-bbe6-2acb16da86de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901856, "uuid": "0ea2f875-7506-426b-8bb8-fd301f8534bb", "value": "12288:tzGz3Ni+hBr7IUA064lQHIdwFGG+DHRBlJPPth:tGNi+hBr8UAXmmFGGiJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901856, "uuid": "5d47da95-91cb-4f93-a78b-0b11df570259", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901856, "uuid": "3e6ce446-42e1-4387-b926-5a2d2b37c0e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901856, "uuid": "cf46c74e-8e2d-4baf-b47f-35deaf453a81", "value": "d71b625ed03ed8629f0cffa7c61cbd882f0c2541f84c9f17320b351d44ca0381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb796f3-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632896409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896409, "uuid": "b689180f-b288-4110-b7f9-a431b0665e0f", "comment": "Malware payload (AgentTesla)", "value": "b58c016cbcf77229d09a5270e007e5ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896409, "uuid": "e0658692-5314-490d-85c3-be368d354e45", "comment": "Malware payload (AgentTesla)", "value": "da2d98f266927aef6e374edc0dfa54bd305ce7451dc620aefd289a991e6f6eb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896409, "uuid": "a6975965-b959-46e5-9f3d-9c8e8114ecc9", "comment": "Malware payload (AgentTesla)", "value": "99738c6a5f3c8d9ab0f402f0171064f78e6dbf5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896409, "uuid": "2457d242-f8f4-4f27-bf14-75e7d6278c7c", "comment": "Malware payload (AgentTesla)", "value": "48e9c2069b383108b0cca06d2c1ff8edb6bd38ed8ec38ffd5ccd2b54df654cd41e260225d2f98f828edb4afaa008c01e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896409, "uuid": "da2d3fe7-aa0a-4021-88ad-c5cd5240fd36", "value": "T161828DBCE9474194CF86A7B8AB0B2E45018C76ADF7C8A872327C87742BD5C7E511293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896409, "uuid": "c077ab3d-97b2-4c55-b372-99e762812197", "value": "384:WG59VSWizIgMWLHK5JMagjs5eOLnaWH1d6PubANWYA6gQ5K0:D0Xs6DQh5gpWH7695K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896409, "uuid": "331c81e2-4c22-4966-b611-d8d85e875267", "value": 19072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896409, "uuid": "6352717f-61c8-44b4-adc7-ea12fd3e2c92", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896409, "uuid": "0b3d31cf-b8d1-447f-a77e-dce6e16d2e0c", "value": "TT COPY AND PO-W9282817281929.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a863affd-214a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632936507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936507, "uuid": "231506f4-60f7-4018-ae2b-84de29d74238", "comment": "Malware payload (Gafgyt)", "value": "69e43efeb30f2630a9faa662d078958d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936507, "uuid": "cc87bb3d-4824-4114-a7b6-a2e481c01f86", "comment": "Malware payload (Gafgyt)", "value": "db211e6c4a03b60bf17ee9879b4e3c05d8dc27acac284bebd0160eb010a55389", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936507, "uuid": "3256d9d0-d411-4b88-a6e8-3efb8fdbca74", "comment": "Malware payload (Gafgyt)", "value": "99fcec9166518447ed09530019c4b3f2011fa253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632936507, "uuid": "fb8147f4-fca8-4b22-8932-746d8bd823d5", "comment": "Malware payload (Gafgyt)", "value": "f8d7fb86d9f285fcd0f1d6e89955a197c0c1db64ac36dca099d3eacbbd5eced1e7e7acf0cec996e9fa3c05e868565177", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936507, "uuid": "9dc1c9ef-83b4-4eab-879f-0745524759b7", "value": "T104C35E49EB43C2B3C4430BB2028BAA5F8921F5BA8A6E8F45F7592CB4AF134C57315F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936507, "uuid": "1e7b689e-2007-404c-bd0e-3f21aba817db", "value": "3072:2oozSBTk1z5o/mVjjp4BnK959V4yyPTFaVMHUJnM4mF9tMB105hkp9jMQBLmrMV+:2oX6eg105hmjjLmrMVduyV/rG+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632936507, "uuid": "730a5b33-ed64-4878-9119-69419175b4aa", "value": 127255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632936507, "uuid": "64e7de6e-5af9-401a-9e20-8b1e401ef0ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632936507, "uuid": "eb92f59e-9a09-41c5-9cc9-16fef3a0c77e", "value": "69e43efeb30f2630a9faa662d078958d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc630cc-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900549, "uuid": "007c364a-35cd-401f-b85c-61b796e4640c", "comment": "Malware payload (Dridex)", "value": "2854262c2ca522fb9f3663e6b6ccdeaa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900549, "uuid": "fd04f3c5-a9f8-4148-88a4-8d088657e37f", "comment": "Malware payload (Dridex)", "value": "db9c139016780618d9790acd85af6eecd410f587223d3abcb22da4c3f38d94d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900549, "uuid": "92d01d28-0760-4be0-ba36-071b3b20708a", "comment": "Malware payload (Dridex)", "value": "2db1feb916c0325827c35e3587be191ca599ff88", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900549, "uuid": "86928391-385e-4567-bf90-ed6be2d75520", "comment": "Malware payload (Dridex)", "value": "f3205abe93b745cb1acff0d0dc38ba86850c068c54f8584da4169b9991efc4d72e33715d4d4aa545cc6ddec6a51f886d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900549, "uuid": "843005e9-adf2-4e7d-b4b1-f22137f7b038", "value": "T1BA95E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900549, "uuid": "053abff2-6d41-41aa-a8c4-69531f19a66a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900549, "uuid": "f44524e0-5f49-421d-9b9d-1b47b6e98a27", "value": "12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900549, "uuid": "e1d04150-6fe9-4508-8395-caca6a9a3e42", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900549, "uuid": "7a36a908-43fe-4f74-8ed0-d84e3fdd3633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900549, "uuid": "c7fa4afe-e78c-4835-a1b9-d31426c3e9f4", "value": "db9c139016780618d9790acd85af6eecd410f587223d3abcb22da4c3f38d94d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3422265e-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1632899376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899376, "uuid": "5eecafa7-7ad2-4000-9bcf-d5c5059f01a4", "comment": "Malware payload (DanaBot)", "value": "52aa6302df3180d3a2ebf75b62f1c0e2", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899376, "uuid": "6aa7662d-0ae9-4cf1-8022-291e146d8865", "comment": "Malware payload (DanaBot)", "value": "dbeeb0dca252e3cec1387f61df6adb493b366de3a385e306bcf21f64db7e5363", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899376, "uuid": "8f9e3b9b-52af-44bc-abd3-704edb7bc7a1", "comment": "Malware payload (DanaBot)", "value": "6bf8933eb159b51273b2053e66cf03278c09ee0c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899376, "uuid": "3d4e9e41-cd09-4ace-962b-2957fb171910", "comment": "Malware payload (DanaBot)", "value": "ce700eb042eb9d8ecbf097137e74676f355a195d000edb7a1481eead1c7b09ff79f6beb6ff5e10c91765f5f60a05c5b0", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899376, "uuid": "1b076b3f-8915-417d-b0a6-a6971c2dfee1", "value": "T1B4352300B96182F0C75105BFE86DD3DCB56EB9DEA7E21B326649A9DF25B81437827303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899376, "uuid": "5b06705f-9ea2-4de7-8ede-dc7fdccb8a5c", "value": "c660fd6c06779da3e6c79f00060c3a9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899376, "uuid": "80372516-9941-42d7-9bec-6bf7a36912d4", "value": "24576:8uzDsnKYDRY9mcUybQsM/WHsTcD2HH0CBJwENiy3S4tI1:8u1ZmcUVTuHqcD2HHXJ3N53S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899376, "uuid": "b489fb8c-3b53-4d60-8280-83fb44693c6d", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899376, "uuid": "2c302051-228c-4a8b-8623-9230784a7680", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899376, "uuid": "dc27f164-e6fd-47f2-8abd-2d85cdcd1ec9", "value": "52aa6302df3180d3a2ebf75b62f1c0e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f38ea2-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901070, "uuid": "c443b306-09f7-4294-96e8-244e70a9047c", "comment": "Malware payload (Dridex)", "value": "1d233e3a125ef5743ccae94be318ea6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901070, "uuid": "6cd9aeb5-473a-44e6-bd04-930ed1b75820", "comment": "Malware payload (Dridex)", "value": "dc04225d29393bc9ba12e513b25172c130e6bebeba91783024188be85ae08de8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901070, "uuid": "6073d237-4033-4ba4-9bf2-d34dd23f34ed", "comment": "Malware payload (Dridex)", "value": "9a20db40fb56234719ba7d142253ca3c87b835a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901070, "uuid": "abf67b7b-efea-4d9b-81a1-a80155bbb28f", "comment": "Malware payload (Dridex)", "value": "cefaddb273f7fdf729461e491484f07b5d7111017f9b88f1681d81eb3e6f80fc2f17a4b65f62efc35cedfb46a0969d95", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901070, "uuid": "9b959368-27da-4b29-a1c9-d07528b68e8d", "value": "T1E895E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901070, "uuid": "389fe344-94c5-4e01-9dbc-69185db65c59", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901070, "uuid": "c57c5344-cf16-4c9e-8799-0c001aedec21", "value": "12288:BVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:wfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901070, "uuid": "09d3a7cd-b227-4343-9c61-787a05e9e90d", "value": 1929216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901070, "uuid": "6d921d44-db49-40ad-84a8-5310937e19ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901070, "uuid": "ca37edd1-98c6-4e9b-9dee-13f8bee42827", "value": "dc04225d29393bc9ba12e513b25172c130e6bebeba91783024188be85ae08de8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23b6ca7-20b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632873925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873925, "uuid": "4022b78e-6bb4-4fa8-be85-2656d2ccb45c", "comment": "Malware payload (Gafgyt)", "value": "ccdb7e4039e755d0b1239757062f8afa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873925, "uuid": "48e0b674-2a69-417b-91c4-5f609914a955", "comment": "Malware payload (Gafgyt)", "value": "dcc66466b399cd80eccb70f555fb6ba64a2a5cd837781bd1450be05f7652ee63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873925, "uuid": "4b918c9c-5242-4113-83ef-bacd4957ef22", "comment": "Malware payload (Gafgyt)", "value": "183391c9d7ba5bb67f7f2c302d560eb5204aabdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873925, "uuid": "26b19ba9-c892-4ad3-8531-1733933028bc", "comment": "Malware payload (Gafgyt)", "value": "c9ae0db86cdc8f27221f249d16485d79ec83dca0b9619b702d2de6a856a6e166228027a5f011680a8d0a591faa913a5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873925, "uuid": "62e50a9f-d7b8-466e-ad8c-fc2b35b51b0f", "value": "T1A8B3E867BB11CEB7C85FCD730AAA8615108DA99716D47B6BB3B4C95CE70694F08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873925, "uuid": "d1a3472b-0829-440d-b8d7-c061cd4c3de2", "value": "3072:RdbrMMuPEqc85h1znqQxmkizF9GhsRiAe:R1uMN85h1znqQxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632873925, "uuid": "7fabced3-35bf-4e4d-8878-380a5b904e65", "value": 115387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632873925, "uuid": "25a51dbe-020f-42c3-91eb-dd177d90572c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873925, "uuid": "838c8530-aead-455b-a801-e860523fff11", "value": "ccdb7e4039e755d0b1239757062f8afa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916f1587-211d-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1632917141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917141, "uuid": "1877048d-8f5f-4336-920e-ff940cd51b49", "comment": "Malware payload (GuLoader)", "value": "acef1456b93331b4e1d4a913c8a7822d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917141, "uuid": "65d5bc6b-1869-4dc4-bce6-9f93059769d2", "comment": "Malware payload (GuLoader)", "value": "dd7f872c8cae1b9e8ad8cb1b9f834e1b6e8f8c8081bde46b13a141810ca1e126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917141, "uuid": "e42efb7f-afe6-45c6-aa4c-72421eee328e", "comment": "Malware payload (GuLoader)", "value": "c750db425e68848bd349f8c3639f198c845bc584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917141, "uuid": "a6a23906-1320-4c50-a1a7-4c4c342104fd", "comment": "Malware payload (GuLoader)", "value": "10d2478c3255df30f7c5694533de01ef00ab0cb3d3a6b832a400e60f34dc2a737331d6c8734a3b0cbaf1391d1eb80e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917141, "uuid": "f1c82536-4b2b-4da2-af72-ca71dc59b0fd", "value": "T1E2935AA636D4EEF0FF8056F51C7C24BA1822BB5C88619F1BDCCC651A06E66466CD1B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917141, "uuid": "091c5c70-7cf1-4bf2-a11c-f1242ab46b81", "value": "e73b8c032c82c64991ebe487a7ffcd43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917141, "uuid": "abde9c1b-5f90-40ad-b2c6-b1637d691c1d", "value": "768:tJIMd9A7Nna2KO2nnMAf5RAMK+lWJXrKK/CTUxiAC/rB152ehsHU7Y1gcmRzVLxw:tKoGNvanMA00WJXrDxO1516HUE7mRzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632917141, "uuid": "070c3f58-0d36-4d58-94df-2064b8a90b76", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632917141, "uuid": "72bfa3d9-5f3c-470d-a8de-5a96e1fff6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917141, "uuid": "8f7813fd-fe97-4b41-b295-a007f686e348", "value": "184285013-044310-sanlccjavap0003-7069_pdf (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e952b85d-210b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632909558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909558, "uuid": "98f408ee-9f55-448c-9378-f2feb8256ef1", "comment": "Malware payload (RemcosRAT)", "value": "0ca89e863cf1cfe049593aec504c6c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909558, "uuid": "f74b3b66-6970-45b0-b728-79b91fbc592d", "comment": "Malware payload (RemcosRAT)", "value": "de10b56f8fb321be38064332e6938917790f2fada2cec604aa89c6a0de071ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909558, "uuid": "65dea8df-c2d8-47f8-a699-eecdcc33b593", "comment": "Malware payload (RemcosRAT)", "value": "06cb8f06a5857fe7b12d2c5386ce4c222d30625f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909558, "uuid": "86cdb35e-7483-4aa9-822a-5993ec3f093e", "comment": "Malware payload (RemcosRAT)", "value": "caeb08dc8ff603b02e89f3b76ce2dd8f7ce90e066e138fc6bf3cb5f6ae54e3742f34cdd1812c202d98da3b9e24c940d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909558, "uuid": "9bbb023f-2285-4fa4-b999-f9f99e26aa33", "value": "T1DD159D35DAD49AF5DCB62A3A0C4F7D905A20FE913E343C166DCC6C849E31682AD3958F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909558, "uuid": "0fe9a0c5-d570-433c-896f-79563d715c96", "value": "a06c5c2e0daa5e1be041ec367fa8affd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909558, "uuid": "cb18f09c-387a-4264-ae1e-547a126ebdef", "value": "12288:L7SPlQKaPIvX9zqhD6yneh8RQZW540cd3z+Hx8lO2fTVqyvLRxaFZoZ:L7glyIvX9zqB6VhoMjaHxA7VhLRYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909558, "uuid": "9c803b5c-9ec9-43e8-b823-23ac5daf5b94", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909558, "uuid": "575a2390-7b8e-4c3a-9934-153b67fa5b63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909558, "uuid": "2b0ce7a7-1639-4f1c-b78d-a1e3023a9806", "value": "Iomaxhrctxwofprickvoyatkswfgpenipp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f2c296-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (FlawedAmmyy)", "timestamp": 1632901545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901545, "uuid": "20b6234d-6d72-4343-9406-c27446ce8c5d", "comment": "Malware payload (FlawedAmmyy)", "value": "1dd91ad747f36f99e3ed931534815268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901545, "uuid": "eb832e81-647c-4b60-badb-84eaf818a302", "comment": "Malware payload (FlawedAmmyy)", "value": "dedb1eb8e4e7d6037502e490ba95fb0eed3cccd15535049049783f3915ecee49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901545, "uuid": "ec202f2b-b47d-467a-a743-d8958ea6cf3d", "comment": "Malware payload (FlawedAmmyy)", "value": "9ac4c73080e5090f05da7b78ea1957b6661757cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901545, "uuid": "b8dfc837-d3dc-4ff8-8f79-e76188c3c32a", "comment": "Malware payload (FlawedAmmyy)", "value": "bd232d4023c9c9292ffff166523bed5f84a6055fd8c4d7f548a04a246921a9d7e26cd0431295f928c511fae4ef7e20a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901545, "uuid": "37ebb696-16bf-4e21-9e57-b2fc03030d2a", "value": "T10E25C0267DC1807BD272067189FA67B2E9B5FE600E27890B5388AF2C5D76D01DB1277C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901545, "uuid": "49c6480c-3e5a-4382-b7ca-d1152ecc9a06", "value": "a058756785ba9de3e6bdd1f326bba0dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901545, "uuid": "7acf5fba-40e7-4a70-b164-326ed5fbcbbf", "value": "24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsx6:dJ5gEKNikf3hBfUiWx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901545, "uuid": "8a0b4c5f-52ed-4051-8ac8-c5bee7b04bda", "value": 963690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901545, "uuid": "ce1946d4-801c-4ad0-9c39-244ba242a2c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901545, "uuid": "c3ea6524-af18-46a9-a87b-2bc400b150e6", "value": "dedb1eb8e4e7d6037502e490ba95fb0eed3cccd15535049049783f3915ecee49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764134ed-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919673, "uuid": "d6eb8a38-aa3e-446b-85e3-94f485d69491", "comment": "Malware payload (AgentTesla)", "value": "84a9d7ae2301741abd00a57d41c75643", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919673, "uuid": "4a82991c-e056-4406-9092-d73cd8e97c8e", "comment": "Malware payload (AgentTesla)", "value": "df2bc7250fba8f6d5e61c183cb8d680b66713d9ba8b6228cdf93222fdf73f302", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919673, "uuid": "ea695d7f-7fa0-4831-9317-6e2a93d8c1f9", "comment": "Malware payload (AgentTesla)", "value": "356b297f6304af5a621313c847957544a637c78a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919673, "uuid": "fc42c4e3-00ea-4869-b9e4-e1d3e46ca16a", "comment": "Malware payload (AgentTesla)", "value": "fbd50516fcc7c361cbe11551d89a49e0613e591356809c5e42570971cf5332055fff152846151bb1481469db521d8c94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919673, "uuid": "d4704f71-9f37-4f74-86f2-bfd76e2a9dbb", "value": "T1C7154969B10CD28EFD05C7BC21297C8415B83CF9183CE91FADA6B4D234BBE6A51F1496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919673, "uuid": "644dfa16-7727-46dc-92f8-d0c6e5099407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919673, "uuid": "2eb5ba59-7ecb-47a6-ba13-feae3ac6fe30", "value": "24576:LD4VHfQe6ZyWshg+qbZxTZZWunAWvoJMmb64CiB2mm1eNhg6gt:ZIJpb6Za2mm1og6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919673, "uuid": "de8bd1a4-97dc-4ec3-b207-2545551e617e", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919673, "uuid": "76a33b6b-9e30-4e72-9ec1-80524c4f34fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919673, "uuid": "4ffba797-5bfb-46bd-9abd-9f3fef8b09ca", "value": "2ARyFl33ERVYSJa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae9defa-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632899924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899924, "uuid": "3aaac7d0-88a3-4cbe-a0b8-dbdb7886a781", "comment": "Malware payload (Dridex)", "value": "b51ba8cc0bc49c2b33cffc1d3bb8dca1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899924, "uuid": "a131455e-7a92-44e0-bc62-1300aa4cb507", "comment": "Malware payload (Dridex)", "value": "df6455d6b24ce0e4dfe334e1acfac232d0fbb6517d392ff435bd6caba87409ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899924, "uuid": "45e4ae19-4a57-467f-b9c5-8f68a90c944f", "comment": "Malware payload (Dridex)", "value": "48ca098059a1f535ba6b4af23f1d6218c74663cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899924, "uuid": "b8816a3f-b743-4dec-b451-9e0c68d6ea9b", "comment": "Malware payload (Dridex)", "value": "66e8db357afecc33efeb35b1ff9046d080c445ec742458cf6a795acb63d1c3ed4f720d2f74dd05ab952a0b91813ec635", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899924, "uuid": "7a9f227c-4984-4e8f-a934-fd2db3774920", "value": "T139F5E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899924, "uuid": "71eee0e7-98fc-4ebf-954a-74067d2ca173", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899924, "uuid": "1bbe8965-1549-4569-bbb7-4034ac6ae88a", "value": "12288:pVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:IfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899924, "uuid": "c356bf17-9331-4e41-9872-878f1e0f0111", "value": 3645440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899924, "uuid": "3ddbbfc4-4470-466a-a8c1-4d54f08cdd9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899924, "uuid": "c0cf88f7-cf08-4ca1-9936-d7a044a269bd", "value": "df6455d6b24ce0e4dfe334e1acfac232d0fbb6517d392ff435bd6caba87409ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b633851-2167-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632948887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948887, "uuid": "d2b979de-2fe7-483d-bb70-dfcc497d352c", "comment": "Malware payload", "value": "7b83b99dace5664b9ab5c0c3882be408", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948887, "uuid": "8224a8aa-836c-42f1-a191-b0165e192f54", "comment": "Malware payload", "value": "e005a59b0ab458c8a1ab6883e17504382bd72d2e9de8eb99c785de520c258c0c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948887, "uuid": "b370e8fe-6e40-41cf-b194-54f49c8f0f83", "comment": "Malware payload", "value": "4c4893beca92234c023ee2dfff759e155c643ed3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948887, "uuid": "1b391274-dd1e-41ff-89b9-d774945157d2", "comment": "Malware payload", "value": "6a3fe11950f2c3f477d30589fe8d17a8bd7a8433d5216eeea3e0e962b0917766a29f9e9bd852d98a378a7c6cc8d7756e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948887, "uuid": "e21da100-fa0e-4f3c-a024-3e0a6fd01ab5", "value": "T18534E15AF175C849EE56473B4CD70B9B2376DC238FAF0247B681B211ADB1DB81E0624B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948887, "uuid": "7ed6f093-29d9-4743-87fe-75f138918cfb", "value": "6144:iKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgD9fWvcZZdtLq1JOjbwvOMPDslAvS3+Hw7c:n9fVrLmUjbwvrDa33LvfH1WO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632948887, "uuid": "a046b7d1-9f6c-423c-93ad-c5352c442fcb", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632948887, "uuid": "0e67d27c-f4d9-451d-b454-d74252d764e6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948887, "uuid": "e105934d-0843-4df4-a2c1-1208fe8c07ba", "value": "SecuriteInfo.com.Exploit.Siggen3.20906.5188.743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957cee5f-210c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632909847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909847, "uuid": "7ef3c9f1-f992-4cb8-a5b3-e30dc6e4fc8b", "comment": "Malware payload (Mirai)", "value": "4c63fb657c6fb23b62b18d57397b9f66", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909847, "uuid": "1b1c2a75-f423-4af0-a246-e9933ed8524c", "comment": "Malware payload (Mirai)", "value": "e013ff27887e633c07cfca75a74d83e477e4229d65d96663ac6cc4350564ac32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909847, "uuid": "cdc87b62-ea6d-447c-8c19-27e8241c5f2a", "comment": "Malware payload (Mirai)", "value": "3f8efa684a2d84542558924f0e7908a98b74c117", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909847, "uuid": "078ff325-0c8c-40b0-9735-48d7c71ef413", "comment": "Malware payload (Mirai)", "value": "0c736628024a5e0c9402d79264abe6ac1a600977678399822f9d9bca713f71703cec589221bcbf29402f2ad42c1b1cc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909847, "uuid": "97d418dd-6244-49e6-929c-436080bf223b", "value": "T138831945F8818A15C5D813BABA2E118E331267E8E3DFB2239D111F6077CA82F0E77D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909847, "uuid": "f9e21de3-cf73-46ef-978e-68c9371a6c3b", "value": "1536:OtnATlnICsJG42JyK4EdMDaryEP2yjPHfaoiiqrKnbM7itNNDzYX:nVO2J/jeyr1iwNNDzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909847, "uuid": "c8f10fbc-90e8-4e68-a7ad-c0417065a8a7", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909847, "uuid": "3bf48f9c-ed38-4ecc-8fd4-4cc567039199", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909847, "uuid": "15070310-84e4-47f7-b33d-5f9c33ec053e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58426ccb-212f-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1632924776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924776, "uuid": "763a0731-05c3-4d4b-aa80-b8fd6c4d9132", "comment": "Malware payload (CoinMiner)", "value": "438215ec552fef4a43a10c331d658c04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924776, "uuid": "6fc9888d-bcf2-4f7f-a046-1e8c743c9df9", "comment": "Malware payload (CoinMiner)", "value": "e01749cfd587ae7029247ef900df2eb0e89e2fc594ca665d460a73bfa9564647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924776, "uuid": "bc319c64-5393-4400-9675-49ed22a0cd4d", "comment": "Malware payload (CoinMiner)", "value": "a4941168e1269993b195b84fa272870c58bd6c10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632924776, "uuid": "0ca81155-87c6-4f91-81f0-6e1b4de88b47", "comment": "Malware payload (CoinMiner)", "value": "37d79580691711c3a5963e9dd6fa8946e87b6ef6b37930195a64260230912be5bf476e60eb4d9a126e6986bef9089260", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924776, "uuid": "aad484da-0ff7-4bfe-8fb1-7168484670c1", "value": "T1A2D3BD0175D0C3F2C59615707876C2A466FEB82D1F62A60B3B6856EF9FBC2D24A33316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924776, "uuid": "a9e1c5f5-191b-48cd-a6b5-e4aefd89f104", "value": "2966ac92acef7bd43000e50be4b3a82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924776, "uuid": "9f6d6148-b64d-46a5-a839-c6bee08073b1", "value": "3072:NAtZ1A1rkry0hyv9qg5ziN5KrcPI1ZeWGhz0Tmx9z:NAtL6r59qWz7cPI18am3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632924776, "uuid": "fa0abbaa-2773-4419-a52d-22632848e7a2", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632924776, "uuid": "01ecccf1-84df-49e8-9edd-1d608a2f20d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632924776, "uuid": "2cb39d93-60a4-4f1e-8da3-ed5914a18643", "value": "438215ec552fef4a43a10c331d658c04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8491c335-2106-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1632907241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907241, "uuid": "6f601af2-71f7-4642-b031-3564720d9e57", "comment": "Malware payload (STRRAT)", "value": "be2e260ac2d0bec3052ccfbd60b963bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907241, "uuid": "18076fdf-7a58-4bc0-9dfc-5f01eab532f8", "comment": "Malware payload (STRRAT)", "value": "e04caf868a7983d92c052dcf3866778f796d597887948a5966256819bedb02b0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907241, "uuid": "9a54c714-28ee-4f15-bb8d-932c9dcaffc9", "comment": "Malware payload (STRRAT)", "value": "086420ebfe76e279bacecb6c15bb6ad81d028a4a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632907241, "uuid": "012fcb59-6d7b-4ec6-acad-e8780a3e140c", "comment": "Malware payload (STRRAT)", "value": "127707ce4dabf0330985fd12674e76ceda51dc16ccc21eb91aa3505cb071708e6d1bcf845183ad3fec9c59e643fb7b82", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907241, "uuid": "9659fcdd-da6e-475a-bc8b-acc63d7cc227", "value": "T12F042314BDAD98A3F81C7970BB0EBD44D6E24EF9C94B934267624068AF730B72D56221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907241, "uuid": "f60ad7a8-a5ca-403a-90d1-5554d60e541a", "value": "3072:t6wNXrYjpeIZ7yQ1vVkMt0Mz7g5Ma48/3xjYLpi+PxJCwtVdzcOs6xarqCYddj/l:dNXUjpey/o5MLEx4prbLVzcM4rqvHzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632907241, "uuid": "13037655-b755-416f-829a-1e529b3a6d0f", "value": 181714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632907241, "uuid": "a2c37522-2271-4823-8470-d772fa7aaf7e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632907241, "uuid": "3a7244b7-2a14-4b45-8876-777b272ddbea", "value": "Rechnung01.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edbb295-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902856, "uuid": "ff8364ab-9668-48ca-919b-e5e02647de18", "comment": "Malware payload", "value": "110bfa3c25b71ab144d4d64697a5af36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902856, "uuid": "a20b86df-6088-454b-af98-b9bdffc59acb", "comment": "Malware payload", "value": "e070b8189303bb8609b4aa2e244e0f37177cad6b1adf48fbb4cd4471edb7063e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902856, "uuid": "382efb59-5c3c-4eef-adfa-d635c447a9d2", "comment": "Malware payload", "value": "3dece4634148d211b9fa10dc7b0b3390935876bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902856, "uuid": "0b61861c-a457-4c10-89a1-a7cef54dd87c", "comment": "Malware payload", "value": "b00ef3b10f9635793da9a5ad5fbf977704d0054eaa8fc58470d910ab50e85a8117d71a55f93f9a373b8e80b69be93a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902856, "uuid": "63e55662-7453-4359-9ca9-eadfd961bbba", "value": "T11273CF11BF812E44E7F91B3316EC25D606AFBB8E9DB087CB686D89D84F37A1094D0758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902856, "uuid": "07c35793-686e-43b0-8ed6-6757e3486f4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902856, "uuid": "6f8f1d26-b155-4878-8f22-a7fd3983a80a", "value": "1536:phc58GXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt961vf9/ouB1l/:Lc58OSyRxvY3md+dWWZyGX9/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902856, "uuid": "41c3b735-46fa-4047-bd83-092620be3819", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902856, "uuid": "e5ced974-7e88-4ce9-a821-8ffcb5f10931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902856, "uuid": "62fe5b9b-96fa-400e-bd73-2db22e9178ed", "value": "e070b8189303bb8609b4aa2e244e0f37177cad6b1adf48fbb4cd4471edb7063e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249398cf-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632908798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908798, "uuid": "f0910c12-624d-46d6-b166-6ddb505a754c", "comment": "Malware payload (RemcosRAT)", "value": "dec89d084216d899e0a940c040e9da0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908798, "uuid": "bda28f0a-5154-45bf-9a37-8f1735eccaa3", "comment": "Malware payload (RemcosRAT)", "value": "e09089c81e67c38f93188d52d0fde98a587c59264cf7730a449886ad40eef52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908798, "uuid": "3486b522-b47a-49dc-abea-b74614979580", "comment": "Malware payload (RemcosRAT)", "value": "e1eae68d6c1b1bb0f9ba0afbe50aec9975031aa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908798, "uuid": "96a8b138-614f-42a4-ba3f-11d1fff8430b", "comment": "Malware payload (RemcosRAT)", "value": "8f81ffbd88ad836d995db81f8affcf460a5062b159f09390f3aec7b320605524ac44202e293480db7d924c12a588abf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908798, "uuid": "2887b1d3-6d08-4ede-99d0-7fc8c960e544", "value": "T16B6512456758D55BC1584678C8ABEF302330EEF89C13E61BB8A27E6BBA7B3C75C06015", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908798, "uuid": "28bdd138-9529-4674-9ef0-f80b1617c2aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908798, "uuid": "6839a8f7-dce0-4138-86e0-54fc702d5af3", "value": "24576:NDSPojudUrzGt4nVLCBkova22OY8buJao0a9RXj8:NDSZdUIXvakYRavST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908798, "uuid": "1be0fd08-bf55-4a62-8170-4f924b63fde2", "value": 1439199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908798, "uuid": "39579726-0a80-4632-9c10-a74e11790b2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908798, "uuid": "8c3dba3c-be31-447e-bb01-5530d01ef489", "value": "Agustos 2021 M\u00fctabakat Dosyan\u0131z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400e065f-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901114, "uuid": "0aa41543-726f-4a06-a8b4-ebe2fe328da2", "comment": "Malware payload (Dridex)", "value": "a033174cc300acb3893a757df34494ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901114, "uuid": "e9b0b253-dfc4-473a-92b7-51b371848a7c", "comment": "Malware payload (Dridex)", "value": "e0a9fb61e3280866dc36304c7228f6b4f2e96e651c740e2201f502d7f736bbb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901114, "uuid": "a64f4cd1-0436-4f33-af48-dbbc36a6114c", "comment": "Malware payload (Dridex)", "value": "b2a48c0e6ed2807a16281f1d477f1ff695e34e29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901114, "uuid": "92539f35-447d-439c-9a88-af5ec87f33e3", "comment": "Malware payload (Dridex)", "value": "c466595a99b0df08f0a6d3ed3d5764022106bda44e08e98992f7419c118548e548fea2f9c1e372ac8bee335dd52370fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901114, "uuid": "6af97642-ad61-468d-8e9d-4532f9b3b506", "value": "T16A95D010FE69EDE6C6B99F3E9408352317B93D74130DA18CC391604F5EF82546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901114, "uuid": "dd86b2b1-9ddb-495c-923c-98e8e25d6e55", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901114, "uuid": "dccd2fd0-12e0-4cb9-9ce0-2809f959d350", "value": "12288:uVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Gp:zfP7fWsK5z9A+WGAW+V5SB6Ct4bnbGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901114, "uuid": "43ad4701-4f30-4540-abda-3c767b382f49", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901114, "uuid": "57ce6467-570b-463b-9306-e9952e102c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901114, "uuid": "4b4bb8aa-db34-4162-aecb-3b6a65cac95c", "value": "e0a9fb61e3280866dc36304c7228f6b4f2e96e651c740e2201f502d7f736bbb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3f7dda-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632900409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900409, "uuid": "e17308b2-28b9-44dd-8761-bd1db30a23c5", "comment": "Malware payload (AgentTesla)", "value": "770bb8f7cce661d0d60db2085dd7c3c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900409, "uuid": "0e9749b8-fdbe-4720-92c3-6d78e0fe8ea2", "comment": "Malware payload (AgentTesla)", "value": "e0b34f771f50d5ae6571ad9470b7a712e6322359bc18bef14fbdb15a9ed043d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900409, "uuid": "5302d874-d59a-472b-adcc-bea1be96a815", "comment": "Malware payload (AgentTesla)", "value": "3e78467244f7e1780e7bcbf85f335356c4050233", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900409, "uuid": "09e8ae7f-1cee-4f54-a62a-5c48018ed5e6", "comment": "Malware payload (AgentTesla)", "value": "4640cff4180d8fa52fdf432848811b07a901f6ffc13a5845bc059e97ec446360c74ff3263b3c42127eeaa9d11660bff0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900409, "uuid": "e941c64c-7f29-4ab8-a275-16b559d295ef", "value": "T15927122E32D4EE53C1A946B26D73D17AE7B2484CC1E1423377906EBE2C545F6BA096C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900409, "uuid": "979dd850-ed81-44b3-ab0d-72ae21e25889", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900409, "uuid": "793a8e30-1aed-4c92-a31d-e8e5d1d18157", "value": "12288:ABggl6xVWvtl3ZFx05P6sVOJeJxyi1w8eSg9L:C88VlJ305PR9PSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900409, "uuid": "657b589a-7a93-469f-bd24-646985893e81", "value": 20971520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900409, "uuid": "2b7f268c-4baa-44c7-b8e8-b24d5be0fbc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900409, "uuid": "a198eb86-a3ce-4017-a8f4-d13827ee0c03", "value": "PO#1135 - \u88d5\u5049.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdb922b-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901375, "uuid": "4e2f935e-f5c3-4981-86cb-452d659c6eea", "comment": "Malware payload (Dridex)", "value": "14f9e921414f6dafef746f6d8d7dc0dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901375, "uuid": "ba71f550-b27a-40da-980f-ac9c208d6ad7", "comment": "Malware payload (Dridex)", "value": "e13259fd17113576da19679239a879397b8b79a1e95f44caccf111e79f70b5f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901375, "uuid": "e33258e2-61f5-470e-9fd5-29e8798a8f1c", "comment": "Malware payload (Dridex)", "value": "bd45a221ed38bc245732eb7995b0f0552d5c9a6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901375, "uuid": "bf3a0fdd-88a5-4ed3-bc60-9446b181e778", "comment": "Malware payload (Dridex)", "value": "eb504e3844afa250b2458a4d630db97c6592a49de23ee2d877c13e2d49b9251cb56274a0f945c47a2e7a8422e07eccf2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901375, "uuid": "7a35a9c4-b44f-4b32-87b3-23533397c707", "value": "T12775E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901375, "uuid": "66e42d07-2eea-43fb-ab7a-682a483b9c55", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901375, "uuid": "68e27a70-0857-4b17-9858-494057bdf2b8", "value": "12288:5VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:4fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901375, "uuid": "187e40b1-52e8-448a-9835-abbe322eacbe", "value": 1568768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901375, "uuid": "1121251e-4b0b-4e17-8033-9ebdd2297af8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901375, "uuid": "d42cf022-e355-4b1e-8f4b-97ad40aeb6d2", "value": "e13259fd17113576da19679239a879397b8b79a1e95f44caccf111e79f70b5f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dc2e92-20d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632884422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884422, "uuid": "4dcbec5c-5859-4c5b-9149-7935beb609e6", "comment": "Malware payload (Gafgyt)", "value": "589801b4aa65397e093882249887e3e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884422, "uuid": "63b58cf8-a14c-480a-a90b-24d7ca2f19f1", "comment": "Malware payload (Gafgyt)", "value": "e1f04356bdb78b69da0c9e19edbda83fc94cf8bb5929be0d1512ea3847479884", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884422, "uuid": "74de7f02-8ca0-4616-98a1-7354605dece0", "comment": "Malware payload (Gafgyt)", "value": "0d7335e26cdc4aeb220a135986ed8eb922fff25a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884422, "uuid": "6040f1ab-425c-444f-be48-8107bc21287b", "comment": "Malware payload (Gafgyt)", "value": "d7e7416f93b624e779ba8da6ada69dd0ba91ae85cca42c15bd7e14f7819d6d6abb98106d83eb3e47dacf62066a81014d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884422, "uuid": "27374a2d-6466-47cf-b425-8bdd0316e4dd", "value": "T183C34B4799626EBBC043BAB925B759304316A9171F7F1A8A742D6BF0038F4CE741FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884422, "uuid": "38af1f86-2086-43ca-991f-46c95d5fd046", "value": "3072:HKf6TAAc6XcHocFDVFuQgCzm+dczA0VcVgNO:HKf8AAoIsVFuYm+dczA0VcVgNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884422, "uuid": "47dd1455-acae-4e9a-9640-724ac225f41d", "value": 118540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884422, "uuid": "d9bd9b00-fb1f-4164-bc22-0abcd044dae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884422, "uuid": "6426433d-035b-47b8-9ef8-8f2570e8d55f", "value": "589801b4aa65397e093882249887e3e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e15572-20fa-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1632901900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901900, "uuid": "3fe15e68-1915-4068-81a6-37719329da2b", "comment": "Malware payload (njrat)", "value": "e8fb8e14c5e50dd51a7499b84e2c857a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901900, "uuid": "0cd43a1e-e7b5-40f4-92bc-e2481688d3aa", "comment": "Malware payload (njrat)", "value": "e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901900, "uuid": "e66caa91-26b1-4089-bb88-2380bb087fd8", "comment": "Malware payload (njrat)", "value": "bad853c5496bc28f492c01cdc6fff77efd72dc74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901900, "uuid": "0ce85bfa-1553-4a3b-8f18-b97fc25d183d", "comment": "Malware payload (njrat)", "value": "453a977a7ed71edeff08ba4e25611b1c318e20e844263e4b46adbe8fbeffd40bbbea494669490554a080bc524b5356f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901900, "uuid": "efccde53-d1bc-43dd-b838-3787e44ba204", "value": "T1CA74CF11BAC184B1D1721D3859F9A734A93CBC301F358ADF93E43A2D5E345C1AA3AB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901900, "uuid": "cd8757af-79e1-4275-8af4-304199ee16cc", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901900, "uuid": "af7d0251-8cf0-4f96-acfd-88e247c3f8da", "value": "6144:1Q+KaiKX2omqZEIvjzmW61pX+t4OHGbPEBOk/bhnAvx:pKry2/qZXzmVpX+t4OgMdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901900, "uuid": "71a413d0-b5b5-487b-a7b1-8b4f6a0e9293", "value": 349456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901900, "uuid": "0d9702c6-6d09-4e56-9ac3-35aa05e391dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901900, "uuid": "9f68365c-5a2c-4414-a8de-983ce63a13c3", "value": "e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b691a771-20d5-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1632886280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886280, "uuid": "cbc50768-42aa-4815-972d-64ef8e0ed807", "comment": "Malware payload (BitRAT)", "value": "e5cf31523f01f3791bf0d2dbf2a232c4", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886280, "uuid": "83f99555-5940-4453-a193-82a21255838b", "comment": "Malware payload (BitRAT)", "value": "e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886280, "uuid": "f7d4d7a5-9f05-4f9f-b1b6-d44a128747ce", "comment": "Malware payload (BitRAT)", "value": "d992d4c7ff035d4dc730620924625d58be4bd4a6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632886280, "uuid": "7f4dd9f2-ec1a-4ca9-b065-db1da75755f3", "comment": "Malware payload (BitRAT)", "value": "4671ae6f5349c3ac00d27f656bf53fe858cf654815867916023bd013e96ba2659ea51618e10fb1b95e15b4f1ce6b7e02", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886280, "uuid": "f4f09658-02f4-4a38-8588-13eb9182e617", "value": "T1B704AE00BD98D2B1C701017E6825CAECD52EB9ACFFE066772B6426DFEE783A37511251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886280, "uuid": "d346aa17-7ddc-44a2-831b-7f573fa22035", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886280, "uuid": "fc0f8fa0-9077-4048-87ef-21a4cdac1f93", "value": "3072:AjkQUZ8zPRPLEAjvbgO+kv03cFGf8BzrcPI1ZeVPr8EuSzQz:AjwibDgO+kvmcFo0cPI1KPtuSzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632886280, "uuid": "1fd87b7c-3451-47be-9aa5-d6ec5baddf25", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632886280, "uuid": "bd3c94bd-423a-4a2a-b95a-877418767309", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632886280, "uuid": "138db1f5-03c1-4651-a81f-4ab643eb504d", "value": "e5cf31523f01f3791bf0d2dbf2a232c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a19b0b5-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902848, "uuid": "8efc4208-16be-4ad9-806d-9e1d423fa334", "comment": "Malware payload", "value": "e80eac9cd1c6249f8c2692b15f7a1dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902848, "uuid": "59b92222-7bb7-4b4d-91e1-0a86bd34551c", "comment": "Malware payload", "value": "e32a3198aa771357b8c1920f5ee82f29f14d6237cefd6071f3bc2ac1d866ea90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902848, "uuid": "381bb9e7-9ba2-4887-afee-0880f34dff15", "comment": "Malware payload", "value": "633f995b26f3bb45f3c208072a490da6595423a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902848, "uuid": "db32a7b8-2032-47a8-a6f2-69f07d36ec21", "comment": "Malware payload", "value": "3367858955effbed466953bc6058b2118a6087d6d0fc30186bd23802c632ad5c20e2fdd936dbc9e9eda7a3f3bb659ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902848, "uuid": "67b41340-2ca9-4ad4-ab12-465ba12c7c00", "value": "T1CE73DF12BF811D08E7BA5B3766EC31C606BFBB89AC3197CB642E59C84F37A5095D0718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902848, "uuid": "878be36f-e4fa-4efb-be1d-702d93dc5d28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902848, "uuid": "73a5c24d-3d3d-4062-bda7-f64e58d10d5e", "value": "1536:8RWV5jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96179/Y1Sj:8RWV5jS/SyRxvhTzXPvCbW2UG79/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902848, "uuid": "83e3cb0a-3b62-4cbb-9089-20638649cf8f", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902848, "uuid": "5c550fde-e1a4-4a90-a4fe-9726d7c7a324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902848, "uuid": "40d3cff7-0b09-418a-905f-9d5f36c41c39", "value": "e32a3198aa771357b8c1920f5ee82f29f14d6237cefd6071f3bc2ac1d866ea90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3042e125-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1632908818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908818, "uuid": "18bb3b21-b434-4140-ae06-5d0428e90034", "comment": "Malware payload (STRRAT)", "value": "da32f3d108deb072f3d5ab2c6f89ad74", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908818, "uuid": "f1bca8d2-0bcd-413a-9106-e4f18689e794", "comment": "Malware payload (STRRAT)", "value": "e3e190eebf45fad540c7b0c60ded96512988423a535239c1520360862f1eabea", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908818, "uuid": "640bfc25-77bf-42dd-bdbe-01f14953e22c", "comment": "Malware payload (STRRAT)", "value": "7f5371ba442190b1f47815f73a1dbb90009b738d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908818, "uuid": "6cf5798f-ae57-4761-9733-8b4e28c256f0", "comment": "Malware payload (STRRAT)", "value": "2bd383e08b521ef9c1749b4569bfbe77815e6bc5af8d63f3502d8f83bd8eb7905298b8295e19e1b6dfced69cea1cd897", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908818, "uuid": "e65f8fae-5b3c-478c-9b42-af1620e78fc2", "value": "T131C3127178136BA6C42935B8234EDE2615230A30CD551B037960CDFEEF7921EAB478AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908818, "uuid": "bf458302-bc27-4142-8968-7e72e7bd4063", "value": "3072:Aspva65S7Oyauywl0EwQ96F0/l12E1hnvv3:RvDEhauy3E960/dhv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908818, "uuid": "0667476f-8cf0-48ca-9a48-9009a951b06b", "value": 122550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908818, "uuid": "0e7975d4-721f-4470-bbac-909cafebc8d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908818, "uuid": "dbdce1ef-ecb5-4c5f-af01-d379c4497dd0", "value": "VmZTcqSQEiInvb.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac07f907-214d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632937802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937802, "uuid": "ff4a85dd-9cf0-4810-a5d6-3497f4e75eea", "comment": "Malware payload (ArkeiStealer)", "value": "e20545381ad1328a8f21eca64301dc99", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937802, "uuid": "1cd05557-6e3a-4c81-a217-b1515dbe6842", "comment": "Malware payload (ArkeiStealer)", "value": "e4351163d175cac08ac38dde15c61b2bf6d088bdf93a7755440f5271f6e01a01", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937802, "uuid": "802007d1-6690-41ea-99b2-15ac71d60946", "comment": "Malware payload (ArkeiStealer)", "value": "d28322e9b93b263372c3a46ab84f44a0a5a12c84", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632937802, "uuid": "06946c5c-83ff-4549-b05b-ca77c2372e03", "comment": "Malware payload (ArkeiStealer)", "value": "51c892e5d6c0e887097609ae507ba9aaa1a89331a629a23de60b38ca26e677197160330e9fd38336615d73616200c522", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937802, "uuid": "98d456b2-e56e-49f6-a601-419b5757d170", "value": "T1E2E3CF0079E9D3F1C4D20674B8ACFB98A93E787D5FA085473B1406EF9EBD1E04626366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937802, "uuid": "a0106616-b3aa-4d8c-a77d-1b6def767c4f", "value": "2966ac92acef7bd43000e50be4b3a82c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937802, "uuid": "ab5fef0b-094c-437e-9a00-b5a0da7932e7", "value": "3072:56V+NlV96P3NXwvIC0t78b5II62o5krcPI1ZeaSFKmmn/a9F9z:5U+3rA3NgvIC8Ybt5xcPI1dSFLmn/Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632937802, "uuid": "7d67712f-c096-4f28-addb-3e47159b6ee9", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632937802, "uuid": "f86b478c-0605-42fe-96f5-48ce5ee399ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632937802, "uuid": "d1b7b60d-f3a2-4f46-8a4c-948e42eb195a", "value": "e20545381ad1328a8f21eca64301dc99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5b6867-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632903094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903094, "uuid": "644b8b0f-3527-469a-adcd-25e431601220", "comment": "Malware payload", "value": "8d9703579c1302601b62ca8321803050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903094, "uuid": "9fcd578b-b610-4f52-8bc3-25bcad92a4b1", "comment": "Malware payload", "value": "e43fc4f71ac263d5d5d2add07810c592bea8d9f4608b7292c70d4eb7418eb238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903094, "uuid": "b98ffb2c-444c-4af3-b44b-a4f1d03dbcde", "comment": "Malware payload", "value": "4dbd77e24813f9f4c4be9c4fad2f3d423d33d867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903094, "uuid": "be9fbef0-d64d-4689-b7f5-9144e0bb4c93", "comment": "Malware payload", "value": "3caf029febfeeebaee91ec87dc9bc599b950351a115aa924ce084f4031bb74a610411ca11935c8c0f70ffb1a32d4771d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903094, "uuid": "021529cf-6a2c-4ae9-8180-2ccd93ef4ad9", "value": "T178031808B7E2022AE6FE4B7149F75681433DA8435D33EA8E5DE4409D1567FF08660BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903094, "uuid": "5ece7b72-8b42-4db2-bd0f-de4ab8a3a1c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903094, "uuid": "6f08b11f-6c92-4938-a426-0edc2a51d864", "value": "768:+hUg0FmmBmziRi6hhsj/O2c2iI7HhwqsuJp5snFn7iFJzu16rwVqT/Ss:o0FmmBmzEiwhA/nLitmp5snFn7iFA6rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903094, "uuid": "bbe4f8c7-8954-40be-bfe5-c5cdce2a9e96", "value": 40920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903094, "uuid": "72e44c62-5547-4961-af24-23abbfffb5e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903094, "uuid": "9490e35e-7a99-4d23-a7e1-6d9dabaf4978", "value": "e43fc4f71ac263d5d5d2add07810c592bea8d9f4608b7292c70d4eb7418eb238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530d1cc6-20b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632873658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873658, "uuid": "67f355f6-c28a-4116-adaf-97414580a623", "comment": "Malware payload (Gafgyt)", "value": "17a9b737d2db90f11a9db21b68bcd960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873658, "uuid": "03935028-a9c1-42a5-8623-59450dc386ec", "comment": "Malware payload (Gafgyt)", "value": "e4abe4f49b3ce460510f29dd43b35fc7748eda32512497026eca5ade30cd4523", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873658, "uuid": "acae5223-3d28-4623-8f55-e70b41c938d4", "comment": "Malware payload (Gafgyt)", "value": "7cacb1782aefef2035286cf6a09405df2c9d695c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873658, "uuid": "2cf8f4ad-0d8c-4719-85eb-cfdc00188e54", "comment": "Malware payload (Gafgyt)", "value": "557a522558aaab604adf8b5199e786d2e649983afe539a2eba5c8410608ecdce85a357bc583603afa83f46f302644b65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873658, "uuid": "30c6155f-9176-41fb-af8a-fdd8228639f4", "value": "T18BC33B06F5414B53C1C3177AB79F521977232BB897CB33229A24BFB42BC179A0E3A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873658, "uuid": "37c4446c-1c87-4a3d-9326-5afe59956d73", "value": "3072:Yd5adFfNQamBJl1OS5hudKRvF2/bBbmOQUJ1UXpTn:E5adFf4OS5hudK9FabBbmOQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632873658, "uuid": "a1b8d4cc-e1a2-4a9b-a1be-25e2b80c17a9", "value": 118812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632873658, "uuid": "9258ad78-5427-456b-8581-9f270d33171a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873658, "uuid": "27fd13dc-0c8c-4b89-b94b-27c4073e8672", "value": "17a9b737d2db90f11a9db21b68bcd960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe310005-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1632899285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899285, "uuid": "f66b0fdc-caa5-428c-8c3f-2df4e8db31ff", "comment": "Malware payload (XpertRAT)", "value": "452ea764a4f629c9c4d6880aa215928a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899285, "uuid": "b76cf189-dc59-48b1-a6e6-0b1f3fff3647", "comment": "Malware payload (XpertRAT)", "value": "e4b8184869d65a34fb9e0fb43d8b6c252cb153f7139485e3fde6d02cd6898242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899285, "uuid": "0707acd4-4f9d-450d-8262-47a627af7961", "comment": "Malware payload (XpertRAT)", "value": "9b69fcd3856d302da2506e84f220b26dd926e061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899285, "uuid": "dd4a44a2-7461-4745-888b-288954bc2e1a", "comment": "Malware payload (XpertRAT)", "value": "e735f274f19a9a19be1fa14c104dab5f9728d9ca263c3ce56990340a6a6e536cc43e9b73cfb98e5c3eb472cc81ac24de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899285, "uuid": "85b2cc2c-e881-472e-b3f6-00206b3d0211", "value": "T12D94D13752C2BD97CBF60838E57519804C9A5AB3439082D4BAC9DB9E509B710EFF89F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899285, "uuid": "9d028c64-c5a4-414d-85c7-d493507eea9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899285, "uuid": "7e46a5ad-412c-4992-ac6b-9475ad1a73e2", "value": "12288:/pz3X0sr9b0i55JKbDNSSkauKkEMfhhYYNZuCCCyBFu:/RSnuKkEMfnN8CC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899285, "uuid": "2e2ea871-ed99-42af-80df-18444760bf01", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899285, "uuid": "79865ca0-9131-4e5d-a78c-6c12af9ce8bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899285, "uuid": "de2984cc-3b85-4107-ad37-742e9f4a203e", "value": "452ea764a4f629c9c4d6880aa215928a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de22bf9-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900305, "uuid": "34afc5ad-1891-41ba-8cb0-c8864e2332f4", "comment": "Malware payload (Dridex)", "value": "ff1c3955d8f2e55b71dd5a83660a4d22", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900305, "uuid": "5d592e42-66de-4fbd-a319-446e38a39167", "comment": "Malware payload (Dridex)", "value": "e5156a1751db00d147267c73eb9f4cc6eba956c3d3145eee8b2fc1adce9e5473", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900305, "uuid": "274b1f8d-ac6a-4cb7-a302-cc36f09b10da", "comment": "Malware payload (Dridex)", "value": "900915a04d501b99f0ba2f1f95f6787646b3fd0a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900305, "uuid": "d0ad3588-de8c-455f-b7ae-8464c58d4fa4", "comment": "Malware payload (Dridex)", "value": "6d4797a4e049d9739eae192d25a72f7053bb14d6cf76e9eb6b3605a01b1bcc19110b720f02d76cfa204f7d33731aeb32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900305, "uuid": "825d602b-8e63-414e-b790-390bfa66ec98", "value": "T149B5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900305, "uuid": "227908b1-0ed5-4f2c-a4c3-50c0a0d8d845", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900305, "uuid": "63888fe2-d144-4b92-8df5-ae00c146e58a", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900305, "uuid": "2feb734f-1f93-4992-b6bd-3e404b1953a2", "value": 2437120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900305, "uuid": "67f29231-ffae-4200-998d-20bb5839d09e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900305, "uuid": "f4fe94b4-1406-4d0e-aae9-645e372a4c69", "value": "e5156a1751db00d147267c73eb9f4cc6eba956c3d3145eee8b2fc1adce9e5473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126b7f24-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1632901466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901466, "uuid": "6da0f153-780d-4a4e-8025-eb6598f4e11a", "comment": "Malware payload (TrickBot)", "value": "c7ff57ab5dcfe3c86f16a8d4188e7795", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901466, "uuid": "166d90aa-132d-404b-a3d4-d40517594a4d", "comment": "Malware payload (TrickBot)", "value": "e5189997d295c9353162b5eebf001413df093a774cc7edabd67e9f23daa3a112", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901466, "uuid": "ad9608f9-fbf6-42b9-b3af-ad6010c5fd9f", "comment": "Malware payload (TrickBot)", "value": "23748f0195df926931e1c1fc2601f2c336d9feb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901466, "uuid": "d0d69c16-7d56-4e99-a203-8af95b9b0f79", "comment": "Malware payload (TrickBot)", "value": "997db3b9313c275a3b3a5b41e4ec6a45e49762929add538f4ef9839ce21652d53ff27fd97afada83c6a72f256e44568d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901466, "uuid": "a01add6d-1efc-43a8-8fa1-cb153fb3d748", "value": "T127B4DF3534E188B3D16319318DFD17ED6BF8BC520BB2668F8F902F1D383D196A529266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901466, "uuid": "f05fddc7-e6f2-4357-9098-c7348cc9c672", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901466, "uuid": "adc6c2ef-1a9d-4d27-8222-df756099cf60", "value": "12288:nbVMh0tRyr3WcS72mwrbMyE4srSxFXYBXBFx06pqAeq:JMh0tRypHMyEClYSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901466, "uuid": "5d7be9b6-56a1-4ac8-a4df-ae19a57adae0", "value": 532539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901466, "uuid": "64dad9f9-e91b-4ca2-a57a-30188bb57793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901466, "uuid": "6e1054b1-f684-4630-877a-dcac69f9d175", "value": "c7ff57ab5dcfe3c86f16a8d4188e7795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa558699-213c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632930632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930632, "uuid": "b9229192-69bf-43c5-83a6-558c2a106d24", "comment": "Malware payload (Dridex)", "value": "b42f681931852a788ed814dcf741df48", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930632, "uuid": "617ac4e3-1e0e-4b86-8c94-6b2c817232ed", "comment": "Malware payload (Dridex)", "value": "e5375041372e55ddeb2754d91d8c7341311b3417ddbf34e546c848641ee02c76", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930632, "uuid": "bba5bf3c-523d-40fd-8637-5430abd47e1e", "comment": "Malware payload (Dridex)", "value": "e3734c405617be803bafadaab9dfe6d3822c694a", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632930632, "uuid": "226bfcff-5933-4c11-8155-3fd445de5182", "comment": "Malware payload (Dridex)", "value": "8e955f435c83fc5e4c945990d58dfdb4dca6cfa63a64788372ce66c1d086e0ae3b9e49d165453b0bde84f98899ae9a0c", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930632, "uuid": "d529e010-e01b-4997-9518-3736736a88fa", "value": "T1AE14D0A1DAAB2076C85B8B7A40D5363F3105E949CE36CBF3D6EEE2E4C81505254F1E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930632, "uuid": "d327b985-9c77-48c3-84c7-270bd61fb6f4", "value": "ff376be1194438019505c3fb43da1669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930632, "uuid": "66e6122f-af1c-4d45-b0ed-b61d46d642fa", "value": "3072:eEZPUwrbUDIbURf5I+sGkCV+VRms7OWnv4XRmcCV9qZl:tZP9b4IbUBK+yCV+VRms7rv4Xgck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632930632, "uuid": "447026d2-2c7d-4ef9-9d61-cb95e8460d7f", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632930632, "uuid": "8f3bd391-99f6-48b0-aef8-2348aa55ab25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632930632, "uuid": "d41970d6-1f34-4cdb-af21-5ea6d12e9790", "value": "8_wpfgfx_v0400.dll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52580ce5-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632899426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899426, "uuid": "92af60e9-60bb-463e-9b28-7a8900a3414b", "comment": "Malware payload (Formbook)", "value": "b539f8221222c71d72dbbd06c23988d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899426, "uuid": "063497a9-7d9b-4235-ab24-a975875047e7", "comment": "Malware payload (Formbook)", "value": "e55a6e9d04d90fe3e41ce6b936bc7642dee3e7a804abfc7527ff74ee3062a1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899426, "uuid": "e886f3ed-76dd-4a28-89e2-67f41607a34e", "comment": "Malware payload (Formbook)", "value": "4140f8ac5737ad3403ea6bb9691321af777a0da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899426, "uuid": "751eb893-8c8b-40a6-90fd-e72700c624b8", "comment": "Malware payload (Formbook)", "value": "96296bd0c911b84e353205f4e3ab6cd69d8a897fbd9f328d209cb6543739ec81704c17ae5e3ae0d5a90f15992df7972b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899426, "uuid": "997aa5f6-db6e-4872-93de-a2c6bdeae022", "value": "T131158D1AB60CE65AFD1433F02524BCC415B81C981C6CBA13B97672EAB4B9E27DDF405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899426, "uuid": "d50eb7c0-ec29-4e47-ba59-921480df1a35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899426, "uuid": "f006bfd2-225e-43b3-afea-ef36b770a239", "value": "24576:/D4VHfQe6ZyWshg+qbZxTZZWunAWv93M38FT32AxHERf0zCh:1h48FCAgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899426, "uuid": "8aab9fbe-41a1-4564-bb4f-3dfbce273d36", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899426, "uuid": "5b8d3f68-0417-428f-a174-74022e548aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899426, "uuid": "d4b68a32-51af-45a1-a451-ebafb0c7ac37", "value": "b539f8221222c71d72dbbd06c23988d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddb837e-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901566, "uuid": "2e24c31c-8074-42e6-8e54-99665337b9d7", "comment": "Malware payload (Dridex)", "value": "a83b299fb0cb982d6ac9bed11a2ef08d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901566, "uuid": "dc13b7a2-bb0f-4fd0-a375-9deb1f8b8d0b", "comment": "Malware payload (Dridex)", "value": "e5b2e61781be26841034602297e2b8923e4ff8db9dbe492c7e331b64cd7db6a4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901566, "uuid": "aafdbf65-e255-46d4-8883-ada7bdf95c4b", "comment": "Malware payload (Dridex)", "value": "3bc44a755eb11b4627ab685d589f29536637f106", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901566, "uuid": "a0c5996f-1a1f-4438-9f1e-5e4134ab9543", "comment": "Malware payload (Dridex)", "value": "d54775b4c1c60efacc7df2e190f16a5d2c42078e1aa4f2358976e3bc90d8fe76369a55dee482f72bace7beb0c176301e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901566, "uuid": "79c64a8e-5288-443c-bb8a-af285e045c51", "value": "T14015E094B677A1CAC4A76CF6EDF86D705A122CC3623046B1CE02D1835B751E4CEF6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901566, "uuid": "09f22edc-ab1d-4b8b-8871-c2af15f83e32", "value": "c6b4c2eec8a93016c63563421e15f011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901566, "uuid": "7a9848ac-3aab-45a6-b678-721f3ae8aec0", "value": "12288:ZdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:3MIJxSDX3bqjhcfHk7MzH6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901566, "uuid": "95177431-e9b4-4613-bbe6-1dc31be571da", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901566, "uuid": "a4147fe6-4646-4d5d-8b23-2b9db661c230", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901566, "uuid": "3b55a4d5-d752-4572-88e3-73ffc3c5ba0c", "value": "e5b2e61781be26841034602297e2b8923e4ff8db9dbe492c7e331b64cd7db6a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6e1f13-2130-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632925320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925320, "uuid": "74ae0583-a21a-4a47-8047-716acb137ade", "comment": "Malware payload (RedLineStealer)", "value": "7e27bd30e64157535afe9910078ec791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925320, "uuid": "9600273d-5626-4aef-8f88-c5eb44ce2108", "comment": "Malware payload (RedLineStealer)", "value": "e5e0601b8269cf5ffd12af1b005d913fd5d70235841daf3017a9cbb5da483dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925320, "uuid": "df42f86f-bcc1-42b6-8098-761d26f11c94", "comment": "Malware payload (RedLineStealer)", "value": "b5c9992735096b687c40fb846cf676d0ea36b537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925320, "uuid": "17ed760f-f624-4cce-be0f-e625d4ac2a3e", "comment": "Malware payload (RedLineStealer)", "value": "6a75772002b70bc060d5e817141312b214b6cca31fada543f7950a1c261148f25c932a457301bc243b8b90caef1a9caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632925320, "uuid": "9e7e14bd-8221-47bc-94ab-414eff9bf186", "value": "T15AE21712334DAB73C2AE173D4627884043F992172323D75EBFC891E95AE67990F41AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632925320, "uuid": "17228116-e8a7-49bc-9b16-8a2736c1a36a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632925320, "uuid": "0dc80af7-c69b-4fcf-9f51-91bdc7cae907", "value": "384:tqAAOzQB7QPYVSqfN/Mvc6oWHXZmcy0CfUOuUN0glJnJs4NOdpeIf8ZesDpbDMh:tqlkQB7QPiSKM0y9hON9D4qIfGesVDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632925320, "uuid": "5a87e876-3889-463d-900b-5154488e6b62", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632925320, "uuid": "896b255e-394b-40ea-995e-39fc8527f49d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632925320, "uuid": "199f90de-1d8c-4249-b334-7fdf9ac06fad", "value": "7e27bd30e64157535afe9910078ec791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943790fb-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632898248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898248, "uuid": "c0bfae6e-45ee-41c6-af19-cbb414348678", "comment": "Malware payload (AgentTesla)", "value": "b460d3fa3a64c1893b8dd17c50a190d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898248, "uuid": "d55c7a56-15ca-4f3e-8194-4bde90a42284", "comment": "Malware payload (AgentTesla)", "value": "e62dd79733d9350e653c91688e1f4148865e3d382d249d139aa3371bbe152dc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898248, "uuid": "0c2a4304-1980-43fe-8300-7df73f465543", "comment": "Malware payload (AgentTesla)", "value": "2c1cefff91b8e5e2372dff3717c155e096414b0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898248, "uuid": "72cba602-5a3f-40ec-82b1-454ab4c17e3f", "comment": "Malware payload (AgentTesla)", "value": "544640c880d5be9ac8ef1fb3a3be6c783bb235f8367cd1401a7b07274960ce288a783b26541ca79d4f5f95c3c691d4cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898248, "uuid": "98012301-80c1-4a15-adc1-00a99ac71c15", "value": "T104158D1AB60CEA5AFD1433F02524BCC411F81C981C6CBA17B97672E6B4B9E27DCB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898248, "uuid": "bbaf92bb-6094-4433-846c-d7d62bfb7156", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898248, "uuid": "a45741e3-a813-4d58-95a6-907ca589638e", "value": "24576:3D4VHfQe6ZyWshg+qbZxTZZWunAWv53M32b5vn4PvP:d942VmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898248, "uuid": "f0e8755b-182c-45f3-89b3-4328e46e19b1", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898248, "uuid": "4031f619-1e7e-45cb-9520-0caa4fd75b1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898248, "uuid": "b94636a6-899c-4dd9-b1e8-b8f4bba86405", "value": "DHL UPDATE FORM_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5e7b32-2111-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1632912137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632912137, "uuid": "f1f0be96-4690-4b8b-8ed4-2b2c00dd2273", "comment": "Malware payload (STRRAT)", "value": "eb5db8af69661cc81ba371cc96419f84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632912137, "uuid": "a2496a85-72b7-4c9e-ab4f-30c0616ab612", "comment": "Malware payload (STRRAT)", "value": "e69b9cff44ad1e37d522510ff33b3db67eeb6bd3b30f0c6d42b8b4764ed2bc42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632912137, "uuid": "e96a5b5e-c3fd-4259-a21d-b74c3a6bab22", "comment": "Malware payload (STRRAT)", "value": "03520b9f08ccd896b77ced8933224b75701b982c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632912137, "uuid": "2bb7d604-34b0-4bef-b267-325d260106ce", "comment": "Malware payload (STRRAT)", "value": "f96cfb55fbc0b2a825baeb49c6849f1a253aaebc792bbfc93c6c3c3d41a0732580e957c11cf3d7ee17b2daa0d5abc8ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632912137, "uuid": "ce2e9aaa-faf1-4f04-9019-affe67be1bf8", "value": "T1DF04BED1C6C0678E76C8EE0C9C39C121D2F3E5EFA4469789BBAE7A357B30C045764626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632912137, "uuid": "79ff6bf6-6682-4bc7-968b-ecec5355656f", "value": "3072:6D9GtZoykB1NrgSf5LCvSc83Xh1PsFXUIO75vew4TldNEePVWtG0K/lRsRraJYRM:49MODH/ceXTPhN0rNVTcIooYoTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632912137, "uuid": "90bcec3c-b6c6-4d7a-a532-eb6a6d3ef331", "value": 188073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632912137, "uuid": "a05ca264-1e11-4937-b9d6-1bde7c88bfb9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632912137, "uuid": "00f1c364-3ad4-43b0-90ea-2c372c69c60e", "value": "Tax Returns of R28,765.50.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50766e5a-20f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632898994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898994, "uuid": "8667baa4-23a8-4e74-b661-adf994dc967d", "comment": "Malware payload (RedLineStealer)", "value": "22acb7148c297afbde83e676543c6809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898994, "uuid": "2743226d-d6ab-4253-91b6-b423b1772b15", "comment": "Malware payload (RedLineStealer)", "value": "e736227edfb8ba484bb37197482804450aa64c0ecd47d36e1e5db24cc3f5ee70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898994, "uuid": "51906d27-4c89-4175-91a3-70a351ab633b", "comment": "Malware payload (RedLineStealer)", "value": "828675832660cfdf1b8a47da2564d3279f30c862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898994, "uuid": "ee49477a-d1ca-4000-9b34-f913447070e8", "comment": "Malware payload (RedLineStealer)", "value": "8e2e8d8133dd22d629e7dc70962389d64b7b8f5c90aa7b4c192253006e29bb514a9ae050328a93aaae3c7fde9b2ec540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898994, "uuid": "e3adb666-f29d-4356-acdf-c150dc54da61", "value": "T1F7C5230527E9E612E9F34B3B2DB28A941BB7FD361C72C66EB606B14D4571C00EE3A351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898994, "uuid": "199962a2-7e19-4d3c-b7ce-935121eb912e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898994, "uuid": "0ced5251-f67b-428d-8fae-01e9013c91f8", "value": "49152:IrAGjdwX8heaXwPp5Sn08HO8j76devXl6GDmVdpamh:ogOwPzSnrX6d0XlBmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898994, "uuid": "873f4fb8-9586-4f3b-a580-ec105968225a", "value": 2504704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898994, "uuid": "ba380ed7-d38f-491f-b3cb-5a875b53fa54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898994, "uuid": "1700f123-01ee-45fa-876c-85c8bbf5b945", "value": "22acb7148c297afbde83e676543c6809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c5a4fe-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901090, "uuid": "ac410e6a-9dd5-4611-aa7e-9871f80cd3eb", "comment": "Malware payload (Dridex)", "value": "fe3bca3d5f1acd244cf8b942c99b9471", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901090, "uuid": "aa9324d9-5535-4b7c-8bd1-a84c26b31135", "comment": "Malware payload (Dridex)", "value": "e7455dd312ece91519ca3ad74ffac3e35872bacd181f6125c31cf940f2dee501", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901090, "uuid": "dab51b57-7315-4f51-bcaf-b30ca54f1163", "comment": "Malware payload (Dridex)", "value": "cc619882c853a0a56619c80d8742f67ec6868e4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901090, "uuid": "5db8e5a8-a079-436d-af64-4b12014196f6", "comment": "Malware payload (Dridex)", "value": "e50783584679f436807d2a8b859a9b7ae7751c3f18c8c8c2a6fb359acdb0eb19a990eddd86c9ed8964806edc6bb74ed3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901090, "uuid": "0e70be35-67d5-4668-93b9-0e1734efa84a", "value": "T1E295E020EE69E1E6C6B89F3E9448352317B93D75110D608CC396608F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901090, "uuid": "92dcd2ff-6de4-4e00-9dfb-c9591838e35f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901090, "uuid": "40e58274-097a-44f8-96c0-6b45b79e3ac5", "value": "12288:pVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:IfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901090, "uuid": "02d41b81-0d8a-43b4-a78a-61323f6a8330", "value": 1892352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901090, "uuid": "6bad2ba1-8245-4959-aa36-0e93fe6ca6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901090, "uuid": "bc903288-5f1e-4e0f-9d7f-097a05f04136", "value": "e7455dd312ece91519ca3ad74ffac3e35872bacd181f6125c31cf940f2dee501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0039899-216e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632952036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952036, "uuid": "48217dd4-b3ed-4df6-9a23-0c3c13f9bee0", "comment": "Malware payload", "value": "e9dc758879370cab33193b28b2374576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952036, "uuid": "e7442d71-0da4-4011-aaea-e140858e3456", "comment": "Malware payload", "value": "e78eba17500f5f4ab71cd3d7ce71728fce3269b1cba03c28c6580ac6f8f1f66d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952036, "uuid": "d63d83d9-3f69-40bc-a406-caebf6dfe13e", "comment": "Malware payload", "value": "2f17dd091cecf1e1a449ad830721a81b87e35933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632952036, "uuid": "0853eb1b-44d3-42ee-947a-7d7eea4b19c9", "comment": "Malware payload", "value": "09314e82be9aad71100faf0a2d6294859bf2848c7216956eccaaf4df04470d6d4d2c993a90b13e35a9ee8925a9f76528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952036, "uuid": "be94716c-74be-4c51-9b9f-951a57d3c92e", "value": "T194A2D0C8B601EE65F21044B36D5C95EC4DABF7990BEB34608CE5BD4DC34A496188F387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952036, "uuid": "b2f5974e-2963-477a-bae8-78cc2438fdce", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNBrHKuxt:pwkyTc9pHiGJ7bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632952036, "uuid": "9d3c83fe-d7f1-4d85-8e53-0cbd1a197ca8", "value": 21420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632952036, "uuid": "d7a0b43a-3925-49c9-a12a-d9f75efcbb93", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632952036, "uuid": "a8427986-52be-41cc-bcb0-16c4e0538af3", "value": "SecuriteInfo.com.Linux.Siggen.4218.30386.17368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fc71d8-20f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632899330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899330, "uuid": "3111fe06-ce8e-4153-bdb6-e2425db6eb98", "comment": "Malware payload (Formbook)", "value": "e228a9a207ec66fb124662f5e54400e7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899330, "uuid": "a49de235-eaa7-4f9f-9393-48a1f99f936d", "comment": "Malware payload (Formbook)", "value": "e7ffe2f6ef080f4db1e604709294a85c4181395897e493ddfe898e810ea3d253", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899330, "uuid": "14da7b0a-b3b8-477a-a198-45b3c5a4273a", "comment": "Malware payload (Formbook)", "value": "4ea40cbeedc4ec6cdf1735e2a5cce93cb8defd86", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899330, "uuid": "1f6caf01-c08c-49c4-a3a0-5778f5822de5", "comment": "Malware payload (Formbook)", "value": "b539de474de07d01135f776c2ba46e528e74ac914ff15814e3b5154d7433099e14fe8ab4cc73337c7d37480272af7f0f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899330, "uuid": "3a0f68b4-fd1d-4d4f-b56e-38d0b34f707f", "value": "T15B2533EA4DAD8738FB964437ACCCE49823B1EE0078375214B9A76378910EDA53D5C36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899330, "uuid": "8d9ec8ce-fcdf-4735-9237-df19669c62e1", "value": "24576:OyQUFMVDKXbFDUEynuO7ARXtQF8ThSFNhQj3JFE:OQLmjnh76X7ThWAjZFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899330, "uuid": "647e54ea-9123-4e3c-a50e-7aacec1fefb9", "value": 963222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899330, "uuid": "17416d8f-d2d4-4a58-9c04-bbb89b5134b5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899330, "uuid": "52314097-7db7-43bd-a8f2-740efbdab03d", "value": "RFQ 1SCP2020.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc345f1-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632898397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898397, "uuid": "683d2301-1a53-40f5-856d-0c3fe3cfbaef", "comment": "Malware payload (AveMariaRAT)", "value": "7e40579e49a421d2142eb9c4cf109b6e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898397, "uuid": "62655372-4776-40fa-9788-6275c0293804", "comment": "Malware payload (AveMariaRAT)", "value": "e8054522244cf487884808e2460096ae6b2dc6054cc89988dd6d2d93a98e6986", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898397, "uuid": "3eb06aef-a42e-4877-9493-81d633fd73bc", "comment": "Malware payload (AveMariaRAT)", "value": "da677bb85e04044ce33ac10fb0f963b8ca4ad8b8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898397, "uuid": "07364870-b87b-4aab-8169-9a567a7887d1", "comment": "Malware payload (AveMariaRAT)", "value": "30789286d7afa9578b2f9fdbca781de396a1e0c18ae6be0aa4fa24860775e981fb710bc17e79a9145bbcb0c1f5d6182b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898397, "uuid": "ea851d9f-935a-4315-b88c-3c24234a8916", "value": "T1D9948D315203FDD7DF2E0D28D01438561EAF1E674310BFD8BB8E259EA4D6518DAA8BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898397, "uuid": "32400bc7-5ae9-4b7d-8f53-9c4732ea81ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898397, "uuid": "824f2bf7-0a5f-4904-ad3d-f0c64a9f138d", "value": "12288:i562hXtvE7f41vgGWcLXHdrC8YC9wJLtZycgQ+x:y62h+7fiI/cLXHdrC8YAwJLLEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898397, "uuid": "2652bd27-9ea0-4047-a12b-80036dadec52", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898397, "uuid": "fe9bced6-6778-4e3e-88dd-d0c2b03cf1f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898397, "uuid": "98f8812e-7ccc-44ae-9782-65f070700158", "value": "7e40579e49a421d2142eb9c4cf109b6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e4c7e2-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901100, "uuid": "60618b10-15e1-4bea-a7ff-0432bf21bf7e", "comment": "Malware payload (Dridex)", "value": "ea8a5b0027a6a1ea1425f3b597a6e14d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901100, "uuid": "57eca49a-6c32-421e-84cc-8fbda8ef2407", "comment": "Malware payload (Dridex)", "value": "e8bbb80f900c6155c17180297a0a749c890108df36d3cc95e91f2720e74e4acb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901100, "uuid": "d8d8e063-06f5-4653-b8a3-9e8af8869f82", "comment": "Malware payload (Dridex)", "value": "c69f175d7c2227dfb3ff07aff9e3f7fbf6027970", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901100, "uuid": "b87f57a1-6fac-4be7-a72b-fd967e988a0f", "comment": "Malware payload (Dridex)", "value": "9b111671197fa4007bb4d50eea3649fcfe29a093b7227a7001347a8abe4c65a144a299042abe3eb902415c6c885a2171", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901100, "uuid": "e72c4369-2f26-4afd-accb-417139313217", "value": "T17595D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901100, "uuid": "35f9e6f1-dd56-4bb9-9ace-f23ba3cf91b2", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901100, "uuid": "4a79ba94-0143-45d4-9efe-8869ea37a7b4", "value": "12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901100, "uuid": "9daaf340-84b0-4a28-86a0-77b303cba75a", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901100, "uuid": "9c9e64dc-67a8-4f1d-8cdd-2650bebe1f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901100, "uuid": "263476c4-a5bb-4f0f-8f3a-0d9fa78c8ad7", "value": "e8bbb80f900c6155c17180297a0a749c890108df36d3cc95e91f2720e74e4acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94919139-210c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632909845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909845, "uuid": "0e752cc4-a7cf-430a-91d5-3c71c2a4d7c7", "comment": "Malware payload (Mirai)", "value": "33d85c22c5601871d8380895b4471c29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909845, "uuid": "d1c0dba1-8754-49c4-b039-dabf83a07aab", "comment": "Malware payload (Mirai)", "value": "e9b1a684d122cc05bb4eed44f9bfef5ae47f4bdf0a662be4eca19ae02edcb74f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909845, "uuid": "d57233f2-d6d2-4734-bc8c-05f6e85b29fe", "comment": "Malware payload (Mirai)", "value": "9e72247d4d476ceedea14c079a0530d0746f06c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909845, "uuid": "2bd54cce-5eb0-4705-aaca-80101ab49434", "comment": "Malware payload (Mirai)", "value": "15aaa6beb7aa73e48039fca81bd3bc220d2049b4c8e9deb1378aaccdf38a422ccef4972f002efcc6794dc2dee6fb81e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909845, "uuid": "e1cf349f-b9ed-4ee4-bb54-4b65a2b70828", "value": "T14B63D691BCD29A2AC6E4237AB6AE558E332073E8D2CB7117CC115B147BC641F1EA3F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909845, "uuid": "addb2240-9215-482c-8b84-5abbb6573d38", "value": "1536:0vX8FjcZxKW7tQK70/ChL0Pvg0oi25Oqsc3B2MEASVKtdOttI:aEcZxKAtQKf1BVlDfOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909845, "uuid": "da78f8ee-497c-48f1-8992-8ba06d124210", "value": 69372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909845, "uuid": "12bceeca-5b1b-4d39-9c5f-5efe18a4c72d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909845, "uuid": "2035d97e-7f02-44a3-a319-518ee11221b6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d785f823-20ee-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632897073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897073, "uuid": "6a339876-4376-4d7e-837d-b4838ce328fb", "comment": "Malware payload (RemcosRAT)", "value": "b2e376071faba9f1377ef1eeb14c4962", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897073, "uuid": "4a3c5aa1-0fcf-4514-bfc8-49f25a41444a", "comment": "Malware payload (RemcosRAT)", "value": "eac869074d5b4600afe92bd9188e0b20466668185d07e39c3c00d10a22f0d0e1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897073, "uuid": "aa6eaa74-e8a0-41c8-90ad-285a873e2d2f", "comment": "Malware payload (RemcosRAT)", "value": "58b45e2b3168956bb9d2d0b60149ebbdf465940b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897073, "uuid": "f36ca894-0a23-42a7-acd1-c810a435a498", "comment": "Malware payload (RemcosRAT)", "value": "42b3cda7eebf9e99025ade425298bea8d13961e093c4be625ee00172397eacb77fa53538b2997df2d374b39690b3f704", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897073, "uuid": "87a30c2f-8f8d-4969-9358-8c5ff311f88f", "value": "T16A3423F3DE1C929CB4A86B71D52D48133B183D01E07190E88CDD9D85C4ABA692EF5E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897073, "uuid": "912d2b83-9b2e-4f7b-bfcc-f2bcec2aa00d", "value": "6144:UKJj6nG4+i837xSqiO9M1qg9zfo54CGrQKvirG2+4lpQTCF5:jGGSHq9qwgItKvirF+ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897073, "uuid": "04c400b3-23ac-4e0e-bddd-f8019f169cb8", "value": 241736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897073, "uuid": "c4f9cbb9-400d-4659-b5d3-0ab66be89564", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897073, "uuid": "c534ffc6-39a0-46e4-9888-d3471836e387", "value": "Image-Scan-80195056703950029289.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1f6d28-20e3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632892064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892064, "uuid": "176bad3c-2702-45cf-87e2-05b895289aeb", "comment": "Malware payload", "value": "a49b975035e89ae3df9250d526cc2f31", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892064, "uuid": "e5b9e11b-f8a3-4a2c-8e00-11997a686e46", "comment": "Malware payload", "value": "eb3c84b0d59181535392b595c61b1140e12199aea60afcaa7f975c274811a352", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892064, "uuid": "db55f50b-c301-4870-ba9d-75817e3e6532", "comment": "Malware payload", "value": "ae058348a3b8ad06aeaaf73b9a1e02ce9340e353", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892064, "uuid": "ee6f7139-a8b7-488d-ba4d-59175f856e67", "comment": "Malware payload", "value": "8ba95fa02df0384c0d1a6c6f9b318e6b953811b1194e0918ba23d7531934fb38efe4dad2c761f583dd7d59c975bd241b", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892064, "uuid": "7f8d51bb-5f7a-47ad-9f7f-64e64f30988c", "value": "T1444533E2D437211B6A290C591212720C9E50DD74F9A6DF0FD6D16FE3B88EB04AB4DD1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892064, "uuid": "ca6abe61-e44d-4e64-906d-089eb87f6277", "value": "24576:qYksPGUO8VDdcyCqZQsixVrgGt/1OINH0crDDFh8orCCW+X9MdPR:1OUDqyEsiwk/19DnD7rCYaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632892064, "uuid": "48c3f2c2-a2a3-4c45-a79d-5514aadc9b72", "value": 1195466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632892064, "uuid": "bc72b3f1-f5ea-4862-9c25-342da7152124", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892064, "uuid": "32827503-4cef-4e39-9018-d26094d70001", "value": "RFQ021836.rtf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e60e7c8-20e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632892091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892091, "uuid": "8997ab01-36c7-4743-9066-f3c4c037d387", "comment": "Malware payload (AgentTesla)", "value": "33dbd1caba75171369d871f2d21ea6fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892091, "uuid": "fd91a114-d121-406e-8704-9dab727f5dcf", "comment": "Malware payload (AgentTesla)", "value": "ec79e597eade7bc2b5d6aef5388fdb56142b31be4d2a33161ab85e78d47b9368", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892091, "uuid": "c18446d6-758a-4e88-958f-b0c3586dd04b", "comment": "Malware payload (AgentTesla)", "value": "92435963b98bb636019fcdc5a81bb05d5b351df7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632892091, "uuid": "72f11651-0f13-4bb7-900f-fc95dfc7e303", "comment": "Malware payload (AgentTesla)", "value": "b7279c61ef5382ee2febcfaab3dd404ee7d5ff3ab3bb10b0375c63b69d7035f766f7fbf8e6d7ad20485e8e3d838daeb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892091, "uuid": "75e1e3e6-a72c-482a-a3b5-2edd7a598009", "value": "T16933F179A4A7E36790866EF27E044287DE7616FB3470F7684014C614C8D888DABA7F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892091, "uuid": "a91a05a5-703c-47fd-9534-f5e5d73158c7", "value": "1536:O+al5/2IOjSgI9gDu1RErxMeMvcuPA2nUC:O+af+DjSgbDu1m1DYcsUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632892091, "uuid": "8808e0b9-9e1d-4491-b3ff-9ccc4cae6aee", "value": 54264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632892091, "uuid": "54da69cb-237e-4952-9108-41a42247c1b4", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632892091, "uuid": "222e6d38-a088-4095-a02d-e956a4df20cb", "value": "FRT_INV_0344202_1.pdf.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3780d690-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "86e2b720-791c-440f-8f18-16be1aaeae6e", "comment": "Malware payload", "value": "751a6140e6a1b7faee8b658659383628", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "37ec8ce9-dbb6-4b62-9498-602cfe56ebd0", "comment": "Malware payload", "value": "ecaa6eaf16ab11fddd71f87301bc1b72d62f46d9671539faef606ef3b8a38c7d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "e245f879-12e1-4bf3-bf78-9e68416371ef", "comment": "Malware payload", "value": "c0d46c630a5975e8641febe82b153a440b63adab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "9124c202-e178-42d2-a538-15cdafa71c82", "comment": "Malware payload", "value": "184a71250f2768c66e8ab5d27f348d0bb9d92f06c5d4d8ff289926f98830e6cd7b0f79c6e59da33c229159a4df5f2957", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "e4124565-ccd7-4805-aed9-fe3959d8fb20", "value": "T1C7C32805D5508727C2D3237AEB9F865D37325BA493DB33215A34BBB82BC278D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "e6879e2e-4f32-4a97-9291-4bcb29371a4c", "value": "3072:ekYPUfsgnsb0J2ag/VflkDhuYS+mTQOY5NX3cn:9YPUfsgEo2a0lkDs+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949203, "uuid": "51d046eb-ad94-4dd0-9e2d-59b1ce28eb44", "value": 121013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949203, "uuid": "4c7e3e66-6034-4247-9e85-46893eb20d7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "8af84772-782f-45ed-b7ab-345711818029", "value": "nvitpj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54101825-2119-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632915320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915320, "uuid": "8812e044-4a7a-4322-82f6-bb59f402efe3", "comment": "Malware payload", "value": "3daf9c1d32b09fc831e2ef7d2a593b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915320, "uuid": "61351a1a-61fd-4805-82ef-be15869c8d97", "comment": "Malware payload", "value": "ecbe0cee860d2789a548616368f42ed193bf1bf6cd27cf6f0b67029e516278d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915320, "uuid": "479cde4d-32aa-4047-9fdd-8431846668dd", "comment": "Malware payload", "value": "947563c30f17d16ef08835b299832170fd200f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632915320, "uuid": "0f5830a3-1bb6-4726-9774-3c526e75a9f9", "comment": "Malware payload", "value": "2aa384d2c51bea89e49346a13d4b269c68acf5f208b087dc54e67076721e31320e52fed87489d7a6ddb82bf2d57f6e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915320, "uuid": "2dc75029-109b-402e-9b18-04fa922f0f05", "value": "T167D59C1823F46B27D1B6E771EAF241213A31E5AE73229B5F21418A3C1E43F455E8277E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915320, "uuid": "7fff7bc4-d643-4f4c-9543-56529f025911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915320, "uuid": "249be1b6-3d21-4364-8edf-41a869ea54d1", "value": "49152:co4DmzZg/Fg77R7XUZDWpkdWXbhWc2miT4/G2aHbbHIkvfKNY:l4ygu7RzUZ6ydWPiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632915320, "uuid": "7ed43652-61bb-4b65-b172-e730dde58d0a", "value": 2833408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632915320, "uuid": "42efb310-d25f-4d9e-8b49-b4718f5e4c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632915320, "uuid": "a926aa06-18f1-49a3-bca4-0c6cb6b15116", "value": "3daf9c1d32b09fc831e2ef7d2a593b96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf1b363-2148-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632935575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935575, "uuid": "11f0028e-4609-4176-ab0a-059ec4e65b94", "comment": "Malware payload (Gafgyt)", "value": "feacdde0287a03f6378f0661e15ae932", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935575, "uuid": "0a57568e-836b-43e7-b6cc-9afe46ee0295", "comment": "Malware payload (Gafgyt)", "value": "ed50d6b034bc861c756ae5a2885d7a26cc5de2fa79304af644b680b67954aba9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935575, "uuid": "3e170569-798e-48d0-88ab-69a3c3921ee9", "comment": "Malware payload (Gafgyt)", "value": "3e18ceb2761c7c42c06f12368448d2adb2f897dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632935575, "uuid": "4934f870-7294-4145-b9b9-93c85ead1a74", "comment": "Malware payload (Gafgyt)", "value": "4b1157b8f306fba3a9e520accc9224473367e58f86b815b191e79bc78b29c50ad5d938d783f8988c582cd5e3148faf46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935575, "uuid": "727eb79f-8e0d-48f1-ab8e-9e6539c6a97d", "value": "T1BC242B08E950572BC2E327BEF69E528E33334BA473D7331989385AB43BC27695D36911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935575, "uuid": "4f33e6ad-b40e-410f-858b-bce8daaf332b", "value": "6144:T2HBmi0aG7YrB9Cvi65hUfMbupM/9YByam+wM29ypFr:T24i0aCYrB90B5hUfX+/Ham+l29ypFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632935575, "uuid": "c950eacd-de80-43a9-8b12-f4a95b7cb1d8", "value": 212857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632935575, "uuid": "2b4aab32-a8fb-4acf-959d-1fd057cd6197", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632935575, "uuid": "7ef7b97a-d20f-4c36-b9ef-0bdbd05d1c32", "value": "feacdde0287a03f6378f0661e15ae932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf06ecd-2122-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919281, "uuid": "b33abac6-804b-440c-a5c3-bef538b17c32", "comment": "Malware payload (AgentTesla)", "value": "ffdeb64595062be8d5ae222d799bfb38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919281, "uuid": "54f34fcb-fe13-4a03-8232-a5a631b46062", "comment": "Malware payload (AgentTesla)", "value": "eede67308016ee5f2e2d6e8dc63d325f606f3951be5982e185dbbebb2dea3aab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919281, "uuid": "7fc986d3-86b4-44e0-9210-298b97e5388b", "comment": "Malware payload (AgentTesla)", "value": "fa07b0db1b265ba0f7eaeefd5a431b8b53995cc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919281, "uuid": "8e3a66aa-51a7-4f13-9728-0ffa6f772848", "comment": "Malware payload (AgentTesla)", "value": "0ad8829a2b9acbef0e442c03fc00113af3f2969e6ccd963d23f4ae9ebb569867333dd75606eda9b8a93cde5cabdefc49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919281, "uuid": "801a9d70-ab7a-4fe2-80dd-9b1b61fe4260", "value": "T1D5D42323AC667929F592BB77B038C3B93FCD21603702592A370E1A560966DD7436F823", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919281, "uuid": "8db71abf-b662-4aee-aeb1-d710faf66dc1", "value": "12288:fY8qyYbalbFWZHas6eVUD3NKYWUF5FXGJpaBN9YvD/TEIWIIyoudNBH0Ohid6AX7:fY7yYbalqv6bNKiFCpivY7g/zupXAXJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919281, "uuid": "f1f0e12e-a631-49bf-a5a6-45e854796e73", "value": 627781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919281, "uuid": "9cdca5ee-67e3-4fdc-bcf2-d1ccc2c9c929", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919281, "uuid": "6e61b713-9d34-4cef-a0b4-61e8718b546b", "value": "SHIPPING ADV#ASIA5098.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e6d943-2137-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1632928346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928346, "uuid": "5583969d-2dd2-4e25-8464-f4a35adb5e4b", "comment": "Malware payload (Gafgyt)", "value": "c7bbe10de4f9c19f8b29fc4029df5d8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928346, "uuid": "0336f0c2-bbf3-4f3e-8c24-04b0507fb990", "comment": "Malware payload (Gafgyt)", "value": "ef06636236571c2a723cb72c147612d79c51f7f5b3cdb39978f9b8a084e6ba01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928346, "uuid": "fd784b3f-ec81-48e2-a54b-2cfd32044917", "comment": "Malware payload (Gafgyt)", "value": "519b7ccf39c72ef6d2733babf27656274ede4726", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632928346, "uuid": "bd0a9e90-1a31-4ace-bcb0-6ae8b2422307", "comment": "Malware payload (Gafgyt)", "value": "6d0d6bb4fcc4553b3522a9a005b065f8991252f60606516c3c72364114570ed02cb17a2e4c10d88cd9d1966fc07e16bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928346, "uuid": "be24d7db-0af9-4063-90ff-d5778e81a88a", "value": "T144C35E49EB43C2B3C4430BB2028BAA5F8921F5BA8A6E8F45F7592CB4AF134C57315F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928346, "uuid": "8534f43a-7c6e-496d-b9c7-49d162ec4458", "value": "3072:2oozSBTkGz5o/mVjjp4BnK959V4yyPTFaVMHUJnM4mF9tMB105hkp9jMQBLmrMV+:2oY6eg105hmjjLmrMVduyV/rG+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632928346, "uuid": "5df32484-d704-4e32-9fcb-25e47e2477ee", "value": 127255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632928346, "uuid": "be596c03-19ff-465a-b319-0e07d5903129", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632928346, "uuid": "3f050a38-80da-49fa-8b94-cf132e844dfd", "value": "c7bbe10de4f9c19f8b29fc4029df5d8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3115cda1-20db-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632888633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888633, "uuid": "ad639396-aafb-462f-afa2-25115e750f61", "comment": "Malware payload (Mirai)", "value": "43d6d799a3859c97aa1a10811008dd8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888633, "uuid": "41f6a8a2-0d47-4f55-82ae-463d8b655361", "comment": "Malware payload (Mirai)", "value": "ef6d81f6d8af1de7d05b0c42d42e1806c35f1fca6539c417990db6431e953caa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888633, "uuid": "95bc974d-0221-4525-97a6-9ad95c9ea8b1", "comment": "Malware payload (Mirai)", "value": "33517023ec1f80761e59dc57059d24ea53395ba3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632888633, "uuid": "a3fcba0d-3bbc-421d-8ceb-dd0aa769ff52", "comment": "Malware payload (Mirai)", "value": "ebc1c54986176fc606233a51615a67edec9f6a3e3c991b8f393750fa8489dae59f6c65b49f1a071bf5091e56e81f8ce9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888633, "uuid": "7d2a5788-7d3c-40fb-af3b-7c0208b49462", "value": "T18FC2D10E130D55DEE83650762BD44BB821211BB4D4817C0B2F6AACBD898A4DD34F7BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888633, "uuid": "7dacf0eb-c004-4e62-9d79-5cdb80791ac1", "value": "768:05XvWWe02XfRc9kSAHhLYykJgGlzDpbuR1J3:0K02XpfSAmycVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632888633, "uuid": "3716ff1f-3a21-418d-84e7-74a6d4073168", "value": 27728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632888633, "uuid": "592448a0-a30a-4da5-8452-7725ae358a53", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632888633, "uuid": "85ee9ca4-aa4c-400f-944e-413aa572eb42", "value": "43d6d799a3859c97aa1a10811008dd8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50005f0-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901766, "uuid": "2035adea-81fd-40e7-94f8-16f8e7d62239", "comment": "Malware payload (Stop)", "value": "9157dd70f14e2dd5b697c34164c6b700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901766, "uuid": "028c4aea-bc66-48ec-88d0-a43661c7cfb0", "comment": "Malware payload (Stop)", "value": "ef883b1302fd39664bf7ef489ddac6ae0a4e09be8f46d5c975a127174d0d9c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901766, "uuid": "fe795bc1-689e-445e-ad4c-5ab538b644de", "comment": "Malware payload (Stop)", "value": "5570911fddba04ba22d944d0ae67d6436379e23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901766, "uuid": "916d4028-123c-4436-a17c-629d0518fea8", "comment": "Malware payload (Stop)", "value": "833d96456ebe0d0bce63db61360714f371f6255252b8afff14b55a3bdeba5f422571586ae4b316b1aed5de4df8e7b113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901766, "uuid": "e91d95bb-3a37-49bd-bb7e-d06616f584fb", "value": "T1AFE4122277E0C473E7976931187BF5B9163B7822DD7BD44BE21C079E0A252818AC63E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901766, "uuid": "f84e8b2c-599f-4eed-9e3d-9cabd54b82c1", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901766, "uuid": "7b92687c-907c-4968-98c9-2f36597d8805", "value": "12288:4z/Q4vy+YQ73prC9lF2XLLrCjxHzIEEzFGO9sTXsrn253UcNVEB7KKTbpdd:q/QSPprC9f2XLCjxNk7sO2+bBZTVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901766, "uuid": "fe99ce4f-cc4c-4915-a729-253f31e590cd", "value": 714304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901766, "uuid": "265c142d-5e50-4e08-906e-042f7deba408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901766, "uuid": "76838b36-4b69-4507-b079-6b741d8c2685", "value": "ef883b1302fd39664bf7ef489ddac6ae0a4e09be8f46d5c975a127174d0d9c34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1ddb48-20d1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632884469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884469, "uuid": "6f1710d4-be99-4d64-a10a-ac9bf924a4cf", "comment": "Malware payload (RedLineStealer)", "value": "d08d0d18483811c1fa6437f2f2683cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884469, "uuid": "c5c301f7-8352-493d-8a3a-ba0d1f45c95e", "comment": "Malware payload (RedLineStealer)", "value": "f080e8d8867e29cb5f6d14a6c85506cae3d108d94f0e0974035819a6fedcd420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884469, "uuid": "2a53c4d7-8b99-4e65-b002-ae0264803ef6", "comment": "Malware payload (RedLineStealer)", "value": "cf07a3e12b0222ac11edeef0ab66fe3e9a83433a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632884469, "uuid": "8c1b1270-4054-4808-a681-d612b8e3a499", "comment": "Malware payload (RedLineStealer)", "value": "13cefc7e31518286cd80ce22c29583f4740659014bdd692ed23023d67fdbd87f3e1e15a631e32142bc1fe58105a6bd2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884469, "uuid": "e309a713-9f9c-4c8e-9f71-b29ad12bbfb1", "value": "T1F5348E10ABE0C035F4B712FA49BAC3B9A93D7DB16B2590CB62C456EA5E346D0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884469, "uuid": "06f290eb-fb52-41fb-a992-437cb7d468e8", "value": "192411e2e19367f41197615b5b42abe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884469, "uuid": "da54f8ba-4451-40b5-91ff-60135f9df9e0", "value": "3072:DEn72ZTk19VLMymyoLB6bK4OOo10d7cUyQ+UnnYYWlGa+12ElgYKBVXs4OOl:478TkJMyTqBn4O0HdnYLGv2YWL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632884469, "uuid": "27f0a048-3a3d-40b1-b635-fd14a70e5592", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632884469, "uuid": "5e31e205-11d3-403c-ba19-44cc0e7dd13d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632884469, "uuid": "31a0e79f-ae8e-4fcf-8d6b-fe6ae8becb59", "value": "d08d0d18483811c1fa6437f2f2683cad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490e8558-2141-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632932482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932482, "uuid": "466cd9aa-8012-4ee3-a0f7-2eb00caf5cdd", "comment": "Malware payload (RaccoonStealer)", "value": "7687054ef76c0842a827c7249c7c5454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932482, "uuid": "c2b53985-2f38-4a15-931a-0d4bd348bb17", "comment": "Malware payload (RaccoonStealer)", "value": "f085d79b0b46ad9eda7f2191e2e668314553251ab5d0f4936f84cd2c1afa2564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932482, "uuid": "4f6c3b1a-6671-499a-8edf-a8528a4192d4", "comment": "Malware payload (RaccoonStealer)", "value": "da4177807371fa64acc17dfdd0fa0b6d6c39a8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632932482, "uuid": "bc4d3a26-7067-4908-9704-e24c5f4027eb", "comment": "Malware payload (RaccoonStealer)", "value": "f42010f4d2c1ebfd8eec4f935958801d4374b304163fe1ef2ed75330fdc5ea84f746c70d17c3f5b560f699df5ee03bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932482, "uuid": "2ae9b079-f8b5-4e58-948a-1bca196a2d40", "value": "T10924AE01B6D1CAF2D711417258E6C6B4D52FBCBCEF2056F72B9416EE9F392D19A22302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932482, "uuid": "f923f15c-107d-4efa-b32f-acd31cf2dae5", "value": "ca5041463b2dd933d009ca1aebe1423c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932482, "uuid": "fed0fba3-b3b9-4ea0-9847-b69236e706b5", "value": "3072:tTBu9syjh1zk8CPhmabpc5KprcPI1ZeISr/e5RHZFS4sz:tT4Syjvkjmm1cPI1NSr/e5R+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632932482, "uuid": "74235831-e5f7-443e-a0f3-c77e870650ec", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632932482, "uuid": "d6c52702-1886-4d84-a747-9e52f686f13f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632932482, "uuid": "11f6c682-f035-463a-8f7a-e445f3d06b31", "value": "7687054ef76c0842a827c7249c7c5454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2a9f44-2127-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632921562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921562, "uuid": "b3c6df40-de4d-4191-b789-5777522ff336", "comment": "Malware payload (Loki)", "value": "ef68c0b83a6918a3c72ce976253f6f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921562, "uuid": "41a8d061-741e-437d-8b84-b30ebf266e32", "comment": "Malware payload (Loki)", "value": "f0d689b112dd834c1e4daa0ac6cd032fab83177aa37168b24da9904512fa4800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921562, "uuid": "caf872bb-5b39-4d8a-8577-8e249344d888", "comment": "Malware payload (Loki)", "value": "134d94f6879c8973f336fcb5c540dd0fcb469e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632921562, "uuid": "2bc64f1f-c115-4e52-9aae-ee9679626798", "comment": "Malware payload (Loki)", "value": "35e5ffa639d6c81c531780dc2c26d696f36e9ba644b83ab9f6143fff21321f41307a371edc92974f6bee006a0111f4d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921562, "uuid": "ed6dfffd-1424-4ec9-9bfb-295df862f9ba", "value": "T1B0256A298D2682F7C7DEC63CD05C4BDEDA62AC877A614F1EC495BB93127B60BE04805D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921562, "uuid": "ceeaf1b6-b4a7-47aa-a9ae-e9384d4dcd4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921562, "uuid": "c7f6d251-2e9a-4a98-b18d-a818b73427f6", "value": "12288:MAZpWZf8g5g607olNS949nMTP7r9r/+ppppppppppppppppppppppppppppp0G1:rWeCg60UlNSmw1q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632921562, "uuid": "f2a9296b-2412-42db-be6c-f5929be157cf", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632921562, "uuid": "d6ad298b-a362-439d-bf0c-a7ba18a9a5e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632921562, "uuid": "9de6f601-deae-4dea-b964-d8c83047ed4c", "value": "\u0414\u0435\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 DHL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5d7457-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "430465b1-a641-4243-a84c-f93a67e8093e", "comment": "Malware payload (AgentTesla)", "value": "6818c65f50278d3c3e2e6c8b72671973", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "016a0b55-1b59-4ae7-a59f-ab4ce086eb5e", "comment": "Malware payload (AgentTesla)", "value": "f0d9a065e1b897e733cc5401028b2ad0efd777de28aa68b35666218496481309", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "09cf15bd-3cf6-4224-9ec2-a7c40ecb7e8c", "comment": "Malware payload (AgentTesla)", "value": "885f757e61c88bff96a9283d0d9ac4a33a7a83f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919522, "uuid": "6e11b4eb-f7ec-45f5-bb75-3f8aedda520c", "comment": "Malware payload (AgentTesla)", "value": "ebcf273dc3912f005fb713920d7c355c5fdf93a4aaa4a662c7be9a010a44f38a3c44fcdd82b4c6131d5c34d1a82ab4c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919522, "uuid": "a8359929-e889-4686-84b3-b99dec47e0a2", "value": "T19DD42323AC667929F592BB77B038C3B93FCD21603702592B370E1A564966DD7436F823", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919522, "uuid": "d4785ccf-8285-4165-9f81-5e6440846a8e", "value": "12288:UY8qyYbalbFWZHas6eVUD3NKYWUF5FXGJpaBN9YvD/TEIWIIyoudNBH0Ohid6AXI:UY7yYbalqv6bNKiFCpivY7g/zupXAXJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919522, "uuid": "67f5b988-dcf0-467c-abd8-da4c047be411", "value": 627777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919522, "uuid": "475e3eb8-cc5d-4f99-9a8e-164ebc726d75", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919522, "uuid": "6164d917-a1e5-480c-ba74-e85d1435c1d6", "value": "PRICE QUOTATION OCT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98ecc4d-2167-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632948992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948992, "uuid": "7c7d69f4-7527-4d61-a169-16fac6f28d64", "comment": "Malware payload", "value": "8185cfe49414febb2e3f950a92f09ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948992, "uuid": "b4521681-9280-4220-92f2-71ae80f20422", "comment": "Malware payload", "value": "f16b62a80d8276ea484c49ec613e23a9e7565ba4abe04ac72c6f1b5d2f2b2250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948992, "uuid": "87461a18-1f38-44b1-851a-bbf8c3893fbf", "comment": "Malware payload", "value": "6497bada9ef398012a70d040b4e93161184f4acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632948992, "uuid": "f2fe8182-5d54-40a2-a77f-7ae61ab28b80", "comment": "Malware payload", "value": "529a2000233e1019c95e2584d0416b11d4ed1e3797d73679d3fdb85e573b08eca64a40d0c8538b9ddbbd9faa1c5fabc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948992, "uuid": "e782c80d-da42-49d8-964c-7593c77edbc8", "value": "T16DC35B9DE050BCD2DE7ACDF5A8E094144719E8EFB260B9BF7B58B5F918324D2093C609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948992, "uuid": "1300abad-1b98-43e2-903a-a64cd893b420", "value": "d6035c83c7faba95a2e0648bd4884853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948992, "uuid": "8b8a131d-0de1-44be-9832-94cad3f87671", "value": "1536:lA/iUzHOhZJNpdKycffoUzAZI0w234YM6aYxLU:W/nzorTkJz+P34YMBYxLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632948992, "uuid": "a6cb00d7-aa94-4865-ae1b-66a8ce39023e", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632948992, "uuid": "80f4364c-d863-4cc7-b68e-0ac8292057e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632948992, "uuid": "e08a1b77-5aee-4256-bb95-b5dad2298edd", "value": "Facturas Pagadas al Vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce88786b-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632900064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900064, "uuid": "1db7249b-9950-44c8-a042-6e149200cbdf", "comment": "Malware payload (SnakeKeylogger)", "value": "d682b72bc59afcfd47b97d83cdd2fb20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900064, "uuid": "37b7b91e-2714-458d-ae7a-97db0560fac0", "comment": "Malware payload (SnakeKeylogger)", "value": "f1c9a70d3634afeea15aa85747b0bffc000ab4333161535a721c06cbdd77497a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900064, "uuid": "d3c33ece-bc97-4dd8-9e38-400ff9754490", "comment": "Malware payload (SnakeKeylogger)", "value": "9bbd8bfcdb9fcf33b23c86ba69208b36425273ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900064, "uuid": "702bf56b-32a2-49cd-95bd-69cf96c34f36", "comment": "Malware payload (SnakeKeylogger)", "value": "1d3e42cf8a501b6eb30f65347d59ebe0d5e3b36bd57213bea1d38ccdfbdc8170130d0df06bfcc80809af24ebd7c9c5a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900064, "uuid": "3b3ec625-d235-46e8-bb1e-440192819c1d", "value": "T1E8F46C2AB60CE64AFD1433F02524BCC411F81C981C6CAA17B97672E6B4F9E27DDB505E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900064, "uuid": "e69d3a3e-be13-4c0e-b0e1-f8e911d5489c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900064, "uuid": "7a4155d5-9fd2-4e95-b4be-341f8482073d", "value": "12288:YD4VHfQe6ZyWshg+qbZxTZZWunAWvwz3M35l18b+OT9c3MPBIRsMM3NiI0d:YD4VHfQe6ZyWshg+qbZxTZZWunAWvg3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900064, "uuid": "7287265e-b99f-4d41-8bbf-70afc7a76c1b", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900064, "uuid": "58aaf9ea-4170-49bf-b8e0-bde45aa9885c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900064, "uuid": "3deee0db-9ec0-4451-a964-1a56e6ed6ed2", "value": "PO126127, PO 126128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8242e426-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1632901654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901654, "uuid": "806607fb-1bea-4f35-9b88-d0facff1b292", "comment": "Malware payload (DarkComet)", "value": "50b53927892abfe41b08d0c6311c1a39", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901654, "uuid": "370abe69-0ae4-4337-861f-94b8a863b95e", "comment": "Malware payload (DarkComet)", "value": "f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901654, "uuid": "7d08fd25-c5a5-4143-8487-3bc97d176435", "comment": "Malware payload (DarkComet)", "value": "b43e1fec005c39a1a0b1ab31616522906fe4ba84", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901654, "uuid": "5c8a8a12-afa6-45f8-801a-2ec1d11caa85", "comment": "Malware payload (DarkComet)", "value": "562e47b6166a0a15bd065067e5bc6a151c58da8e208fc36dc4c3a4aa1fab8866fd979e1b5c34fa0edc2bd3a5c8d4574f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901654, "uuid": "9b4058c8-a2db-4a63-a014-a514f754ba0a", "value": "T14DF45C31B1808473D83239F88C4BD5F6942A7E242E2575463AF63F4D6A3A583ED162DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901654, "uuid": "3b3d1a1c-e5eb-485d-b805-647ea2054101", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901654, "uuid": "da98d399-e226-459c-abac-436ab5629a7b", "value": "12288:c9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hIf:wZ1xuVVjfFoynPaVBUR8f+kN10EBaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901654, "uuid": "f0c4abe6-59e4-416b-9805-337802b127d5", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901654, "uuid": "1a1283b2-5cad-4e8a-b68d-0d5e7550e43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901654, "uuid": "1f551963-d5bc-4de7-9f9b-7d9a5ba2cd10", "value": "f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71401448-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632896472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896472, "uuid": "8d0855c0-43ff-4350-9d60-24c7be73ed5a", "comment": "Malware payload (SnakeKeylogger)", "value": "ad181efe9f33f0368cbdf5447814a748", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896472, "uuid": "7e4ee37d-591b-47fa-80e6-66a2183c88c6", "comment": "Malware payload (SnakeKeylogger)", "value": "f260c80e685986ac80122c63fcc494891baf4d688668da8f7fa11e38d7f8d1b8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896472, "uuid": "0901bee9-2521-4af7-8c5e-d56e088f1f5a", "comment": "Malware payload (SnakeKeylogger)", "value": "b212b79c3a934c54765adc0c1e1715835d1a61bd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896472, "uuid": "590e6664-a96a-4ba1-9466-4b71596d19d4", "comment": "Malware payload (SnakeKeylogger)", "value": "f83f4f502d032d5971fbed5b7e7e8159d1589c0ad8f6156a1f5473de910365c12f34f9045a16f89f5d8f7b308c1e34d0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896472, "uuid": "f4897d5f-b8e4-4549-b136-ca03a903cd85", "value": "T169C1C70077E98B36E5F24BB9CCF387005275FB01ADA7871E2594021AAD263648E72FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896472, "uuid": "e534e49d-8fa6-4a6b-ad21-aafd2da61f65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896472, "uuid": "25dd50f1-fa51-4144-a5df-b2fdae328e8a", "value": "96:DZ2J+EAPgZ8bMEhLQM2tEj5V6PKVnzNt:EgEigD9M5UKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896472, "uuid": "bb449642-ebe9-4267-b152-2dab0eace964", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896472, "uuid": "77a931a0-bd33-48d3-a5f8-297970365b4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896472, "uuid": "01b62525-256c-4806-b1a4-9a20f9bec7fc", "value": "DHL AWB# 4AB19037XXX.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ec253a-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900187, "uuid": "654ef539-044e-480a-b3e9-3808fc2a7d17", "comment": "Malware payload (Dridex)", "value": "581c0372c81e6d3e539a1e6efca2b0ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900187, "uuid": "da458a0c-a8d5-4b24-86c1-5c22e309c27d", "comment": "Malware payload (Dridex)", "value": "f2920b6ddb773bc41fe148635f7f3aa2c95c64ebae3ce414a5b42de85221def7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900187, "uuid": "74053b0b-9a08-4153-9017-063bce907f0c", "comment": "Malware payload (Dridex)", "value": "dd5c7db85a600f3f19660a7c94d1e11605cf80a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900187, "uuid": "dad65c03-72e3-439a-a724-f00584a211b7", "comment": "Malware payload (Dridex)", "value": "173e6ce8e7ee7033520090265a87ade540a21ab102f2c10452276c98f81b4730cc9046b1cfa5b712d58e5727ff7cd26e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900187, "uuid": "ab936d9c-b2af-4c8e-b71f-d0009998555d", "value": "T15FE5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900187, "uuid": "69301e9e-2e37-4ecd-8222-292c5c395e48", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900187, "uuid": "4853a0ff-b826-43b0-8372-9b983337936a", "value": "12288:OVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:TfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900187, "uuid": "b7672b7b-2ccc-4374-8c2b-bd3614595383", "value": 3149824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900187, "uuid": "238d8683-e9de-40e6-9f56-a3730ec49b2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900187, "uuid": "4ade2811-4b58-4f89-9f33-2e7ea37a31d5", "value": "f2920b6ddb773bc41fe148635f7f3aa2c95c64ebae3ce414a5b42de85221def7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1008148-20ff-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632904363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904363, "uuid": "a9e37190-1f0d-4635-90e2-9b0401d30958", "comment": "Malware payload (AveMariaRAT)", "value": "316f5d97d93cee97bb0937442512b1d6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904363, "uuid": "e41fb88a-0c96-489b-bc87-cb1c16ff3251", "comment": "Malware payload (AveMariaRAT)", "value": "f2d88bc578a8201f6d8df487f92a3f157b47e6a492be857c4b259fff455e38be", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904363, "uuid": "664def74-ce80-4ab5-8bd8-874818863913", "comment": "Malware payload (AveMariaRAT)", "value": "c7d5c938d4989b98db5aa0488c6a273a15309821", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632904363, "uuid": "d402f4d8-8537-4212-9703-3dce29a06ede", "comment": "Malware payload (AveMariaRAT)", "value": "912125f4acdeb615e84207afd7ac58281dc1dd9f2d6cb7c9f429bcb627389d26ea935abf6cd6bdcf55b3f16b7f4147eb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904363, "uuid": "d322e6e0-22ac-4105-a7d8-dfb0d7427398", "value": "T1F48423F368A6D8437AFFF9B100B0550AD075AF960320183B917D426E27ED9ACD8954EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904363, "uuid": "aba47395-0ce9-4ed9-8d11-f82e5372b222", "value": "6144:jspsnHmou1FdnQ0bJ7++mTGzTWDjpt0CTs8/sr88DnpZ/XLqSQpkzKD6n:jUmH2jdQ0bU+hzTYTGZZ/eShzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632904363, "uuid": "71b806fc-45dc-4de4-a4b0-1d2c7658f423", "value": 389019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632904363, "uuid": "59806d8e-37ff-43a6-a517-7333eb3297ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632904363, "uuid": "699a60be-d712-4402-8330-777b967e7259", "value": "PO_0098765RTYUI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32487103-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900231, "uuid": "b09da2d4-c31c-49a0-a2d8-611ddf13c5f2", "comment": "Malware payload (Dridex)", "value": "4553668ee5ba3b1df41833a92ac1a00f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900231, "uuid": "86327c3d-b92c-4f11-94e8-e98e065c7ba7", "comment": "Malware payload (Dridex)", "value": "f2dd1e63027d4d00c90e5acc85aafe6bab746182f8f9da0e64901870268641a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900231, "uuid": "268c73da-38a9-4123-b32d-4cb779893768", "comment": "Malware payload (Dridex)", "value": "a91c21db05221f12e585d1407f1c858beb74f46f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900231, "uuid": "328b8d1e-9b3d-4ced-8db8-7775f053a6ce", "comment": "Malware payload (Dridex)", "value": "c44d02cc0a89dae02df58ff3f80630dddae8a4738382e2e61e6e05dea5f2dd6e62201c0e7119fb32b9809f80ba4bcdf0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900231, "uuid": "bc019271-6fcb-4ace-b8ba-ebab30f58aa0", "value": "T176D5E020EF69E1E6C6B89F3E9408352727B93D75110D618CC392704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900231, "uuid": "aadce8ab-5cb1-441b-ad1c-104f7c940a91", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900231, "uuid": "d443f9d6-bddd-4f20-8a78-d5ad16e68083", "value": "12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900231, "uuid": "de867229-77ba-4166-9ea7-b65a4c712f09", "value": 2924544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900231, "uuid": "364a05e3-75a8-40ea-8b31-deeeb94deed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900231, "uuid": "3c23a833-7123-48ae-a863-a149e2c368ae", "value": "f2dd1e63027d4d00c90e5acc85aafe6bab746182f8f9da0e64901870268641a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e26a3fc-2156-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632941402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941402, "uuid": "cace2496-78f6-4b8c-befa-76d767ff452f", "comment": "Malware payload (Mirai)", "value": "e5f7cc070d3c51aaa7aacb1cc2583c6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941402, "uuid": "8cb92a18-ea46-4ced-80fa-46def33b4f44", "comment": "Malware payload (Mirai)", "value": "f34a6b4b6def30361ca58f2692dbd56736e266b6bca459867652e2f9a1ee9264", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941402, "uuid": "4c5a55b0-dfc5-4016-b493-755521cfceeb", "comment": "Malware payload (Mirai)", "value": "f77d0f2b19ecd31ffff222318a2a7223feb5d647", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632941402, "uuid": "7f363290-eff3-4667-8704-0951c1d26513", "comment": "Malware payload (Mirai)", "value": "6c1f7250d758420671f7e0ca3dfbcb694880f94217a94b0d757382db598434eb8c26c5991b3ac6287f2f1e3b066154dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941402, "uuid": "438c4cdb-2947-4923-9459-75c7c7483d5e", "value": "T1B1C2E1B9F05C0F0ED40881FE097B35C6B9B728526A3261465B1C5AD313F71E4663BAA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941402, "uuid": "3fe1b69e-6a2c-4e17-b0b0-ec69abd1c3c9", "value": "768:f31s2+AbUYPs+R7HRytqZYHjm407bIagke:Ns2TsiHAtnHjmLXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632941402, "uuid": "8846fa4b-ae1e-43b3-a2ff-8533c57fd042", "value": 27084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632941402, "uuid": "e831cba3-cb50-408c-81ae-39af25b8ef8d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632941402, "uuid": "603cea3e-09f7-433d-85f9-bbcc5ba7a1cc", "value": "whoareyou.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461e3a39-20d4-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632885662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885662, "uuid": "c9e4ba77-f9db-4f6f-aa94-fbfed7b0326c", "comment": "Malware payload (ArkeiStealer)", "value": "7f20b8be5bb0395243cd598169978e34", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885662, "uuid": "25aa9c90-f886-426c-ab56-e1d4cc019349", "comment": "Malware payload (ArkeiStealer)", "value": "f3880cc610096c5ce3a7407741d8679de5b4f163fe1df37a051cb6026afe56d3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885662, "uuid": "c02b8776-0714-40d7-9252-7a1ce474edf4", "comment": "Malware payload (ArkeiStealer)", "value": "f38ce87da1f2a2c8b3c50279d770cd0fa21972e7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885662, "uuid": "8617285c-5755-4242-b030-d3ca33c21545", "comment": "Malware payload (ArkeiStealer)", "value": "e92000be0a887ecc0a216890dcf12f03f196d935c0dc92f846d7840742ad9e9d3d153bd50d254e6a2732b0c718f0eb89", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885662, "uuid": "c05421bf-fe11-4206-a9a2-2dbf2b5784c8", "value": "T174E40210B6E0C035F0B702BA85B593BAAA3DB9F16B3494CF12D516EA5E746D0DD30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885662, "uuid": "751e0aad-f93d-4f94-bfa9-c685c3907060", "value": "1435fac27cb0e146b6806556c822ef8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885662, "uuid": "66b03526-6ca5-4c96-be2f-f6c180b22a88", "value": "12288:m7akYIf8jYoDy2jhFj7t84vy9vb5pwG9aNNhtXhLJxO6UCdr2p4kG89+tq:mmkYvjU4hFj+aYv1pp9oh5J/UurUZGfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885662, "uuid": "4e2c2aee-83fc-41db-825b-83101b67dc48", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885662, "uuid": "f335e598-37ef-4fdb-b1ae-9c8c801dd574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885662, "uuid": "88e4dd21-09e3-4186-bbcc-57c6d10ac38f", "value": "f3880cc610096c5ce3a7407741d8679de5b4f163fe1df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6528022c-2145-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1632934247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934247, "uuid": "e7e949c3-17e3-41cc-b577-a34416f9e727", "comment": "Malware payload (Quakbot)", "value": "5d525597ac63c8b29d42c879b8d34279", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934247, "uuid": "437326fd-f901-4512-af70-abef7bef13e7", "comment": "Malware payload (Quakbot)", "value": "f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934247, "uuid": "3cc12057-b050-4cd7-81f6-ebffc60823b1", "comment": "Malware payload (Quakbot)", "value": "9422595b557dcff273aa393752a48393d80c8bf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632934247, "uuid": "f72f8da5-ff9e-47fb-8d23-417acddfa7d8", "comment": "Malware payload (Quakbot)", "value": "af7840afcdcaa6bb09adefdc6428fef2c68771b1f902ec715ffbb508d871872d4f9ea99d7bcbfe995ad92c67cdcd14bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama106", "colour": "#E8C791", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934247, "uuid": "1169a186-0323-43d0-9f72-126585aacd87", "value": "T1A8F47C403A55E521E6BD1A328F2AD5E807187D089FB5B4DF79E03F1F2AB98D3C621316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934247, "uuid": "1f075d61-9019-4c58-b0c8-a8b4cc2e01fd", "value": "3a9ce6dbfabfc6032e0cfde571419746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934247, "uuid": "0f8f5623-0274-4c41-83bb-3ce2a4dee0be", "value": "12288:4bbAcis08s7gQFMWC24/MFS+AWmdXWJIjJ5F3+DpEFs3H6v/+NoTN:43Dis0dFA24/MFSptoJKnx+NE23a3+NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632934247, "uuid": "60b437fe-6e9d-46a4-bb8b-885ab635bdc4", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632934247, "uuid": "4cde2b0b-cbbe-4a77-83af-bf9ad85e0d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632934247, "uuid": "0fd9eb97-ed47-43ae-93c3-896df92762e5", "value": "44468.7122434028.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5838fc3-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1632900452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900452, "uuid": "658195bb-695c-4c3a-9d8b-0be83db4d17d", "comment": "Malware payload (QuasarRAT)", "value": "90351f12913209fcc69964dd24a0eb38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900452, "uuid": "d104a648-69fc-4444-b624-d94edb935949", "comment": "Malware payload (QuasarRAT)", "value": "f4b43bbc941d68dd3f835a9fc776c5b3e4e0e7442836bcd845d31c87acf64be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900452, "uuid": "4b236238-24ce-48b4-a438-15fc6bef1236", "comment": "Malware payload (QuasarRAT)", "value": "7e6b66fa9d4552c63360a9acfec96ea5f5a0c950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900452, "uuid": "80063f69-e890-4827-8936-8358e04edc83", "comment": "Malware payload (QuasarRAT)", "value": "933dc8095c4637153b296d2ecb510f249a8374b29516d0b0e7d95a0d2ce1c52636b22bdfd46282235624b6cd557141bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900452, "uuid": "f0a045ec-1a2d-4ee0-8dcd-38ac3c9bbe4d", "value": "T10EA5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900452, "uuid": "5cfaba88-f1ad-4639-a27d-1f375419af3e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900452, "uuid": "7cd1ea65-8dc0-40bc-8e9f-940c46cfce6b", "value": "24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKY/:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900452, "uuid": "5e9e0574-80e0-4ba1-bf8d-47c75d3a7e36", "value": 2111392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900452, "uuid": "62bb89b4-9009-46fa-8146-fd9c2b09b930", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900452, "uuid": "c1d102ba-98b8-4f56-9d4d-08db00105cbf", "value": "f4b43bbc941d68dd3f835a9fc776c5b3e4e0e7442836bcd845d31c87acf64be7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0ccc04-20ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632896513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896513, "uuid": "fa6a425a-d43b-471a-a0c9-62926fb0d473", "comment": "Malware payload (Dridex)", "value": "a3964e09428462779116313ac4e1d950", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896513, "uuid": "483a2345-ff9c-4525-bb92-0072d7a33278", "comment": "Malware payload (Dridex)", "value": "f4d2673bd6c42c2d33f83ea67949b6a63fe423fd8225600ca9f163e0808b56c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896513, "uuid": "4de42837-a53c-4adc-93bf-93623ee7f3d1", "comment": "Malware payload (Dridex)", "value": "7dfa23ace3104920e325b5941f2ae9a86194587f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632896513, "uuid": "a980e252-e5e1-4a19-8ea0-c703c33a7a53", "comment": "Malware payload (Dridex)", "value": "7541bb0a175cd42973826ba6cf72a8d6d18cd6c16fd0c6a5baf7cf61c89b2e6be452b75c8c42b9b1c58642d05e1b6e41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896513, "uuid": "a3b6da1d-7701-4c8f-97fe-52fc586b23d0", "value": "T1EB259D4AB04C1F9CC4B9FBB58989A574875AEC6BC771720B7AC271573CB5E802836BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896513, "uuid": "f3719392-9153-44f9-ba4b-a4ee5cf34234", "value": "961cca344709c2cbc3e0f11407c7501e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896513, "uuid": "15dfa066-74fc-4791-89d0-8a20a0006940", "value": "6144:KZSXXU65LrlIBsC8B1zJ25BbpAN/CEDIrQ/UAtwq+zihCJ:NU/UlEHpA3D1Iihi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632896513, "uuid": "13bd974e-83ce-42f8-a969-e1a59d9e5fb8", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632896513, "uuid": "52ff7262-fa04-4fcb-9dca-583cd21b8fcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632896513, "uuid": "8ca1581e-84af-47dd-9345-2ed8dd02ca04", "value": "a3964e09428462779116313ac4e1d950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c9e329-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632903007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903007, "uuid": "51725254-c023-44ef-8d66-fc72be8e2a97", "comment": "Malware payload (Tinba)", "value": "3d0240bd0792068ce61d12a4c1f19547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903007, "uuid": "e14df7b0-70da-4a91-be2f-b90a1f2f4940", "comment": "Malware payload (Tinba)", "value": "f588b29794fb5534d8293c84179b68864ebc4885ed3a71d9e19e00d7b09ad925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903007, "uuid": "a19a0f3f-8bcc-4a4a-85f5-0e8d808b93b6", "comment": "Malware payload (Tinba)", "value": "0b082253890bcafa87e3f46cb877d16409104ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903007, "uuid": "bad8fdcc-1486-4f33-8b1e-a3c5aca126be", "comment": "Malware payload (Tinba)", "value": "1538dbcc0b2f5f38d88edc8c493abc5aed0a7497fb2f01640773876c41b804ba939bd110d453fa51485b14fd43485815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903007, "uuid": "38f9775b-d9f5-42cd-b04a-918a8ac0a86c", "value": "T12773F812A3A6A11FF4B75AB96A78813216237D709F34D1CB32C84E9D56B3DD28D31723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903007, "uuid": "86aecfd6-4487-4833-8564-c597b19edf01", "value": "a0c97e54c7cc84aa5e0a7c186f29e1d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903007, "uuid": "61e23da5-c89e-4834-8d53-d88fab91c144", "value": "768:fHAl7xH0U2VFb8OaYS0a6L+nznGOevsCWg9nrC3Xybi9HW+C5c9JT:Yl7ln2HLPL+znGOe0CWgleHosHGm9JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903007, "uuid": "d4a76995-5a0a-4e6b-aa06-77dc3cfd5806", "value": 77828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903007, "uuid": "4b15cb78-0b80-4467-8f1d-a4cd5252254a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903007, "uuid": "8bf2bf27-4ea9-493f-9261-e21634bc423e", "value": "f588b29794fb5534d8293c84179b68864ebc4885ed3a71d9e19e00d7b09ad925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a558ab2-2177-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632955704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955704, "uuid": "c1392199-5959-41bd-8acd-d77bd9d65aa1", "comment": "Malware payload (Mirai)", "value": "01a7facce08bbf1bad37b6e08dbb8363", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955704, "uuid": "46ff8a08-23fd-40db-b259-b0b94de94af2", "comment": "Malware payload (Mirai)", "value": "f5a80e9b7f6f60a8fd105ea0e8633c1f210501dba36f03f8a7e8f88bdc027ff8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955704, "uuid": "851768a8-bdfa-46dc-a78e-f3ebafaeadc2", "comment": "Malware payload (Mirai)", "value": "dad15cf30550ae1a3a3f2d2ecbe8ca247e695972", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632955704, "uuid": "2d8544b8-6d78-4037-a0d0-535ffa224453", "comment": "Malware payload (Mirai)", "value": "4f69eaf324d7233993683b79faaf516d0b461e059a6f25a8aa67b9350b83090b871c2e304f570e5e58bd573e68a78b34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955704, "uuid": "3077fc9f-b0eb-453f-94d4-420486353a7b", "value": "T19453A319BF650FB7DCAFCC3745A9174228CCA51A61A93B36B934D418F24B64F09E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955704, "uuid": "e97ef6e8-b9da-4717-b04c-2e0cd07ea765", "value": "768:j+bpLmWQ3Wk/VM/SNvvxTzIP25UdesefnepAA2IZIy6Xidokc7vvK:j+b5mA/EvvxIP2QVWnCAAFZIyHc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632955704, "uuid": "806752ae-ec99-498d-8202-cae60fce0cda", "value": 63888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632955704, "uuid": "a1bff3c1-3391-4710-8c9b-84457f0d0577", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632955704, "uuid": "ceee3dd0-2253-4045-a5ed-1870c389ca14", "value": "01a7facce08bbf1bad37b6e08dbb8363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb92471c-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Tinba)", "timestamp": 1632903066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903066, "uuid": "b03990f2-c8b7-4ddc-8c03-3bae21d62fd5", "comment": "Malware payload (Tinba)", "value": "e1b4bf48da15cfbe2761690f308bf250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903066, "uuid": "58c8b40a-77e6-4c2e-b34f-46d8fd305007", "comment": "Malware payload (Tinba)", "value": "f5e8e874009616b7110ace2077658d2e0007dcee4b9a40f45f923707db3d654b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903066, "uuid": "1824a432-56dd-4361-86fb-2918e24da0e9", "comment": "Malware payload (Tinba)", "value": "b68dc225160442f5b356478dbde0ebafda86c5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632903066, "uuid": "5b76559f-4628-410c-841b-343e6e08bb3e", "comment": "Malware payload (Tinba)", "value": "a60c495affde4dedba4b8c3b17df3c4b49ae37cd8418bc815d49d3b60888ae8d07efe9efffd05efcc4c0d6de30f7d8a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903066, "uuid": "559749b6-8398-43c5-9547-a5900a8e863a", "value": "T1E023E031B67A2847F4EA5C30158BA6742655FD4E1271AF2B1A3472DD3EB4392CF8380B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903066, "uuid": "77fa4460-bc6d-40ab-b8fb-31d397477ffa", "value": "f3b40bf9ff52656d4798070bcd1b25e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903066, "uuid": "4ed8f32c-c3c9-4c92-9286-034c59ea054c", "value": "768:5twyMe0Jy8xwd117mrlI9m/xGuv4V7RMEnqt9jn2ACH3hLZ2HwCLlH:5twyedxwr1qUMv4VV6j2A83hVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632903066, "uuid": "bd9f9ac4-123f-41a4-9767-084d6efede2d", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632903066, "uuid": "b7ee0c7f-0aeb-4589-8b02-b3d7c776ad31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632903066, "uuid": "544350a3-def2-46e0-9fcb-55f9c5de4ef3", "value": "f5e8e874009616b7110ace2077658d2e0007dcee4b9a40f45f923707db3d654b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0424dfd6-20d5-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1632885981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885981, "uuid": "7a49e3b1-5f98-4070-a96a-39e4db874b6c", "comment": "Malware payload (CoinMiner)", "value": "67e072aba19c05f74cf7b9319d7fbd42", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885981, "uuid": "8039fe23-8bca-4a3f-97f5-ea1dbab785a3", "comment": "Malware payload (CoinMiner)", "value": "f5f9d1912e786c71c2d174f198266ad2566cdb7d3a3ac99923f7baec5ffba26e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885981, "uuid": "e7fc4bf1-8fb8-41ef-970c-ce3b5e59e461", "comment": "Malware payload (CoinMiner)", "value": "c42df11764a444e132146d367525608d4bf660b6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632885981, "uuid": "bb29848d-5a7f-452e-8299-f75270c4f4b5", "comment": "Malware payload (CoinMiner)", "value": "2350da5b9faf1ecf094d22f6684020d6355b3d26b00a25adaed4bc06c1ba976a8bac1bbda57ddf44efb6576837af7dad", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885981, "uuid": "2d2c21e0-f619-45a7-a6ca-4339ac03adbe", "value": "T13D04BE00B194D6F1C317007E6825CAECE53EB96DEFE06677261425CFAE39AE37121352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885981, "uuid": "f7bc60e3-352b-41a4-a0d2-1f1641de5e54", "value": "d34c2e9386a3eb95da4c6fd4346f4c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885981, "uuid": "636fc10e-6f62-4ad5-8d08-5e3daa25030c", "value": "3072:4jkQUZ88QKIBnX3ZNe3uy8BDrcPI1ZeoWAfID8EuSzQz:4jwNZYX3ZNe3J0cPI1LE1uSzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632885981, "uuid": "606660ca-a3d2-4a8b-9f13-34577901fc9c", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632885981, "uuid": "e6d2728d-d187-451f-8cc0-b1d50678c617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632885981, "uuid": "163fe40f-8ac6-449e-b6c8-d633568769e7", "value": "67e072aba19c05f74cf7b9319d7fbd42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b617f9b-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901455, "uuid": "41643074-8c1f-41d5-8232-34026911f453", "comment": "Malware payload (Dridex)", "value": "3d7661ce13392d7689517101f2a50fc6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901455, "uuid": "d79ff59f-4570-4277-8174-603fa272de30", "comment": "Malware payload (Dridex)", "value": "f6896569d27399ae8050f9d4096674ece87f2ba7919fb9026d6c5adf23cab4fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901455, "uuid": "bb003c03-dc45-45e0-aa27-a02858b7bef9", "comment": "Malware payload (Dridex)", "value": "f4d1718c3cc04c932b1764a51b9c26f35d18ad1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901455, "uuid": "89553156-e265-4696-8794-3e7025308098", "comment": "Malware payload (Dridex)", "value": "6dbde1f2990654889addeaf8dfac3aeef9f9055ce55e567882bd306b135286991b9557fd81dc003bc777a736bdc44507", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901455, "uuid": "c746a62e-e921-4d59-939a-de5ef3baa828", "value": "T13635E054B6B7A1CAC4A76CF6EDF86D706A522CC3623047A1CE02D1861B751F4CDF2A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901455, "uuid": "27ae8b9c-c0bd-4b95-805e-23b76eafa030", "value": "c6b4c2eec8a93016c63563421e15f011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901455, "uuid": "08add867-c6f1-4e34-8be8-74648bfe9ad2", "value": "12288:udMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:YMIJxSDX3bqjhcfHk7MzH6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901455, "uuid": "0e49e597-05aa-4eed-b040-525482879539", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901455, "uuid": "ab166896-5773-4314-b474-4e4a31b2aa13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901455, "uuid": "272c303c-c14a-4816-9e63-003f15078c62", "value": "f6896569d27399ae8050f9d4096674ece87f2ba7919fb9026d6c5adf23cab4fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d370918-20f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900599, "uuid": "7f33b511-1ec8-400b-ab70-6492d34ae477", "comment": "Malware payload (Dridex)", "value": "90b069c8c7a2397930fda5b3fcee9ef1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900599, "uuid": "88a0b534-7ab4-4a66-9add-4b5f26318516", "comment": "Malware payload (Dridex)", "value": "f6e044ea925404b953493d7868f23add49de4ece9ba4811d58386f26c622ed42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900599, "uuid": "4f42a4b7-1f82-4f41-91b0-ffa50990dc60", "comment": "Malware payload (Dridex)", "value": "e442a1295d1821658b1f2d67534fa9110e7dcfad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900599, "uuid": "457cc116-5d70-4827-b7be-9e8ec2ec2122", "comment": "Malware payload (Dridex)", "value": "db511923e0d93765ea02a32b3c6fc287c94821ff84eb7d49e03938e4bd44394fbed42db982239821659e81c4510112fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900599, "uuid": "7873055b-c645-4502-afc2-47c49e93945c", "value": "T13795E020EF69E1E6C6B89F3E9408352717F93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900599, "uuid": "a5eac9ee-93e7-4a15-a16d-86aa827c7410", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900599, "uuid": "cd4a3e75-cdc6-4776-ad78-80c125859538", "value": "12288:zVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ifP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900599, "uuid": "15d1af90-4624-4474-b312-c9217ec5e656", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900599, "uuid": "380b34a2-d9ff-4564-b5ce-764be126e2d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900599, "uuid": "0061fa79-89cf-4678-a6eb-23fd05e96729", "value": "f6e044ea925404b953493d7868f23add49de4ece9ba4811d58386f26c622ed42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ceda9b-2123-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632919784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919784, "uuid": "7fb76432-b742-426a-b114-c3609c00340f", "comment": "Malware payload (AgentTesla)", "value": "997c316b95378109bd7ab7fda2763660", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919784, "uuid": "b07c7a89-5bfc-4584-8e0b-feb63d22755d", "comment": "Malware payload (AgentTesla)", "value": "f70255da544f5a7d3bda1f13d51280290ee8223cd3fca4a21745af36966c0ed0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919784, "uuid": "d85e629c-9b71-48a7-a734-416730d0cfa2", "comment": "Malware payload (AgentTesla)", "value": "061f13c409fd3e72f4ddea88a3209e4e09b45c06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632919784, "uuid": "8ad04d23-3f51-4523-b741-da975bc5939f", "comment": "Malware payload (AgentTesla)", "value": "23b19db3e53aae508274d4a3c9399610b1f9fbfea754a6aab66f2ef33f72f47ed66803ef563ae9fbe2c9ced5c85a2fa5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919784, "uuid": "71259837-1dd8-419c-83a6-f265adba52b0", "value": "T110158E394D2682F787EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025770FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919784, "uuid": "f875ed40-4ddd-43ad-a247-83f5960566ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919784, "uuid": "9a9dcb87-e7f8-4814-acf9-25b03f7158b5", "value": "6144:1qp+z3f+FzrycfbizXMd2wahj/E9qKNL+a1CPpEAg8+zEpVoZlviYqwQol57wh3D:gpS3a/iLMIopBCxEv1+Kvvifbol57oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632919784, "uuid": "aa85171c-c0f5-4cd9-b14e-4d49007ef371", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632919784, "uuid": "1992b4ea-40ef-4d3d-9486-c05e885c0dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632919784, "uuid": "14b02a4b-35e6-4a52-bbd9-c387271387dc", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a261785b-211d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632917170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917170, "uuid": "59f606f3-176e-4310-a925-99e75ca17025", "comment": "Malware payload (AgentTesla)", "value": "a9adcda7a188563372228ef29e2a2e34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917170, "uuid": "8c7f7afe-ae9c-48b0-a172-68e228d6822c", "comment": "Malware payload (AgentTesla)", "value": "f753e1523e1167178475d9e61e651d99ceab41964845d566a702de250fc65596", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917170, "uuid": "6df9227f-e73a-46dc-9ff9-4ddf82401f2d", "comment": "Malware payload (AgentTesla)", "value": "6a5d0b6829cc094578f23aea43cd4b04a22c1bda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632917170, "uuid": "104d5d3a-82f7-4eb7-868f-301f9bfb55e4", "comment": "Malware payload (AgentTesla)", "value": "8435b7b890008bf53222cc93dd18d18ff50213d1087524cf4d87230a9a0ea8ea00bd55906d2cf3f9218a44adf268ecf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917170, "uuid": "7faed872-d6c7-47d2-b7fd-759a3ff78c9d", "value": "T18DD4121E3458A96FEC1F0938F882984421F85C566C96E78FACC479DB09773E4171F2AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917170, "uuid": "d41015a6-f043-42e1-a21e-befd238e9dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917170, "uuid": "c5fafa73-00bc-4ab0-ae65-2e41afeb9bcc", "value": "12288:gKzC3RL0F/uWdzCC9Ww0oGiTSRgedMwK2K9lsKYM/BvXaOWQtaf0cC625q6yJ:zGBL0FVzCCow0RzgedMwWrsKYMprr3WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632917170, "uuid": "aa00ede9-adf0-49de-9d05-b27f20bc0587", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632917170, "uuid": "e66be32e-60bf-4f86-8612-180b46e478d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632917170, "uuid": "04d92c76-74e8-4e75-9268-3acccdd06208", "value": "NEW_ORDER_LIST1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5879b9e1-20e9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1632894712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632894712, "uuid": "c2a59b93-3f57-434b-9a95-75fca8135e82", "comment": "Malware payload (AgentTesla)", "value": "f86bdabdad32013d40a1df081985cd52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632894712, "uuid": "0ee4171f-c2e7-48c6-ad3c-2d9406298682", "comment": "Malware payload (AgentTesla)", "value": "f7e23df2027195ee0a30647e149bd79cd77eccb8a1d82cd38cc74b364ba94a05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632894712, "uuid": "d4a49cd2-4572-4ca6-928c-6d9fdfe46d99", "comment": "Malware payload (AgentTesla)", "value": "2a2c8c99b04f8d2e000ecd015d8a2d8190638934", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632894712, "uuid": "8b688138-87cd-4605-ae27-a6e2b507b5c1", "comment": "Malware payload (AgentTesla)", "value": "c7cf22b2312bb806b6c995c50ccda51e78515fe23eb62586985faaa8227f5bc5ce1a7a1ac52137666b6214deed255ac2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632894712, "uuid": "cadaf2d4-7516-419c-8ec1-3214525b0432", "value": "T106157D394D2682F787EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025770FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632894712, "uuid": "81ebca06-b74b-4836-a83a-5b0ff8727240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632894712, "uuid": "19be89a5-fad8-4737-8d61-454b62beda39", "value": "12288:oF6sdiuvexpOPwGo00Z9Ec0S4sfzvvGx:IdiuSN00PEm1vGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632894712, "uuid": "b424a5ce-f91f-4cd4-8f3c-3e7d60686300", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632894712, "uuid": "00345ed1-aaa5-415d-9ed8-7097aaa28265", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632894712, "uuid": "d43a7676-696f-4981-b36b-5b4529918514", "value": "New Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37958c41-2168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632949203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "25888cc8-b572-4611-98d7-fef21dc918bc", "comment": "Malware payload", "value": "51d73d86a25984b23f40845bf23dd4f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "584f2d4d-ece6-4dd3-b200-60424f0b4c0f", "comment": "Malware payload", "value": "f81a41238902cc861b38f5ac5ed2356f952419deec85a69fc6358a9194ac3660", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "35373c32-7e98-4e3a-b2a4-a97d34de7bd0", "comment": "Malware payload", "value": "b35c3e8f5a4f968abcd638eda8450558625ef47d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632949203, "uuid": "2f7ccbd1-b193-4e16-9090-7bc5d9b8296e", "comment": "Malware payload", "value": "8c436b4a94e7fab8bb1d859d9acbd9bd9dc4cab51ac8752502d0e95e5ca9a18c67303a9a265f343726528951f04e1156", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "27a81a93-624a-41c2-9d7e-39672de88cff", "value": "T1EDB31845F8418727C3D327BAE78F478D3B36579467DB33116938BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "0352ccfb-e249-4bd9-8426-05b6bd501c21", "value": "3072:MSY+46m1qOzssRFPnNdDmkZrQAhPDCXFke:06mgOzJRFPvmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632949203, "uuid": "d3c49b34-2c90-442c-9a6a-2d4621f72832", "value": 108423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632949203, "uuid": "e988aa6b-2191-4e3c-b1ec-bd666d4f49c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632949203, "uuid": "e5d18bef-260f-4946-8bec-a14b6bdf301d", "value": "atxhua", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db6f66d-210a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1632908787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908787, "uuid": "eaeb421c-00c0-4462-bb3f-bfb725220117", "comment": "Malware payload (Formbook)", "value": "dcd899bf5d9af57ad39c135ccbc24085", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908787, "uuid": "8cdc86ab-5d4d-4ef1-a00c-7c3ec569473e", "comment": "Malware payload (Formbook)", "value": "f836093baf3255830126881722dc2edd86fd615fc922f86d177b0ccb0e3d2941", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908787, "uuid": "28817144-f681-4a23-9227-02409ba025a0", "comment": "Malware payload (Formbook)", "value": "2ebef2b1b65fcd51ee662d3382128321674b5c78", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632908787, "uuid": "3e2ca952-7dd4-4c54-82c5-596c63e47f3d", "comment": "Malware payload (Formbook)", "value": "6481df4a216127f836402818f2fc90f7193efdcb1d74d04acd952299b35e0b9ca49363ea6ceaa19117cf862127bf7958", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908787, "uuid": "6b7b2587-717e-462a-9a10-b1da250e1095", "value": "T1FC84BF263BA9D90FC9E48A347AABC212E77DDF9243F7060623E534758EB444D38431B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908787, "uuid": "824fad78-412b-49f6-83e4-eb8d926df3f7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908787, "uuid": "b192ce11-dda4-42d8-a891-d48a6a860bf9", "value": "6144:68LxBbme9stOoSsDW1rTV0OiR9ocRjZ1qbsffOyUdBOEr3JMBz3Te1:MPDSsDW1d0Mcf14saBOEVMBDTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632908787, "uuid": "e78fd027-2288-4f87-bbac-b8517902f9d4", "value": 388479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632908787, "uuid": "60299e9b-eaee-43cd-8608-e84d549be850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632908787, "uuid": "2cb64dac-3016-45ae-bde1-a98f62097e40", "value": "cat\u00e1logo de productos2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a2bbca-2162-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632946540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946540, "uuid": "61e8613e-8a33-4a26-b183-24745421777f", "comment": "Malware payload", "value": "e15b9bef5d1c00ae80ac9ed86d5ffbaf", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946540, "uuid": "97f4a4e5-5afb-496b-813c-ab4d361618fa", "comment": "Malware payload", "value": "f8e1d25c4e9db3f3f633afcdd8ea2ec55b711e2289457d6ecb3f1b7437169f2a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946540, "uuid": "cb9e98dd-1664-470e-8603-2a88cd231d95", "comment": "Malware payload", "value": "c1ec34be319e4815b35845ac050a547bcfbef502", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632946540, "uuid": "2a7576a7-3b88-4ece-9f6b-b05f2bcd6bc6", "comment": "Malware payload", "value": "4284d5bebee98ff40ac368b60ee34e71859e7a4edc6059fee6dd41699fefb234552921f84e10f15a4ab9e6fedae28424", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632946540, "uuid": "c40538f6-f09c-4bdf-848c-9a1516f52afb", "value": "T1E5F623C6F7419A69D9F743314B310A21A737AC288FDBC24B9858713C5873AD02F5AADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632946540, "uuid": "d892f204-89f8-499a-ba59-308896342a6c", "value": "393216:BGQcEiRrSXHxBPr5y/Vu4GhjQqgRatjH9bcgrtyd:BGQcEyraNr5yjzXKjl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632946540, "uuid": "8c74a132-ac15-4048-8d0c-c6034c6aaea2", "value": 16310143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632946540, "uuid": "94153135-4163-4bdf-beca-3963090b617c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632946540, "uuid": "5cb26f42-7721-48ad-b08e-c3262b7d9368", "value": "lk0927.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321daf44-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901520, "uuid": "560e0d80-14b4-45cd-b47a-4a6109078e88", "comment": "Malware payload (Dridex)", "value": "b164274a209b4b248fda78fadc18bf5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901520, "uuid": "3b158ac6-a7b6-4c79-b7d8-faaec08175aa", "comment": "Malware payload (Dridex)", "value": "f97635d20036450cebf8d8e28ede43ee140b5ff5f6ff58ecfeb81549bff026f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901520, "uuid": "7b788e27-fb53-4e58-b527-1b13bd77a53d", "comment": "Malware payload (Dridex)", "value": "6dd19450176b83caf8cd556e96d46f3fac23aa6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901520, "uuid": "095d5111-b486-412d-9b00-2f45a0bf5a4e", "comment": "Malware payload (Dridex)", "value": "2f9e7cc33213a5fb69ec903c756b5ec61cae9d4113bfcc1fc30a56c0b93f0baf5af96b79f50353cf91ae3b9238f887f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901520, "uuid": "2353803a-f3c4-43a4-950f-b7de6af6371c", "value": "T17C25F10EE796ED7AEF65E3F4894E9CC27D5B0BC2157B0AC3AA4C71880D0B04D2B26755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901520, "uuid": "99f02927-955a-4f2e-aab6-92b1f1fd3dd3", "value": "a0b4ca2a15e3731e4f4ae67579f175c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901520, "uuid": "938e3319-4448-4d71-ad41-ce329422a997", "value": "24576:NIuIxBOQNcKv8RtflMQazYZPT29BL0qNsX90n:i0+YZr2DR6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901520, "uuid": "5409964c-da2d-4896-97a7-92d9af017e3d", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901520, "uuid": "dd128ac9-d4af-45ce-b9d9-235d5dc38b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901520, "uuid": "a47d94e6-5bb3-4d33-90fd-163892a75cdb", "value": "f97635d20036450cebf8d8e28ede43ee140b5ff5f6ff58ecfeb81549bff026f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936dcf95-210c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632909843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909843, "uuid": "98cfa24d-8b17-4404-b0e0-4f4b5e6d02e4", "comment": "Malware payload (Mirai)", "value": "ee033f04096f645cb564779ab1dd6136", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909843, "uuid": "bcc6f7a5-bc20-47dd-aae8-a14f9d207a20", "comment": "Malware payload (Mirai)", "value": "f983fa41c37face49cc48c4bb48ab5937781c6feae064aef29d313a73dd18466", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909843, "uuid": "9823bf36-5a9c-4e3e-b418-36b5e1dc9f6e", "comment": "Malware payload (Mirai)", "value": "e569df4c55bdb519f4bc953e380c5980a0efc1a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632909843, "uuid": "281703d0-90ba-4544-99b5-2500e48f7924", "comment": "Malware payload (Mirai)", "value": "d28f164f55a3b5b4f8be3d410ec11751a331c64d64fcce368c8f7b6ac26e18d59c41877144f772a432742a1e71bffddd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909843, "uuid": "c42c3557-2620-43c4-96f1-61008fdcde7f", "value": "T101732841B8D29A56C5E423BAFA6E40CD372163E8E2DF7217CD215F1037C682F0DA7A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909843, "uuid": "1ad4e5ca-35e2-4d55-8955-c007029cb2ea", "value": "1536:QrpQ8zfYO72TlT0OHZsRk6tOTWuVN38V7wOqAASaqtmZbn2gJs4:QrpQGt2TrO08xwnxog9npJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632909843, "uuid": "a43336fd-aa24-4dca-bf10-e30c4339c345", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632909843, "uuid": "3c4d08a4-4881-440a-8081-82daa21e7919", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632909843, "uuid": "adc07649-a179-4cdb-91a9-5458f56b2c1e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dd3c36-2132-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632925955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925955, "uuid": "fbbd97f3-aa1f-4bcf-ac9d-8710912d916b", "comment": "Malware payload", "value": "c7d01ed64a4e34c129f3e80eec62dd90", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx86", "colour": "#700144", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925955, "uuid": "f91544f2-9b4c-4c14-af2c-5ffe0da9b6f5", "comment": "Malware payload", "value": "f9afc132aa170191d1b23e949a88228b0a9dd1d995cbf5fd9cfcddcde9fd09a0", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx86", "colour": "#700144", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925955, "uuid": "a86b8d60-4205-47b5-9c17-34bbc75c7fcc", "comment": "Malware payload", "value": "0b8623938523a97cb79ce119759511d297177f0f", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx86", "colour": "#700144", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632925955, "uuid": "67ad3d42-3e2e-4d58-9893-0eb92a65c59c", "comment": "Malware payload", "value": "67f69aa3c32954ad448f894c5a9aa00856e724c5c1808d7c14fac28ae10f0edb5b60b06033ae90034e42fbbb4f00768f", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellCobaltStrikeBeaconReverseHTTPx86", "colour": "#700144", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632925955, "uuid": "5f5a6c68-40f6-48bf-b5bf-57790a52ef99", "value": "T1C82160793E125294B82E85D239E122A43C1116B37BA55988B6CCB96FE1F81E46A75060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632925955, "uuid": "04c0b380-7530-422f-8acd-3325d9c923b2", "value": "24:hq6LzGg7gbClX0B1qu/lfC9gzVBZO4eNUVBe3wV78OvMAS98ha:rGIJNQq4lqSVbOwVwgLvFOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632925955, "uuid": "49db1db9-0783-4f90-a814-a5657660c6c5", "value": 1117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632925955, "uuid": "44402814-01a1-492a-817b-10f3c3dfbc4a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632925955, "uuid": "272720a5-9b92-4c6a-9dca-eabcbe29a613", "value": "UmLzWYDk.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc11c329-2135-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632927575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927575, "uuid": "436aa39a-cd60-48c2-a9cd-c19465982a62", "comment": "Malware payload", "value": "1fea91e3debf7c3115cd97b8be64da57", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927575, "uuid": "462dd2a9-8b4e-41d9-80bf-d947ec6bd872", "comment": "Malware payload", "value": "fae6a3048e91247206a42ee5f9261b9602afc2bd7fd8665f5a08b82c517a1789", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927575, "uuid": "bdbe3e0d-1ba5-41d6-a468-e76f138dfbf6", "comment": "Malware payload", "value": "dc1fd88108a94cea7d802f9e8ab20c8d120c7602", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632927575, "uuid": "91752bf7-f545-4c52-8e54-d54432755e86", "comment": "Malware payload", "value": "ec3f1964b75e64050955f6e28407d8ea635dc26fe5a306c080c2d1f9def084673eaaf190147799e34884a233fe5c40de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927575, "uuid": "864d0c05-b0e2-4987-aa7d-289544affc97", "value": "T113825B91EB71C4FAE27600F255B258BCB81EAF87138500E749D80D2E5E8DADB7E32D51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927575, "uuid": "6e85c451-a140-400d-aa19-31095e65fc48", "value": "ba48bad107ae117de4ed3d130b43bf9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927575, "uuid": "345857aa-c21a-452a-b7cb-bead27185dbb", "value": "192:URhhmPEsFixjhqvuUJAWl+Mpw/RD/MGPMGYUJU79dumdoHDu7nWiDiOb+2pQKa8o:kvmchx1q/ljSDPfjQ9dKHa7nWizymfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632927575, "uuid": "0fecffa0-7aad-49d9-8f9f-1101d184a494", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632927575, "uuid": "b5d03e11-cbcb-46b8-98a4-1397d320f152", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632927575, "uuid": "e488964b-c172-44c3-b824-4d437c245f68", "value": "SecuriteInfo.com.Trojan.Inject4.16715.26711.18425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed83e6d-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632898400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898400, "uuid": "de4c74d0-9d84-4d52-8a0f-b576602479df", "comment": "Malware payload (RemcosRAT)", "value": "27feaadfb2b9d1253ff2ab4167caebeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898400, "uuid": "c53e407a-bae9-48cc-a4c7-edb31aeac8a9", "comment": "Malware payload (RemcosRAT)", "value": "faec6f7ecdb79531edf3c1bb871a71d923a51b18aa5955d3ba804fe7ac598518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898400, "uuid": "8e655075-425d-4026-8074-03b2a3237683", "comment": "Malware payload (RemcosRAT)", "value": "d510d70d70be8fc0b2ecd42378b7ca203c4d6e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898400, "uuid": "f66c772e-987c-4a6d-8f6b-648355e1af57", "comment": "Malware payload (RemcosRAT)", "value": "8b5dd24b2cb2bb5b7179d613a50e4d8066394ef48317211d18d3f46ad9919ac3ffb62b5e62520edd29faa975613e14c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898400, "uuid": "88d39d38-5106-4ed9-8281-c5f370c309a4", "value": "T1C5163324B03C65A6EF1ED3F02AFBD2F1437EA593615E6A1CEAA361C44C11B059C9C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898400, "uuid": "54b57d16-14d3-4278-8a31-044d66a1f5d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898400, "uuid": "33358c5d-d995-4c80-84a5-10d5f4fecf33", "value": "98304:T0z3CNHe8Tf3NN8T5NIDPDGKVoNb6jGCmfR8rteT6eVmjSHBT/H:TQCN+8Tf3/8T5NIDrpVo96j+AiVmjSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898400, "uuid": "d69f16c2-56c8-4025-a94d-edc281811172", "value": 4204032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898400, "uuid": "4cb1b474-0f6e-4fcf-ac0c-ea8bb8eacab9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898400, "uuid": "c6f52c7b-c265-4275-94b7-85795e71e5dc", "value": "faec6f7ecdb79531edf3c1bb871a71d923a51b18aa5955d3ba804fe7ac598518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8b4ee5-20f0-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1632897913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897913, "uuid": "1a9da765-b514-4786-876e-5f2b010ce84e", "comment": "Malware payload (Loki)", "value": "e609380f3a43a129672a4387f3c56f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897913, "uuid": "d69e7688-c2c0-43a4-99ae-f6520c112945", "comment": "Malware payload (Loki)", "value": "fafa23d7f65e8c5ae81556735ec087e23292e7aaee76598a97a6883c4897799c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897913, "uuid": "23598b50-ed58-47f0-be16-b084919540a4", "comment": "Malware payload (Loki)", "value": "74106024ab9c721943153f5db738e47329659aea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632897913, "uuid": "6e5c3eb8-2d17-467d-8a63-3b4c21350238", "comment": "Malware payload (Loki)", "value": "2ca46f71c1696b78de10ee9393d8242c594d1902c66f33b07b01fc4e35c7cf8fa80752c5dff88081c22ee86069a3f9d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897913, "uuid": "d0bbeee2-4645-4536-adf7-22d7a0c1b784", "value": "T1B6057C2AB60CE65AFD1433F02124BCC411E81C981C6CBA17B97676EAF4B9D27DDB405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897913, "uuid": "d172b4a7-5737-45bc-8fd1-8d53a6422763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897913, "uuid": "6efbc742-0c87-48b1-b44b-e11660f8358f", "value": "24576:9D4VHfQe6ZyWshg+qbZxTZZWunAWvj3M3DkhjfP4gc+9g5KF:vD4ubPz/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632897913, "uuid": "2611000e-84ff-49e1-a69d-f033f1e5dc13", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632897913, "uuid": "21bca539-de06-4b66-a5bc-056b3d175ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632897913, "uuid": "ef2f1063-b927-4b3b-92fc-5dd188564330", "value": "FedEx Shipment documents_AWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66183ae-20f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632900560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900560, "uuid": "ccd6e461-566d-4bd8-be4d-1727a5d72385", "comment": "Malware payload (Dridex)", "value": "01253cb90896795344709e565d5c0148", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900560, "uuid": "e6d2feb1-724a-4f24-b37b-c1854230a4cd", "comment": "Malware payload (Dridex)", "value": "fbe5c327747783c6787ea289392e3361cfb229f7d5099cd96d474265c2f4fed7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900560, "uuid": "749ad2ed-7ef1-4247-b964-f8ca31c790c6", "comment": "Malware payload (Dridex)", "value": "e24392265b9f452f5dc9c1bd349b7e7c787c3b91", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632900560, "uuid": "281ce345-e3c8-4010-b55b-1e8713a2a214", "comment": "Malware payload (Dridex)", "value": "86c050e961b93c0f75d8974c54cfed23c40531d9f9e849cace2543da0edf8334d4ff53080a214d85905dc2c115625e85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900560, "uuid": "3b9ae723-0c5a-4096-8181-53fe36220af4", "value": "T13C956B10FFF205C3C09DF739788D3415B2B3AA65811F8A5D824F131E6CA5B912EAE95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900560, "uuid": "690d8240-335c-489e-bcb6-6779d166e51d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900560, "uuid": "9b1e2fa0-4c54-47ec-bb32-fca006a3fe8c", "value": "24576:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnbTmE:5DW/e+WG0Vo6CtSnvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632900560, "uuid": "ea5e192f-f33d-4ee2-8ac4-ac47651dbd12", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632900560, "uuid": "9ff2cfd9-2860-45ab-bd5b-b3bfcf40c21e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632900560, "uuid": "d3a2a786-044e-43b9-a89e-290b7846c2f9", "value": "fbe5c327747783c6787ea289392e3361cfb229f7d5099cd96d474265c2f4fed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be5fb1c-20f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632901160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901160, "uuid": "d74eda06-abb1-4985-a4b6-72a130b4c05e", "comment": "Malware payload (Dridex)", "value": "bd9c74a8436c91d4ca46aeb5dbfdacce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901160, "uuid": "7fbdbbf7-db52-4eca-8464-f4d95d38ebaa", "comment": "Malware payload (Dridex)", "value": "fc926cad08c8bccc70d5ed03e5d7813ecd107e0a6639bcc7d4d296cb5ca45564", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901160, "uuid": "3f56e369-c84d-41e4-b340-4be36813325a", "comment": "Malware payload (Dridex)", "value": "410b65b4244483dc5c066f3cf70893bdc5357943", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901160, "uuid": "ffc9c727-1ae7-4c67-8294-e065b8e67c0b", "comment": "Malware payload (Dridex)", "value": "e5c2d613182656da15f64cc0544d576efb6fc9da45454feff4281d8dab6b0f2a266dd164c0c8b577bf5130bdd2f0af6c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901160, "uuid": "f212bf92-cc1a-469f-8a7b-57543c70e3cd", "value": "T1A185D020EE69E1E6C6B89F3E9408352717F93D75110D608CC392708F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901160, "uuid": "49a448e7-029d-460d-a5f4-84714ed995c3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901160, "uuid": "f19b923e-5487-4171-b44d-2035b2b89bae", "value": "12288:cVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ11t:pfP7fWsK5z9A+WGAW+V5SB6Ct4bnb1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901160, "uuid": "fdd7b3c3-1a1f-4b15-b86b-44999e481e3d", "value": 1822720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901160, "uuid": "d2f0ce84-a2dd-4b9c-b49a-bb0fb46fc119", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901160, "uuid": "fd48a737-eefb-4e9c-a106-884f738887c0", "value": "fc926cad08c8bccc70d5ed03e5d7813ecd107e0a6639bcc7d4d296cb5ca45564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0765dc-20f5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632899842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899842, "uuid": "6bcff3cb-b9b6-4590-a976-3a0708029d8b", "comment": "Malware payload", "value": "bfe77b9267c968501bd7ebe31e4c12ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899842, "uuid": "6ed79a2a-ba4e-4efe-8158-1ee9b33c02d5", "comment": "Malware payload", "value": "fccbac4760c07819a29dbf1df5d06aa8de89f34cf41b77913e6c2d3fbe578060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899842, "uuid": "58be4b32-a145-42aa-b122-d97a23bb9bb4", "comment": "Malware payload", "value": "649ceea43cc1b00dd4630fa16ba3f37be5f8803d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632899842, "uuid": "0b901716-fafc-464e-9f97-2f2f3fde5382", "comment": "Malware payload", "value": "eb9bf86ce08c7fd56e1924472e01a62e241fcd1dc863ce340a25b567a7bce7652d2507878f090579be1f4d03e3e3466f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899842, "uuid": "65aba1ce-a61a-42ed-a258-d5985a9ea338", "value": "T141053B72E3804CF2D31626B80C3A565454696F327E5CE48E6DBC3DB63D3A291743AD8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899842, "uuid": "c9b080dc-8d95-40ec-95ed-a3e4565dbb8c", "value": "f0c25cd198950ba1bc931e9bf4f4e5f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899842, "uuid": "d53cd913-cee6-43d7-981a-afd54c587a7c", "value": "12288:02DA+ebuMqQ/5KIXmdLwWZsSOarJsU0QLS7TnUEw/XNkYEQPC:C7FJ/5KIXmNwWZsUraU0QrfN7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632899842, "uuid": "59283439-fe28-4cc0-ae0e-54d2372d3dbc", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632899842, "uuid": "788884f4-f51e-49d2-b6d5-68b4ad7f188d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632899842, "uuid": "33218943-88fd-47fe-960a-d6fd025d168c", "value": "PO-RMS74OM PT Chrome PVT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e84b687-20bf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632876603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876603, "uuid": "6b2305c2-6955-4cdb-9a1a-bb4756b981fd", "comment": "Malware payload (Mirai)", "value": "a92b2ebfce0047cb41c964af24e3c6cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876603, "uuid": "889c9ada-1621-4c2c-9eae-f1a9adfb07f6", "comment": "Malware payload (Mirai)", "value": "fdf8038b5221e9320ed10214c082333eeedf306a8f87c537a5ad14ecbb4910b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876603, "uuid": "5e770500-f938-44be-888f-6da41070b082", "comment": "Malware payload (Mirai)", "value": "ff48ced5b362555f5547418f19fa07fd7dcfcc77", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632876603, "uuid": "f9a0a0b3-6dae-4dbb-b0c8-31a3d3b3036e", "comment": "Malware payload (Mirai)", "value": "49e194c50cec860fa756c11fa0f1b8a799de33eb95a0e7dc4027defbc537b3355eee59c1ce710cecddf66eda327143dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876603, "uuid": "d477df64-c3ed-4463-8ad7-98b56f2c66f7", "value": "T178F20254C4EA6F9BEA4994334CDC758C0194A51501AFBCAB112114BF89E2F3BA33F7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876603, "uuid": "0afc162a-b68f-4e7a-8640-9f965055cb43", "value": "768:kkJbEXnNd6L+X/6Mk+0fYduwf8zlFhRjMhfrhrS1+G9nbcuyD7UHQRja:kkBEXnLQ+XJ0fBwfeFhsrhm7nouy8Hyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632876603, "uuid": "63a52b2f-72a9-41a1-83ae-d38d5b6e984e", "value": 36128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632876603, "uuid": "96a33169-4c72-4193-94a6-edd539abe3aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632876603, "uuid": "041ec25e-7479-40f6-b49c-2f6ee8faf417", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88efc05-20f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1632898417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898417, "uuid": "e4848159-9da7-4966-abea-8dfadbe928f0", "comment": "Malware payload (Dridex)", "value": "1aea2179362c228e8285e6a5f37d8962", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898417, "uuid": "37e5924a-0668-49b0-b704-b5289e9fb93b", "comment": "Malware payload (Dridex)", "value": "fe14441b9acc889bff1dbd45ac1ee4c9c7691d0cdbad72325e7b6ab6ef8433f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898417, "uuid": "01f6007e-927f-4241-b0f0-a5e83c62dfaf", "comment": "Malware payload (Dridex)", "value": "1fbd24637ef8b8701ded5b36dd86eecd9c4746cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632898417, "uuid": "059d173c-d95d-4b6e-a77b-a48be92c3dd6", "comment": "Malware payload (Dridex)", "value": "d5928ca1fb2cbf8b82f8bdd1aef1f0cad9f4e366240696e50d18c6e2f946f2aabd1a76ae2d24e95fdd2df252323b14d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898417, "uuid": "f014b7e2-880d-4d9d-84ec-c0d576ba69fc", "value": "T11806E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898417, "uuid": "9988d01c-dc63-4c34-95c6-f45c7f5fa96e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898417, "uuid": "6c08e82b-011e-439a-a933-96d35d9e670d", "value": "12288:ZVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:YfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632898417, "uuid": "fcddacfe-4b40-487c-8b6e-441b5adf2c98", "value": 3981312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632898417, "uuid": "101de328-b0f7-4f11-8b91-60548cd27b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632898417, "uuid": "8fa7383c-b99f-4cf2-a7f5-735f030659c5", "value": "fe14441b9acc889bff1dbd45ac1ee4c9c7691d0cdbad72325e7b6ab6ef8433f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e994b3-20f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1632901799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901799, "uuid": "4fbe917e-d18d-40a3-99c2-41546e108d9a", "comment": "Malware payload (Stop)", "value": "1f8c099a24f7397ff6893bcd5b06919c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901799, "uuid": "a117204e-ee72-4fe0-b708-56a867a7ca2a", "comment": "Malware payload (Stop)", "value": "fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901799, "uuid": "0d2da787-1dc9-49d7-baa1-01afcbedf0c5", "comment": "Malware payload (Stop)", "value": "4f7fa55fab58739bbadc3455178fbc7384677b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632901799, "uuid": "ee0b6cfc-043f-42b2-a448-3098f036695a", "comment": "Malware payload (Stop)", "value": "a1a402cd726ecbc9d387f3df5e725cb76c2db9bee33db669851a4b8a76b7e4eb9eff952c6bb338ef0ac87477996373f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901799, "uuid": "9b3d165c-30ae-4092-8dd5-594d4b976f22", "value": "T176E41225F9AEC933DBA7613408FAC365593E78B3DCA74557E18D53262E312808AE530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901799, "uuid": "f3a0be2f-66ae-4495-b068-8b8fa56f29c7", "value": "9c01f3fd8ec8bde8dd4b2a07823228ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901799, "uuid": "2de69da0-85fe-42e9-83c4-12f305f2f3eb", "value": "12288:Wr2WuSIDNj34caQtrkZA6HPN7K2x4eKWIp4hr93NDeYR/8IcPoONv6zBxMsCdqY4:g29+jZ7HPg2ZKpp4Z9dfl8IhONvYqL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632901799, "uuid": "2b962efb-f675-423e-8ae0-49c39d241b91", "value": 710208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632901799, "uuid": "6846e1bb-1641-43ba-a60f-d070ca035f5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632901799, "uuid": "70d7b43d-aa6e-42ad-917c-52960ef41b33", "value": "fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb76e4c-20dc-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632889168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889168, "uuid": "635e6970-5008-4364-a2e1-754584c75a93", "comment": "Malware payload (Mirai)", "value": "4dfd4ba784d0d298c1de616829030b56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889168, "uuid": "e51c68c0-b778-4fd8-ad01-3370701f443d", "comment": "Malware payload (Mirai)", "value": "feec3edc0f55af9b7ce419fb07648db98d0f21d8437b87893ba8754f354c7a8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889168, "uuid": "0ec8f4ca-09fd-4d63-a674-99e8ab648157", "comment": "Malware payload (Mirai)", "value": "03d5be8dae19623ff39a5ec034486fa685aa356a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632889168, "uuid": "56b60c18-1d55-498a-bd26-c3b59d1f14eb", "comment": "Malware payload (Mirai)", "value": "c048ff2343d2303196a46b336e3a13ddd25ff4f05b59c98dc2c36dbbf075b695b20f76067e299194e41e7dd812f38da5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889168, "uuid": "80ad5194-ca4e-4e5c-987c-c2a209592e68", "value": "T15EB2E0A4E6940CD4CEB2EE714E01DAC63B91EFAB21B68D70A09AA635014741F5270ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889168, "uuid": "d13a322b-7556-410c-9c5d-9845a529b941", "value": "768:TdxuXvVBTzq3WZG+Mv8pyoz7f0G4aoW04uVcqgw09j:TytZAWZG+MvMscq4u+qgw09j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632889168, "uuid": "b7ff69e0-8471-4d4e-ad22-865f74224c34", "value": 25364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632889168, "uuid": "ad7e9000-1cea-44ee-9aba-72b98a04c0b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632889168, "uuid": "d1d7a59f-7db3-498e-8e0e-c59f58cc09d4", "value": "4dfd4ba784d0d298c1de616829030b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4efd9b-20fc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1632902986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902986, "uuid": "7356eab0-9f52-4c0e-a680-217a1e0d12c3", "comment": "Malware payload", "value": "ab0919605842c31d998f3a27021d4dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902986, "uuid": "ef8b2cad-e04f-4e7e-aa90-86a7ebf0d4ef", "comment": "Malware payload", "value": "ff464d2218b2b688b4c51188fefc50a1fe17b6818ef54809123eaff285df5822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902986, "uuid": "b0ddb25e-5219-40c5-91c4-c501e151178e", "comment": "Malware payload", "value": "37e89c852d8cbb9dc8ac7ea0a8549717a1ac2d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632902986, "uuid": "1f093021-c434-422a-b660-f69dcb747d09", "comment": "Malware payload", "value": "6e4bf1740796a32e10d1596501737643afe1ed57a80e26fb16ad85a15f6d590839ff5f24dcba6a84e1caab7167558cbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902986, "uuid": "102c8d84-a72a-41f6-b6ad-17b54b2ffe1a", "value": "T1C073C0257F921C08E7F84B3365EC51CA46BFBB8DA9304ACE296E9AE40F37B8455D0714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902986, "uuid": "664c6f53-4406-428a-920d-04ed4e124356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902986, "uuid": "794fe1bd-306b-4ec7-8f3a-d22fcd179e10", "value": "1536:CXe5sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti67r9/LW1VG:ae5sAtWDDILJLovbicqOq3o+njr9/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632902986, "uuid": "9c2f6faa-da21-4df8-a41b-50653ee3cb6d", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632902986, "uuid": "03e1a854-3d0a-4a93-bbed-1cdd3065df3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632902986, "uuid": "f0e10c20-90d1-4dc1-b06c-1c02c528fe10", "value": "ff464d2218b2b688b4c51188fefc50a1fe17b6818ef54809123eaff285df5822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaa58ac-20b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1632873915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873915, "uuid": "602c25f3-316a-44b1-8c7f-11835f576c73", "comment": "Malware payload (Mirai)", "value": "462e0ca872fb3fa2385560d23403e78e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873915, "uuid": "c475dbea-5c8e-477e-99e1-83e09bbed8f5", "comment": "Malware payload (Mirai)", "value": "ffaf03a7a60708f2790c42dd2bc84c10bc31ef88b72f89a7f98cb1c722f5c599", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873915, "uuid": "af4f86b7-d918-4917-8dc5-9ff7182f86bf", "comment": "Malware payload (Mirai)", "value": "db7feda7fa25b80d87286a8f06aff9dcd6371b99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632873915, "uuid": "59bc5822-8495-418f-a3b2-b6a0581bd481", "comment": "Malware payload (Mirai)", "value": "18075a018f3c9984e157db293cd382896ddc7dcdc8ca3ec19fa7e91e698af74a163b5af19403627aed1749aa8827a37e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873915, "uuid": "e0864fa9-7a0b-4c81-b70e-f4d3ab9d3b96", "value": "T1B593AE23C9202D24C1054AB171F5EA369363951691C73EFAE585CB6DA843DDEF226BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873915, "uuid": "cd4abc56-0ec3-4d33-af64-6abe25c7f931", "value": "1536:4PxmkLbgX0FC5++gedRyTd4+2XCCOi3DPYyCfIZJKAsagZYJYaI5hrp:K3bSJYzsyTd4SCnDPYy6AsuYZ5hN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632873915, "uuid": "5e535529-9530-4c01-98ed-31a013b9f30b", "value": 91508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632873915, "uuid": "492eda1a-4ec4-4395-a695-a9e0a054d461", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632873915, "uuid": "7fe0231a-f028-4e6a-be9b-067a6963dce3", "value": "462e0ca872fb3fa2385560d23403e78e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }