{ "Event": { "published": true, "date": "2022-09-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-09-26", "timestamp": 1664236981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "57e70611-9560-47ae-ae92-79ba5a7175d1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56f5244-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215085, "uuid": "d059528e-b327-43f8-a145-aa00b03a59b0", "comment": "Malware payload (IcedID)", "value": "c1256dc480f5399094a9e6cd29b48c4c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215085, "uuid": "f853d687-1838-4803-b564-4080ab0f22b9", "comment": "Malware payload (IcedID)", "value": "0000cee3e4fb7de0585d4184b49f1ed6cb81b01aff38c042d1f9ac9777520bdb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215085, "uuid": "4447aa06-b47e-4ea8-b29e-c85c2478be9c", "comment": "Malware payload (IcedID)", "value": "d92fcbd24745b33b8cf6ddc08e8e8cabc1a84fb9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215085, "uuid": "e31ec4b1-9363-4fec-930c-d2e3c3f67189", "comment": "Malware payload (IcedID)", "value": "fc7a3498163825ee989b426b1094eca9ad4906fdb652435714d478524e75040bb2b555cf942541dbe65a3060ad296fc6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215085, "uuid": "446619dc-cb55-476b-9d39-6ebc47ea07f4", "value": "T11315F005CF40246BF00B683E371365D7F8660C2B308BDE1A6B96516E2AD7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215085, "uuid": "af5c0c8e-29fb-4fc0-a54c-40261799b456", "value": "12288:ebVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEsaG9PhhW+/wPKNS:ebV2jUeQRI5wPN/jphh/wyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215085, "uuid": "bac5e81f-52e1-4504-ad6e-8f322de650d4", "value": 886768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215085, "uuid": "b6e60b8d-58ed-44b4-843e-39daab6a9727", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215085, "uuid": "295c8a13-2a6e-45ce-9dfe-18ddb1cfe408", "value": "johnsmalley-doc-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de477aaf-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (MassLogger)", "timestamp": 1664181196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181196, "uuid": "c0c94448-aaff-4758-b3fd-fdb96e027264", "comment": "Malware payload (MassLogger)", "value": "1a6cd2ff652a3c9c909682a62fa6e25a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181196, "uuid": "8e4290cc-a1fe-4e4d-9872-e97882fd0c0c", "comment": "Malware payload (MassLogger)", "value": "00bcf28771526c2f876a4135520a4eb5a373f6671ea6c94eea36ce2cccbc8e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181196, "uuid": "08c643fe-2e94-494d-9659-317a1412355b", "comment": "Malware payload (MassLogger)", "value": "54a16855a8a48f4f847a0a8ca66a2f26b333b2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181196, "uuid": "f278e83d-1d3c-487c-83be-59a685343243", "comment": "Malware payload (MassLogger)", "value": "0171f30d4d34b84196f51aef8301117034a0c83d9e69f4a7a5407b188c7d0157efa31394d57897962bff1addfc1c832e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181196, "uuid": "00c5d918-75f1-4054-be16-309bed238029", "value": "T1E324CF8176AC6949C96B9F3658818446CB31FC13BE53D34A60FAB33C0F523FA6A5D4C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181196, "uuid": "89506a8f-c72a-4888-a62d-8b15954cd9d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181196, "uuid": "537ccedb-bd47-4e78-af9f-59101cb53038", "value": "3072:8I42jI06VSyw9rPdTlYpw3BC/3MYxLXVnSCLr/nEayyGq:8z7yywlPdhYqxm3H5SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181196, "uuid": "0e317b8a-f626-439e-b259-3c6534ec44ef", "value": 209392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181196, "uuid": "9e738a01-dce7-4139-8552-eba40e9fe65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181196, "uuid": "edbdc82b-1888-4dee-87e9-0faff0b83de5", "value": "_220926_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b82d55-3da6-11ed-9266-42010a9c0072", "comment": "Malware payload (BumbleBee)", "timestamp": 1664202100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202100, "uuid": "36c213ee-0f6e-4365-8bf0-f45519cdadfe", "comment": "Malware payload (BumbleBee)", "value": "30f0b4c68317a320227389dc671e32c2", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202100, "uuid": "c6918a4e-f268-4abe-b5c8-12fba4c1a078", "comment": "Malware payload (BumbleBee)", "value": "0213a0d183b593976c20511515be077f94595a3993bfc496e9c4783a506c147e", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202100, "uuid": "bad58fe4-88fa-4e84-bb7e-72af683d759a", "comment": "Malware payload (BumbleBee)", "value": "4cc428c3355504fbc7fa68ab44c4f8c43938adc1", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202100, "uuid": "1bbc2a4c-8487-4168-963d-93958166d2a1", "comment": "Malware payload (BumbleBee)", "value": "27a6cae80f73d02c6ec101e54e32409b2286bd95f39ca30972a61d88b15a2632f166929b6b1c634fd6c7e1b2fc7b9c8b", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202100, "uuid": "d99753a4-0bc4-491e-b08a-17a7b263a116", "value": "T193C5E1B0464A1231F6EF197A5C9B4F5CC33E1522877CAA1962F0034A0997EAD5D8F7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202100, "uuid": "a4d512a2-dc27-4c7b-9d92-c5682611f280", "value": "30cd8f85b45ce2e61e63c8875a935225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202100, "uuid": "1d770341-17ba-4be4-8b93-0e19c5e82516", "value": "49152:/UV3vnVxDtgL47ZbH8TGN8DC9Vj7iRJrd1skW3/gsykrC+PhqJlT89i3FCQuweF7:SVNtSYZbH8TGNYC9Vj7iRJrbskg/gsya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664202100, "uuid": "730284e1-b790-4121-aa56-dc5f78a72b27", "value": 2617856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664202100, "uuid": "ef898fe9-70b9-4496-8bef-89655e9aae49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202100, "uuid": "1c952eac-ea59-415d-b776-63fb2b85dee9", "value": "StOMW0ci.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630e530b-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173259, "uuid": "36ef69a0-fc57-4982-b290-f2a88169a3aa", "comment": "Malware payload (Mirai)", "value": "532f05b1d1eb7d875608e412ab516cc9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173259, "uuid": "017a5207-4267-4e92-81a0-7d5d371fe7ff", "comment": "Malware payload (Mirai)", "value": "0270ab836b77943ce85ba29c843968c066e0cf4b2c09eeb03b374d9f18bcacd1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173259, "uuid": "2f85e283-4f5a-46c6-b4bf-ae526eda9d49", "comment": "Malware payload (Mirai)", "value": "c0d4357e6edcf2cbe6f610371db0dd1c0096973f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173259, "uuid": "7eb452a1-ab7a-4a8c-9b44-4e6e445f24d8", "comment": "Malware payload (Mirai)", "value": "1b535f3393dee5fd5e4922f747642676d9ea7ae98d9776561de6b6cd53c713fd66d4e51658d29d376bf283662379d7d6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173259, "uuid": "400e3ae0-b4e9-46c6-950d-017df3703e78", "value": "T10833F1D3FE4B89FAD46B4970146DB6C0FEF02016231B2E3F29CD905B8F4B69B6A05910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173259, "uuid": "c18c4017-e609-448f-85e1-0c4aee328f2b", "value": "1536:XL5hTpW3xtv0DaX8eyCsnJVOk09rjSSfd:b5e30quCsJVOFjSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173259, "uuid": "d40a5119-4ea9-46c4-ae56-6b7c40939434", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173259, "uuid": "c9334d5e-9034-498d-9295-35d7a66ec13e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173259, "uuid": "9a1d1d07-77b9-4b10-bc36-6d2f9efab6f7", "value": "532f05b1d1eb7d875608e412ab516cc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56560ac-3de6-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664229688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229688, "uuid": "55dbcd17-aacc-422e-bb60-3b5cdf3b3b3e", "comment": "Malware payload", "value": "d51d143f6d9d11b218cbf9210aa4c7fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229688, "uuid": "c0ef0265-ff0b-4b1e-9a25-b9bd568fad16", "comment": "Malware payload", "value": "0321e96f1546b8e781e765d342e220fbe3cc3780de1b19ff67be9b851a04fe0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229688, "uuid": "f2138118-fb9f-400b-b628-99d9772ab4f9", "comment": "Malware payload", "value": "17fe9a633305e47428b8fd298e2c8d634bbb269f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229688, "uuid": "687785e0-5415-4f95-875e-30750998a5ae", "comment": "Malware payload", "value": "ebdc70ea8f801dc0d7c03f05e08786c6b84b88e709d240d89a9f8f5c4aa4bd5cddbceba86e2d515f8f6a37fcbdc23931", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664229688, "uuid": "deed17fe-d068-4ca5-a86a-e5b85ebde180", "value": "T1BA763353B2FA85B9C36200794F691EEBD4EC4A941D70886727858D9FBCDCA84D03E9DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664229688, "uuid": "2e64ee74-299b-4e07-aece-0dfa3db7e0ff", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664229688, "uuid": "af3c9139-c957-49a2-a74c-9f54ff3c7f7f", "value": "196608:91Ow6HhelptyqAaYCiYf7NI5VvO6HuVKaQ5mGiv:3OwZyqAaYeSfvNuVKXmGiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664229688, "uuid": "98ae0fb9-0214-4964-ba54-ed55b64c5083", "value": 7612258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664229688, "uuid": "bf8ed6ce-3c57-408a-a98a-32ee40e21bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664229688, "uuid": "3577606a-db9e-4273-b82e-44801378cefc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0174ec1-3d5b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664169979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169979, "uuid": "f241c683-ac29-4cd4-8ed2-3c4fa25eb363", "comment": "Malware payload", "value": "b27a11f6d31593c46923b1ac28779516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169979, "uuid": "30fa7874-0163-4839-a7ee-c2763e6b31f3", "comment": "Malware payload", "value": "0349b353e27891e1ed1d05864b0b5133cda4f3c22b11c32a77a35d078b919c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169979, "uuid": "8ab6737c-97e8-4498-86ee-891cd7a83ffd", "comment": "Malware payload", "value": "907d2ab38029b59b1c5cb3319802679a301ecba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169979, "uuid": "fc396844-33c2-470f-843f-0b1b88aeab4a", "comment": "Malware payload", "value": "fea7f57a27691826f3b1a6757ecd89686e32926f38ad0e6ee2f1cba6461ff28dfc89e187b27e0a635963cd504067167e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169979, "uuid": "0abfe51a-4bec-47a0-a6b9-57d87c55b14a", "value": "T1CB76332236C689B4F19642B38D6B5EBE8472F4214EB4D01F93EE487CF63D4D0C5BA946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169979, "uuid": "0b5ceaac-e65a-4104-8e0e-69201f963b02", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169979, "uuid": "d2784657-f8f0-49e9-ad2e-5c7bfaec97e0", "value": "196608:91Oj8GARTRTnqBFa+9kn+xtZcx5NpYGWwcO:3Oj8vfGFPuEJGW5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664169979, "uuid": "410ea471-d29c-46b7-b74d-17d7ea6c17b5", "value": 7617367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664169979, "uuid": "2149a157-826e-404f-acaf-78b265d68145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169979, "uuid": "f399ff34-eaa0-413f-96c4-2e687a50d33f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f18aaf8-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload (BumbleBee)", "timestamp": 1664201652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201652, "uuid": "9c74a243-ecac-45b5-b5d5-4b3581783bf7", "comment": "Malware payload (BumbleBee)", "value": "35cdb3340fddf3d2f354fecc11bfa09b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201652, "uuid": "aa3bcba0-ee89-4bba-96c5-dd35ad26fc24", "comment": "Malware payload (BumbleBee)", "value": "04dcd577bd35afa1329bdc8afc857d4f187b90650442cff896c9d9f61f88ded9", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201652, "uuid": "ed5c1355-044c-4a22-89bb-220f22f2d4f1", "comment": "Malware payload (BumbleBee)", "value": "6a8280886764c697507dde93ff8c7dea0018ee89", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201652, "uuid": "4361b7c9-3be1-42e4-a3d9-3784c9130d6c", "comment": "Malware payload (BumbleBee)", "value": "f76c891c2370b7bc866bf3ac6c3fdafbf63ee105313235f764f1c9a554be271d4da96dcba5ad94fb7befefc2ea540eeb", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201652, "uuid": "f2e2c042-4781-4108-add6-f8c9dd61a2c4", "value": "T1B9C5E15D2B465333E9A160BA682784FFD3B6835283ACDC1FB6E502264F0749B135A3DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201652, "uuid": "f403c2d8-b08d-4955-965c-afc82d1607ce", "value": "30cd8f85b45ce2e61e63c8875a935225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201652, "uuid": "c2f883d5-831b-47a6-a8e2-06384707417f", "value": "49152:6UV3vN223otONOS3sf/vP2pUWX/HzEuXiWPnRw0RULD0CYhw+S6xx9Lxly:n2X+O4sf/vP2pjXfzEuX7PnRw0cYfw+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201652, "uuid": "c6b55c96-e2dd-432d-b1d9-7455641b2070", "value": 2615296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201652, "uuid": "b841171a-e649-40ce-8452-3c116b19fe66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201652, "uuid": "ef5fb9a7-14ba-40c2-b77d-05a87602c300", "value": "OZb2xivE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a55731-3db9-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664210406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664210406, "uuid": "296625c5-0412-4554-b1ee-2415d8357273", "comment": "Malware payload (IcedID)", "value": "c03cbe2b79ef33b927782a5350512fa7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664210406, "uuid": "f78ec21a-7a5e-4da0-9e16-b6a12a479978", "comment": "Malware payload (IcedID)", "value": "05763b143246031434fb393e4ba46ffd1a303f8e7436affe22509c7e5a4b95e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664210406, "uuid": "b047994f-9d59-4ff8-af9a-654ed216b4db", "comment": "Malware payload (IcedID)", "value": "9f2f17571f8b1389f0da59f304b4def7ae1adfcb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664210406, "uuid": "9e99afb0-f41d-4a2a-9a63-ecda981a0367", "comment": "Malware payload (IcedID)", "value": "3488c6bf4189453c939d6e745d6451b83b831399d3167349f08ba50336579f89f4d72be26246a6654fc82ba5fd862162", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664210406, "uuid": "bfa17ec3-384f-43f8-a8c9-3d736cbe21c3", "value": "T1807428D87792F4A2D6B36075007F040BB37A2A57B84CC890E241E9D47EB85AD913BF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664210406, "uuid": "fbb84a38-35a8-4860-a12e-d94dea00ee6d", "value": "0a9aef6c3988a175605d76552a506410", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664210406, "uuid": "c10ba865-f910-48a3-8bc1-25f05d6beedb", "value": "6144:x6HdvqSwNOTzZLen7qACQ9j6pSHP7csiU302dw9qOr:4PLQHP7AX2djOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664210406, "uuid": "18613aab-2b31-4b72-8243-b3fe69b1359e", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664210406, "uuid": "fab78804-cb05-4e5c-a288-9b34109c9572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664210406, "uuid": "911725bc-190e-403f-87e8-cdab01c75201", "value": "c03cbe2b79ef33b927782a5350512fa7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24707af-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214677, "uuid": "b394205a-ef5e-4722-aa68-ecdb514cd701", "comment": "Malware payload (IcedID)", "value": "28bd5a879ef98e0efdaea727543d1c63", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214677, "uuid": "237e5e84-45ec-4dba-a6bf-461fc88c4b6f", "comment": "Malware payload (IcedID)", "value": "05a054ddaff706205f477ff5cb318c64151efc3135bd01c9aa225e9c881b6c46", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214677, "uuid": "486d324f-bfa2-41ce-a191-f71789c7aff5", "comment": "Malware payload (IcedID)", "value": "5416df1b966fc56e27563178f339cd57cd5c7f67", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214677, "uuid": "ac494924-a13f-4dd4-81c9-6b36246a8db8", "comment": "Malware payload (IcedID)", "value": "566057841a69780e2811710baeffd5572d6af236e7d03c04070f26e747ee968602b755d89a97b6df6a87390771affb8e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214677, "uuid": "c7016f8f-e155-4a4f-bc10-b1c46a3be4a4", "value": "T13115F105CF50256BF00B693E371365D7E8661C2B308BDE0AAB86512E29C7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214677, "uuid": "a6b8fb1d-527b-4154-8862-1d3ea842f582", "value": "12288:6JVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEcrz5B9c6dq:6JV2jUeQRI5wPN//n5B9cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214677, "uuid": "d70d6b01-9e7f-4298-b901-38c967b1907c", "value": 886944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214677, "uuid": "d911a5d5-ac08-4187-bf06-d25394394dbd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214677, "uuid": "6c06e329-dbb1-4606-a2b3-24703382b6e3", "value": "kingwoodcabledoc09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a291b88-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214502, "uuid": "336545fc-5948-4ac0-9a2e-069d9ad41897", "comment": "Malware payload (IcedID)", "value": "ff498b50a55ad54e3c8eaf1f8810edb8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214502, "uuid": "c9a4202b-b7ce-4660-9b16-563aae72bcbe", "comment": "Malware payload (IcedID)", "value": "06f6b95cd39e770e937dcb94a0a2f11f46fa4500eeaf08e4be270e501ecf7584", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214502, "uuid": "1f9009c4-1c50-4e77-b7f7-2ecce8c90748", "comment": "Malware payload (IcedID)", "value": "8bbb45b152c041d7054d9443a53f37264ce24dd7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214502, "uuid": "5165dac6-cc72-40c2-84a2-7cc9309379e9", "comment": "Malware payload (IcedID)", "value": "77ed177ba76df6ce2348d533bdadc3acaca4f7d8360a06d729131be04d42eee84dd7c16ccc33bd0e7ca951212b0386e7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214502, "uuid": "7cb9425f-923b-4fc5-b3c0-961e7803b1b2", "value": "T1D115F105DF50246BF00B293E331765D7E9A21C27308BDE1E6B96116E29C7FA0EC36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214502, "uuid": "1fbf9bfc-cab3-4949-a5d4-8e8c6de1d075", "value": "12288:PzYVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEQCibMbr+9f8zAgo64f:PzYV2jUeQRI5wPN/aiwrk8e3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214502, "uuid": "58698778-fcaa-404a-904b-e6a5eafc7858", "value": 887063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214502, "uuid": "7187ebbd-915a-4c81-b8d6-2d6af12e75d7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214502, "uuid": "1bf1bd68-c9be-4ba8-b50c-a2a99d0177df", "value": "kingwoodcable.invoice.09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5c399e-3d89-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664189436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189436, "uuid": "2e01e793-31f3-4bd3-bd67-b332c715ede0", "comment": "Malware payload (RecordBreaker)", "value": "929feff41f245803c5527176c2510328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189436, "uuid": "e0af8dd3-e300-44a8-a4db-652746a2a38f", "comment": "Malware payload (RecordBreaker)", "value": "070b35fe8f9f8054c8b5790c2576626252b289b2b68d093e37692a59b1eecc43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189436, "uuid": "02696e35-59b3-41d5-8ab8-57565c5bdb1a", "comment": "Malware payload (RecordBreaker)", "value": "2f59344063d07cad6c2601d4f8791a1bd888078e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189436, "uuid": "cd120620-8213-4a14-b4e6-052fb6f6db93", "comment": "Malware payload (RecordBreaker)", "value": "ef8f3661876c0df1d336b9d2019c4f204f6971a95d2b32373a087a5e1e8b91541ebe779c3495fafe4824f99229ba230e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189436, "uuid": "4fbde505-ce87-4f30-bc9d-e6efe852f5ac", "value": "T157747C00BB90C439E5B715F4496993B8B53EBEE15B2451CB63D82BEE96356E0EC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189436, "uuid": "c587874f-77a6-427e-9393-fc170e67d7dc", "value": "249133e0fde99bb33679857440809c13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189436, "uuid": "ef8fcfd3-e3f9-41bb-a86a-eabae3c5c60a", "value": "6144:n7X/mciW2XmeWVhXVt1g0mbuJtiUMg+WZetXnTsazryP:n7POWBFVt1g0mbuJtorW4XTsa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189436, "uuid": "79abffa0-f48f-4a3c-84cd-f40d70ffc6f7", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189436, "uuid": "fdc8d94a-8171-4ed3-ad80-ae7af8908ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189436, "uuid": "9e2ab476-5803-40aa-b540-498f5b949001", "value": "070B35FE8F9F8054C8B5790C2576626252B289B2B68D0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b8694e-3de4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664228772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664228772, "uuid": "43e41c96-74d7-45a7-af10-01797ac72768", "comment": "Malware payload", "value": "facf173726f6b3c0dfc6bff5b223e67b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664228772, "uuid": "fada74ed-081c-44f0-b576-fe6cafe11851", "comment": "Malware payload", "value": "07240bc14c34f1bcac94a19e0d5e6331d98717a65b76f7a106216a41de782a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664228772, "uuid": "4ffd1256-72cb-4767-993f-86e1c7fe6089", "comment": "Malware payload", "value": "d26afc80fb12850d46683b8c217e07dd96277963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664228772, "uuid": "54410db5-a74b-488e-84e8-9770c4e4980e", "comment": "Malware payload", "value": "e135ec9d19dae8e9f54cdfa289e362df964467fb9b692c7c5c3bc7ad97c1823a2fc2509bc280e1d49dd073e323aa68ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664228772, "uuid": "c4419bfb-5868-4522-9542-508e47164da8", "value": "T17FD5C0761F0F7B5CD032B572F416BAD38BA882C6198B9A05E23E69054D723568EDF3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664228772, "uuid": "f6c1d1b1-aa49-4cb2-96a7-9e2e9b579dc5", "value": "209adbabf16b5a817fa273b37d5eea7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664228772, "uuid": "7aa57901-c047-4e81-ba24-c706ff076df9", "value": "49152:cUV3v7mzyveqNwoqmTL93qSsgMObQGkCxnkaugjSo51OZ+BCPe6UNb/ed9rg2UsL:bmehNdqiL93qs3bZkCxnkTgjSovh6+bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664228772, "uuid": "736d370d-880c-4ad5-a23c-214bf419c9ad", "value": 2976768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664228772, "uuid": "fda6858e-c1b2-49ea-b8b0-39c13bfa6561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664228772, "uuid": "4a2fa0dc-d6a0-4de0-ad56-56bc53b8aeaa", "value": "lqDwAhoXOlNwLd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83932770-3d95-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664194788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194788, "uuid": "49c33180-37d2-4a42-b6b5-9a92e95b1f64", "comment": "Malware payload (Smoke Loader)", "value": "51a4ecdc1bbb126de323417b3609bfa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194788, "uuid": "5041661b-e540-4a9a-866d-6e0c28b77f28", "comment": "Malware payload (Smoke Loader)", "value": "07e0d0efc6f42ff619ce8a14c18388b370152181a43336d4c76ff02a3548f3e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194788, "uuid": "b866c3bb-f313-4327-8a44-c7d1cc1f1107", "comment": "Malware payload (Smoke Loader)", "value": "5c103a88f126cf3929de5e9d5e7fcb4dab129a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194788, "uuid": "90de170f-8d41-424e-87fb-502475c91856", "comment": "Malware payload (Smoke Loader)", "value": "5574e736b96c0a3327d2daec371b81c68691c293915c3a87c52fcd263d4547aa3252002805a4fe2114a8986418789ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194788, "uuid": "3b1876f0-f217-438d-9736-dd8365d61d7e", "value": "T15AE3E0117A04F832D01699741824D6B07B3F7865593A5A8B3B9C3E6F7F323C29B72366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194788, "uuid": "bd08b956-0f40-4918-93fd-530a533ac766", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194788, "uuid": "d87f1bf4-29c3-4f3e-b43d-d8ac7bad85e1", "value": "3072:R2Ff9TF5q4bi0xNWb6Njsu8NQOzPBoO3UX15B:AZMOi0x4Q4uhwN3UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664194788, "uuid": "ac95b3e2-fc0d-4950-92fa-b931545cc52d", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664194788, "uuid": "41cc65f7-f10b-4fd7-867a-630c0f89f125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194788, "uuid": "c98262f7-8002-4ea8-b9d9-09d48c2acfad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfacc7d-3df6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664236329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236329, "uuid": "f9d5f2d0-023a-41ee-bb8e-1266e977be25", "comment": "Malware payload (Mirai)", "value": "b03e5f3202fe40a92e9ee4c494d1cbc1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236329, "uuid": "4025baa8-7c03-4da6-bdc5-5306ec88669a", "comment": "Malware payload (Mirai)", "value": "07ed602d8b4ce01739c06c9ab67d5a5bc1e9c07c5795cd5d8b1378e7ee7b63fc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236329, "uuid": "6099a9a0-fd55-42cd-9874-8065db8875b4", "comment": "Malware payload (Mirai)", "value": "1f00cd0fb7063eaf4549242c1b99b66f0b022f46", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236329, "uuid": "89c80d60-eb9d-42c9-8804-d37186d667bf", "comment": "Malware payload (Mirai)", "value": "b83c09442d317fb3f12918c53d2cdb291c54b9d734ab2023a62bf4ab458c0a54683607bf86fde9aac64499f842e6d299", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236329, "uuid": "d4438139-2287-432e-ba5d-3f2f8e5088e7", "value": "T1AD333A03B98280FDC55CC274566FBA36C873787D0339BAEA37D4FA266D46D611E2E904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236329, "uuid": "7164c60d-f14b-45aa-9fe7-cf5279233f61", "value": "1536:VJCqjbwNRaPq5Fllaxouzvif3dToao9Mkv:FjEraP4llaxooi/dT3mMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664236329, "uuid": "1e054762-6bf7-43a1-a43e-ea5e2858e456", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664236329, "uuid": "f2865a24-608a-45e4-a339-706e68151ce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236329, "uuid": "25f52f3a-40cc-49f8-a29e-7f48c4fe9f55", "value": "b03e5f3202fe40a92e9ee4c494d1cbc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c27c51-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664227626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227626, "uuid": "124e6e7c-a7f0-494b-91d9-07d36cb62bd4", "comment": "Malware payload", "value": "697fbb026fe9409970793b46745b59d8", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227626, "uuid": "48991fbf-264a-4cf9-94e8-0de7b288bd9e", "comment": "Malware payload", "value": "08927126f80138113f70e30a032cd6c925ddd95cc6c7fe09734249da71fc736a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227626, "uuid": "2c651b0d-5841-40c6-8efa-bc8c191287fd", "comment": "Malware payload", "value": "249362be20c5dcf194669d2d8b406ac3404c4542", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227626, "uuid": "243cc752-65f6-4142-a09a-d0e63ffbbe89", "comment": "Malware payload", "value": "2a8e9481745df16978a549f05a26bc1c02a764c766f21839d8f73bdaaa1e6f9bb604a2577277d4a5d8b3af4688d7bab8", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227626, "uuid": "253a076e-cbb2-41a2-bc38-8d2096cff325", "value": "T10851970AFD47D15C9BBA236BEC978962FF1B411B9DA2104C71ECD2455F20809A67CF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227626, "uuid": "f5ea7a03-a518-44fa-ac98-2784b634d3ce", "value": "48:AE+4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:ZGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227626, "uuid": "5df7f01b-7f23-47be-b126-7fc98958a2dd", "value": 3135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227626, "uuid": "b226caee-4d70-4413-9245-c8274d3108ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227626, "uuid": "fa28ca2e-03a3-4d1f-bcbd-9d488d1b366d", "value": "7nZuvhVp.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b53c6e-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664180370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180370, "uuid": "1c6436e5-c282-4b1f-8511-5470071153cd", "comment": "Malware payload", "value": "ef0ddc826b8ccb07d6640cdb5f345e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180370, "uuid": "5f90d40f-0e15-4888-8c69-7a7b817b7dd2", "comment": "Malware payload", "value": "095bed54a0b4d2d85458d7d2cb45001fe33f12378ed04ba96c1a5387cec3d1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180370, "uuid": "d6521949-4645-4da7-aca2-13c93c809142", "comment": "Malware payload", "value": "eed67af2917f853b1b3b7f865724b50d06b8c304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180370, "uuid": "6db74e94-ab9c-486f-8c0f-88cb7bdcbde9", "comment": "Malware payload", "value": "8b947ce41cc9f410f36505d7cc0f435f91ed5b7ae243efa7b8a0136926efe649ce296abca09d33a8bf62e061c1882dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180370, "uuid": "d0593995-79fa-4757-a19e-e7385c57969a", "value": "T1D34512F93B6E78F3E5589630E845A2ECFF6170BD9AC784243EB4B4265272351096EF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180370, "uuid": "a124e5a4-2247-4fe2-815a-3477cda2223c", "value": "0fc53ee66c7393834a70294ee6d442f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180370, "uuid": "64a8ac92-1b6b-40fa-a2e9-b9dc22f484d8", "value": "12288:YlRabhN/UgaGL+sU/empAF9++TlP5hH/G2+2Ehf8bR+jq6:gRaN6g5+s/m+++d5hf5Dbkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180370, "uuid": "a45cb31e-8cca-4c2c-a976-d5939d06f519", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180370, "uuid": "32622788-f7bc-4acf-a3c2-70a1f48c338c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180370, "uuid": "4dd9e62f-f60a-4fe8-a6ae-2fa1354b486f", "value": "Order_2609220047785.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7120355a-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664181013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181013, "uuid": "ea4a6d99-d13e-48c2-9983-e0fc68145ae0", "comment": "Malware payload (AgentTesla)", "value": "1a61294e2e755589263fb89a9384428f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181013, "uuid": "24b92003-ed8f-4c36-80cc-283d799ba797", "comment": "Malware payload (AgentTesla)", "value": "09971407dfa530ecd5ab466ed1c9155cf1ec47d22619285602a565eb06b509e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181013, "uuid": "0ff5bd10-9ac4-490d-a160-220551d9444f", "comment": "Malware payload (AgentTesla)", "value": "08cc651f7eee8baad1e32e85648f495d93923124", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181013, "uuid": "4b560f85-a013-473f-b5b5-7665331bcba6", "comment": "Malware payload (AgentTesla)", "value": "0fc0d735b7ead89f5271f37d45c18a6f38af2d677d36fc66335c1cbd317924a2cfabc409bb8dcb02881072c5f8694797", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181013, "uuid": "1a699fe2-3d47-4f1b-a791-cac58f9aa8bc", "value": "T1AD25F1370BEA8B0BD115A278D5D0C2F6A799CD11F527C2DB6BCAAC1FF08A465CB60710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181013, "uuid": "39ca593a-3aac-4b29-9b9e-1e25d2093016", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181013, "uuid": "53ab9a33-aba1-4200-8993-93d7d0897ba5", "value": "12288:9EO4F3eb5/rtOxVaP3ihsufpKqRWJYkMLgQvZUL0PENFHODVk04gM6S0TtSXhXIK:X5t8kwTVENA+01S0TsZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181013, "uuid": "8d8a03b9-c5e2-405b-b2ed-96c1bf69f697", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181013, "uuid": "21aea33e-91ea-47d7-b7a9-9c33f597aa53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181013, "uuid": "7dbb826a-bbe8-4d5b-a23f-3572ff8b64b2", "value": "1a61294e2e755589263fb89a9384428f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368928e3-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664212698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212698, "uuid": "8e263522-68f6-40dd-a548-ba1ec631536d", "comment": "Malware payload", "value": "514e858978ac1ddb67092a004acc2c37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212698, "uuid": "5441de46-2d51-461f-97ae-7f75a863fd5b", "comment": "Malware payload", "value": "09f4e5f620a2166727d87b9263934d1e4723413fd5aa1d7bda54b821594c2b64", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212698, "uuid": "8a20b870-0dca-4f53-b4bd-356104ce2393", "comment": "Malware payload", "value": "effd0a09ed16410653dde4a8133b05675040a750", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212698, "uuid": "570743e8-88d1-4ace-b7c1-046fe68227e1", "comment": "Malware payload", "value": "07f5f49e3d80f92557817851eda42dd02595523a59223735553f5deba3fffd343ba8554b83fa45ff7c1e2cc52439c745", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212698, "uuid": "aabf6f01-1dc6-487a-9569-9fef32367b34", "value": "T1B7D4C5C5B156C22BD6886E3A4C97D7F933B47D02AE45A603F08D732E3E7E294CA45781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212698, "uuid": "8a402256-5662-4186-8fd0-78d5f0eea5e3", "value": "6144:T0RUCEqhx4eKc5bPZz0cEd7jBYebsa797Q0OxnPPTMZIY:TWxhbPq3d7caBK2uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212698, "uuid": "537d0be4-b7ac-4644-86be-2613b9b5b89e", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212698, "uuid": "48909389-a550-459f-8563-1ccd3a6c0726", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212698, "uuid": "a8624d7f-712e-4374-b5f0-7cf1032adda9", "value": "SecuriteInfo.com.VBA.Logan.3856.12091.4677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70272ef4-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664180153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180153, "uuid": "d90f2258-ca95-40cd-bcb8-57efc4c2dcba", "comment": "Malware payload (SnakeKeylogger)", "value": "c84bf4e6db6b5d6f39711b3df6fc110b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180153, "uuid": "92612b3a-90a9-43aa-9280-4c1d62516f73", "comment": "Malware payload (SnakeKeylogger)", "value": "0a2fb56aeda0b7e281f579f610167401ac598e4c4228320639f1e08daf5180d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180153, "uuid": "d54ad8d0-4585-4c31-a270-37c039d31fc4", "comment": "Malware payload (SnakeKeylogger)", "value": "6c9b566b912cba07a222489fb6e49bce04bc99d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180153, "uuid": "8f65ed68-45a4-4c82-ba5e-6383d0da2c8d", "comment": "Malware payload (SnakeKeylogger)", "value": "9f8ad3edd124a81fd22495e5c53f86eb80912498233a4db40d12ed1faeffded23aa0da96a803d40321d7179b4bb85fea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180153, "uuid": "830eabe5-dc19-4da6-8003-a11ee2020e98", "value": "T10C720A11BB86C976DCA10636489BC3D0177DBE435847FA2FB980395FAC7524B28A1AF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180153, "uuid": "9f27a8a3-acca-487b-8b56-b872f34ed3a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180153, "uuid": "ff00cdc9-f3a8-408a-87cd-37c21424a452", "value": "192:bA8fYIJxKVj460o6Ate1ozTqpKGvOFwCwBeu8C:blfYSxKVj0BAteaKpzOFwNIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180153, "uuid": "04d637af-d729-44c1-90df-c30b5f8ad2f2", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180153, "uuid": "265394b9-69e2-40a2-8bea-e3caa26faa5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180153, "uuid": "5f061fd9-1c9d-4848-b889-febb0d5c5885", "value": "Ifagko.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be154ff1-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215073, "uuid": "bc05229c-2a83-4d5f-acb2-4bca35e11076", "comment": "Malware payload (IcedID)", "value": "765e875322857eb72991f1f4c99528b6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215073, "uuid": "6c68d644-5e50-41e0-87e8-3a59898d6e08", "comment": "Malware payload (IcedID)", "value": "0a6b1516e40136f18f0533685991ad8be96cf485b0c638cf5e8359183647eeb2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215073, "uuid": "89f8abe6-094c-4076-a518-8e39311d12b4", "comment": "Malware payload (IcedID)", "value": "962062c798cf3b2df2881820ed33f19ba5d9c6cd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215073, "uuid": "2d102352-5982-4a8c-865e-aef8f8cf22a8", "comment": "Malware payload (IcedID)", "value": "9d05b8c902831b4ea8b8c4b44e30976c735a0f71d12b8eb80ed4b3069e913577b76eaebdd7364d9cd4e04569183e2687", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215073, "uuid": "f4c5223f-21aa-42dd-8cc2-7e27f5895bef", "value": "T1BB15F105CF54606BF007693E371365D3F8A61C2B308ADE1A6B86112E2AD7F60FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215073, "uuid": "02c6e519-90d7-4b1e-ac16-f8b016c57529", "value": "12288:S71vVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEZXQDHRrljvXAQunP5GU:cV2jUeQRI5wPN/sXkxrlrwQuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215073, "uuid": "00c9cb4f-542f-495e-b084-e7d8e300d2b6", "value": 888077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215073, "uuid": "183acbf6-0e49-47b4-8d5f-1619f4e1c506", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215073, "uuid": "8e832642-fcfd-41aa-9a14-517945a1415f", "value": "leatha,invoice,09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153616cc-3dd0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664219943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219943, "uuid": "3defa862-1c5f-4fe8-ab79-02bd078f63da", "comment": "Malware payload (IcedID)", "value": "c98a6f9e8a1118650945086e7064a2b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219943, "uuid": "283f1471-f20a-437c-82f9-cfacb74773b5", "comment": "Malware payload (IcedID)", "value": "0a7f377d19ba4c93d523af53cd58cbb00d05e070823d6ce6c967990d40cfcaa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219943, "uuid": "32892a76-d0bd-4a80-bd1f-0db1fb64e2b2", "comment": "Malware payload (IcedID)", "value": "4b40e46398e48350af80692105c65d87342f6140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219943, "uuid": "eed34e09-97ca-4c02-9636-eb32a288d522", "comment": "Malware payload (IcedID)", "value": "6d21ddb2f928de3bb5ffe3c8e0b6b50c379dade5e4edb8f072af65cfa4b0c20a7ea701cc4aeb2411e452190424153d9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219943, "uuid": "692ca0d1-29b3-419d-ab60-951ad27b1023", "value": "T11CC45CA5B5C13026E2739279A0AF6546B2769913B00B89E4F17EE4E0DF749CE0133F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219943, "uuid": "6f556299-26c4-46f4-81e2-8ba8e0c829af", "value": "19c10135117a704516e8404b24282c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219943, "uuid": "b61604e3-9216-498a-a627-604350bca09a", "value": "6144:C+86v2VKRnZEvCijwzDv35F5+Djwy/QCn5drokAieihT:C0v6vCij+3yB31BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664219943, "uuid": "846070b5-dc8a-43b7-a5d3-8860ed474171", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664219943, "uuid": "4d958df9-0ab1-4da3-8e29-c7e1119534c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219943, "uuid": "d3540e25-a436-4d5d-81eb-796dd2656eff", "value": "plenitude.db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696047fc-3d32-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1664152224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152224, "uuid": "ade57840-1a83-42a3-891c-0bf5c9c88656", "comment": "Malware payload (AveMariaRAT)", "value": "2d34314b3908a419d0bfdf64d7b12e63", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152224, "uuid": "c5c17fac-8366-41f2-96e5-5c4258909a6a", "comment": "Malware payload (AveMariaRAT)", "value": "0a8c82fd949fed5b52e3853e9e9cf876d8b7f3cdc929c3034c97928b2ed20411", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152224, "uuid": "d409d951-0172-461f-8bfb-a58faee8221d", "comment": "Malware payload (AveMariaRAT)", "value": "f04175d0122db4ee1f28482207d09ccd65ace531", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152224, "uuid": "36d22a8d-bb6e-4d48-aa15-6935550f4874", "comment": "Malware payload (AveMariaRAT)", "value": "0d00191827ec7f8976166701888bd97a5c81ba53c436f5ac32f377ef05a49fafff0f8a14f8826b0b30ade4f9805d3837", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152224, "uuid": "7690f520-7b01-406c-8a05-157e20b1fe49", "value": "T120724F127F5C862BD1AAE73A54B6C310E230D740F172BADA7998FFC5781278044DD6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152224, "uuid": "2b26b04a-e2c6-402f-8b9a-01f4eedfc753", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152224, "uuid": "d6f0c3ae-9a68-4c20-9e93-d68271668ef6", "value": "192:yFE7hzuFDcV6BwqXOcV6BwSVT66zNLoYbYighf7l7BB7q5P6ld1ktzBSLuoa883H:57hzunwcKwSVT1FgdB7BB7qKizBS6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664152224, "uuid": "c2e8f9ff-83d1-484e-ae47-23ee59043aa6", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664152224, "uuid": "80fe68e6-5c4f-473f-a708-8e89e701ff5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152224, "uuid": "5d308f98-5a0f-434c-9b72-c7ffb97cc103", "value": "Quote 09-26-2022RFQ-994902093002039902934890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ba6b77-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200878, "uuid": "7d599942-30bf-49da-8513-80dad1e8253f", "comment": "Malware payload (Mirai)", "value": "3cdbc5339d018e052af899740e1685e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200878, "uuid": "2a768111-303f-4f16-b7a4-5b1329c60ed2", "comment": "Malware payload (Mirai)", "value": "0b0101c21b14da5531b52fa22b9ef384f0c5f939806c857b406b0badeb0ae90d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200878, "uuid": "06cac31e-b6e3-4f72-bb8c-b19d55d24da1", "comment": "Malware payload (Mirai)", "value": "7b4c59f71439c81af4621e12ac7d47e3f0f2203a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200878, "uuid": "5ddadc41-9043-4cd2-b4d3-673d98435ba1", "comment": "Malware payload (Mirai)", "value": "b6c67d41c638ec03223999bc0546d10c7aef034ef9817da2c4fe5a021cc9c7e860d6762487c1f554ee378fdea05cf9af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200878, "uuid": "22b33196-bd95-460f-91ab-d28598d9e87c", "value": "T1D9734CCDF683D4F5EC0609702076BF778BB6E2BD2225E647C7B86A319C42203D516A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200878, "uuid": "ff46a9ad-6136-4088-ae52-ee4d4bd70974", "value": "1536:/v2XrCtncZezX/Dp8CTNoM/ip1jQLihyuGTfhPQhZrFCj:n2XrCtnc8PD+q+M/iz8LGGzdIzCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200878, "uuid": "5a3ad574-bd01-42c7-828a-98b2a88d7044", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200878, "uuid": "551ba92c-6ae0-47d6-b370-3b595df8324e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200878, "uuid": "8f6e3ff5-fafa-4ead-8f29-207969e24c05", "value": "tamkjll.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde02bc3-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213891, "uuid": "556d4486-9435-45b8-86aa-f069bbfc5a4f", "comment": "Malware payload (IcedID)", "value": "127a837bbe912f144fd3c98148308459", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213891, "uuid": "6f265589-24d6-4b38-84ee-0afc4a4a0b02", "comment": "Malware payload (IcedID)", "value": "0b1b3f889461485e71868160f46aeb008d8dd68c44b7b2e2f6f2c3e8831aae8b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213891, "uuid": "b7351bfc-a6d1-4780-85f4-2c80935fd12e", "comment": "Malware payload (IcedID)", "value": "06d87666a996908807e373a9a7569f24cf6c2e17", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213891, "uuid": "ce456aab-9333-417c-bba6-2d3c7dd73af5", "comment": "Malware payload (IcedID)", "value": "0f9ba8d5a35d3da4cabe6b2d3c483166291708bf357f4a5a68724e5b39cc793d45d5231e2967c66fc7e12deaadeb1b79", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213891, "uuid": "47a82513-835e-4841-92d1-162ee9cae024", "value": "T19F15F105DF50606BF00B693E371365C7F8661C27708ADE1A6B96112E2AC7FA0FC36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213891, "uuid": "afd747dc-d1dd-497d-9991-b7ac00d223b1", "value": "12288:0PVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEzhkmuVOkGnC6XAaunP5Gt2:oV2jUeQRI5wPN/+kmZDBwaux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213891, "uuid": "3ad5599f-53a4-47f9-94c1-8d634b04781a", "value": 887941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213891, "uuid": "c981190a-5122-4de3-adc6-8405e24cb4a8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213891, "uuid": "fe6e210e-0da2-4784-a442-06bdb37be8c7", "value": "kinizamail-doc-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a621412-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196061, "uuid": "3d1235aa-5d18-46d1-9924-dfd86cd3305d", "comment": "Malware payload (Quakbot)", "value": "e17ff4c8e0da566b6fbe6ce54101eee7", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196061, "uuid": "15cfe8e4-a212-4449-9bbe-fac2731a2746", "comment": "Malware payload (Quakbot)", "value": "0b353412e79686c5185dfdf185747e856f379c863ff41d82ce0ef4b69b31b747", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196061, "uuid": "16f6cd6d-46c8-4ed5-abec-fcd299ea231f", "comment": "Malware payload (Quakbot)", "value": "ed92354f1a9500c9dc07dfe77e23d3193e905559", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196061, "uuid": "3040c3b3-d068-4983-8786-4a5a04888ceb", "comment": "Malware payload (Quakbot)", "value": "d9b633afe02fa8a7e958bf1b62691410c4a8b217cf4712df62f23f5dd595cd4d8b474a7a2ef21f95ff3a37181fe2ab2b", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196061, "uuid": "c6ef230e-74a0-4604-a168-2a808b69a593", "value": "T152358E32F2914477C1732A399D3BA7659D3ABE112E2869863FF81D4C4F392813D352A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196061, "uuid": "a6d36ed3-a384-4686-a0e4-362f22de5de3", "value": "4c28c2092fdabbad5c5522584f7ea5f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196061, "uuid": "a31d06fa-cd7c-409c-b3da-d0818aa029d3", "value": "24576:wVeK7bHY/DS6wku4EmQKyMeRP7IYqsS/HdcoO9u+5w9M4a:wZjMpn6oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196061, "uuid": "0dc0664e-aacd-405d-a896-42ec4ff3ba11", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196061, "uuid": "1db4e902-3fbf-4926-b13f-ed1433182051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196061, "uuid": "4a789fb1-fc05-4baf-aa4b-c012c571757b", "value": "retsina.db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93f4d96-3d51-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664165780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165780, "uuid": "b40b6f5f-d81e-456a-8b47-19ac3d75368c", "comment": "Malware payload", "value": "1acf65f27852e6c4bd3e03ba258064ff", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165780, "uuid": "1c990e4d-cda2-4603-b27a-c19cfeb93b97", "comment": "Malware payload", "value": "0b5020dc3eec95dc16d0e8e833772028273004ac2832a0fdbc8991e6a4cdcd5a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165780, "uuid": "2565414a-17fb-43c1-91a1-70417aa10174", "comment": "Malware payload", "value": "08d722c635a64efc20b0cf44f9a06eb64f40b4c7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165780, "uuid": "ac8b1339-20d3-40b0-a103-531c422b1c79", "comment": "Malware payload", "value": "f877ab21958303b9d9d65d6c84ebff2a1a3f326bb25dfefa9f7d07a0ca91fd21d19537aa3f02630076debe1b74bcf75c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165780, "uuid": "cfd59ce4-e314-4769-ab1e-776aa773cd00", "value": "T1D1E63382F7D9BD2FCC7380324BB5167661864C5ACB13E2436965736C99F7AD08E81BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165780, "uuid": "1e32b400-8337-4fc1-a9b4-137360cb4a17", "value": "393216:imaBC9u9O4X9uGtUNCK54bOZkLx0hb2r2fZRpoiN:mBVc4X9uGtUXzset2r2ffpvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165780, "uuid": "21844134-e5a5-4756-89a6-d390e09d2582", "value": 14004085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165780, "uuid": "1255670e-5184-4c66-8bba-32307701d7db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165780, "uuid": "579d0d80-369e-45f7-9887-305c28aa8bcf", "value": "0b5020dc3eec95dc16d0e8e833772028273004ac2832a0fdbc8991e6a4cdcd5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a459d53-3d4f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664164627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164627, "uuid": "6db13a64-7a33-423b-88c3-7d28d6cb5267", "comment": "Malware payload (Mirai)", "value": "fdef52ffa26aadbf60f2f0a06a1e5391", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164627, "uuid": "4a2ca0a9-b2e4-4cbc-a645-62fd55acc9f5", "comment": "Malware payload (Mirai)", "value": "0ba68fb29fb1fa202d95a98b487050336d29da9b7f522a2d858bc597d697c58d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164627, "uuid": "809b0e35-00ba-47e8-99e4-4ee6ce675ac3", "comment": "Malware payload (Mirai)", "value": "cb9c56877f98498e506c7131a1a00b905ee79702", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164627, "uuid": "dc800498-00f0-4588-8366-af47945721a4", "comment": "Malware payload (Mirai)", "value": "0cfa59b9cca3146ebeaefda05356ed49f6944adaef31e779f071e6cd783a5b20724613bcbc3930c56f93cd19a8300883", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164627, "uuid": "4395c7a6-eb58-4972-b196-112c7a32fbb1", "value": "T114244B86EA818E13C5D717B6B6AF424533329724D3D773068D18AFB83B87A5D0F27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164627, "uuid": "f1920b5b-d96a-49dd-96dc-b4151d705441", "value": "6144:fmvobRGAmAD9mrsplDKZUjQBKXAVanaX+F8Jyv3eKawcd72E04cDxwM3eGf9Wawc:fmgbwu9mrsplDKZiQBKXAVanaX+F8JyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664164627, "uuid": "0ae1d783-bbd6-402f-8e7f-f82852353c56", "value": 229427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664164627, "uuid": "81a5ecae-8cc5-430d-9059-1aadebdfaaf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164627, "uuid": "cfd59b33-583a-4836-aa72-f04c99c4f535", "value": "fdef52ffa26aadbf60f2f0a06a1e5391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e48808-3d6b-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664176723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176723, "uuid": "afefa0c1-8a00-4c25-8f29-2429d88ecc12", "comment": "Malware payload (RedLineStealer)", "value": "43b9bd3285410e06843df16352ddee65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176723, "uuid": "2874a3b1-8ef2-48fd-ae8c-7857e74f0dcb", "comment": "Malware payload (RedLineStealer)", "value": "0c6facd04ff638eca0f124a85d70a58afbf0f3aab6e9848a3ed4f327fc003f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176723, "uuid": "070ab173-7384-40a9-88ac-abadb1b57d1d", "comment": "Malware payload (RedLineStealer)", "value": "98c959bcf862fea707678ff5ccd75fdf9f45460f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176723, "uuid": "cd646779-9aa4-4e65-9e5b-822a0751424f", "comment": "Malware payload (RedLineStealer)", "value": "7a1b47270e14a05cc85db6fc50a9300bf666e70dd10f566e7f8b1740dc70617d909280a5a8f90462300855cd04d654f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176723, "uuid": "a373d396-ec7a-4bb9-8fbf-f099cd0f8120", "value": "T108E3F1117B90D8B2D42505744836E7E0AA3EA82146325A0B3B9C1E3F6F713E2777A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176723, "uuid": "4cc8e49b-b2ff-4f13-ad3b-e377141d6ff9", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176723, "uuid": "3395415b-4872-45a2-a76d-09c3e9f626e3", "value": "1536:coJyYQbkpMkPYk1G5Lhwn/NHbjnI8R1K73l3orCYsa8FL7Sg9rDvBaycmjYj1Eix:chQdG5O/BfFRgOCR5ugjaJ/Bt5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664176723, "uuid": "e12053f5-c026-4065-8498-aab9d84bdccb", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664176723, "uuid": "9f473354-ad89-495e-a974-233a4b1f5eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176723, "uuid": "4667491e-81ff-4400-8627-4091d19b145a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4caf386-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213446, "uuid": "4b6acf0e-38bf-43c1-8a72-2aff1efb8f35", "comment": "Malware payload (IcedID)", "value": "5d0afffe5bef3200e17298103ec3087c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213446, "uuid": "61a084c2-9c66-46f2-b9a0-07bfb2bd3f1d", "comment": "Malware payload (IcedID)", "value": "0ce40e119c53aed71cf0958e4b8ed239e14b3e6453b455a2c5dc616bc9b8c0b9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213446, "uuid": "836ec774-db64-4944-aead-1a9c7b6d4ab2", "comment": "Malware payload (IcedID)", "value": "acc7bba0a671bde117e28d2d5d926a2ab35817fd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213446, "uuid": "d7292090-7146-48a2-848d-977bebabd7be", "comment": "Malware payload (IcedID)", "value": "a8fb2a934e9717d42145e80f19f595cd3a4c3441c496c13f738c299b4fbf4bd51354a528f4df102f24f84162d487b259", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213446, "uuid": "e9ecffa4-0308-40b6-b907-56399c10a538", "value": "T11615F105DF40246FF00B683A371366C7E8660C27308BDE1A6B96116E2AD7F61FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213446, "uuid": "15ebd935-9ecd-4457-ada1-4524f0008649", "value": "12288:hzaVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEed4gb9oqSzvmprHMmB:UV2jUeQRI5wPN/VdZb9oVzi7MmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213446, "uuid": "cc539514-a401-4bab-b37c-1e4f73dae07e", "value": 886943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213446, "uuid": "cafaddf9-113b-41a4-a97b-be3717ee81b6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213446, "uuid": "be3a33a2-969d-4e00-a963-a76faf6c529d", "value": "nckcndoc09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d24cf0-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227351, "uuid": "a153d194-2116-4eba-a21a-34015dd10334", "comment": "Malware payload (Mirai)", "value": "38a32d1302558321477369d3575e564e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227351, "uuid": "d19b1f45-19ff-468a-98da-9c572de57489", "comment": "Malware payload (Mirai)", "value": "0d6d5a7d6f5c3ff34cfe01607e1661eb730aa57f3ed80a038414830d68145e1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227351, "uuid": "61cfc98f-4ff5-4961-8bf7-f02f8a13dfc9", "comment": "Malware payload (Mirai)", "value": "4390d84215443206d70aaba49f80b5ed490fbe21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227351, "uuid": "a4d56821-03e6-488a-8f4d-681acb01851a", "comment": "Malware payload (Mirai)", "value": "f63a5eeeeb61386e623be1b3f15c1d79ecf5ac7b19c265f41a7378b3f586c6879421e9dd8edb37006c930889fad5345d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227351, "uuid": "d0820c33-998b-4cf7-9bae-64ebbd8aaf26", "value": "T136E2D0CEE4B8AF89CEF99C3CC2491661995489EA73DB4786A3109CD87F11D4A749C0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227351, "uuid": "17c91ea0-81c4-4704-beec-9fecd2eba4ad", "value": "768:OrRKG+yWvfzOEeGUx/CLTAeCYRJuz9wwwrNIyW/:OEGfmfiNGUALTAeBRcz9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227351, "uuid": "ce8bca4c-6160-4761-a559-67f0e785d320", "value": 33988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227351, "uuid": "1132144e-d3f6-49bb-b0b5-253dc1995700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227351, "uuid": "90b5c8f1-4bb8-4bc3-b299-97f2b310a7f8", "value": "38a32d1302558321477369d3575e564e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b12ff92-3d9b-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664197270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197270, "uuid": "224f51a1-8a42-4bbe-befe-69e373684f38", "comment": "Malware payload (Smoke Loader)", "value": "acbfdc2fd8e7f9f67c1bd1a2ce3d0ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197270, "uuid": "1406f1f7-713e-4e9b-9ab8-37f6aa5e6d8c", "comment": "Malware payload (Smoke Loader)", "value": "0e7f09da5d52cbcf386d9d208bc5d5f8c84fb27acb31cb436cd87efbd2d1526f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197270, "uuid": "90defe81-cd22-4021-bcb3-8f6043ad7acb", "comment": "Malware payload (Smoke Loader)", "value": "fb90477bdf9c512ba3b7a1c5e9a56b3ce51fc35b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197270, "uuid": "870fc9e2-1654-44b2-a2bc-bcf833e6e4d9", "comment": "Malware payload (Smoke Loader)", "value": "6414c57b13d6787b275d9cd2b44c4e163c4cc378e1bcadc14d1f20769d07e33c6180081430803e75215788489aafe8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197270, "uuid": "ee705641-2a44-4def-a0bf-ba7ad7d7d282", "value": "T18DE3E1417B88E832D00518744C34EBA1AA3F3861557A16833B9CBF6F5F723D267B6366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197270, "uuid": "04707359-3ad6-4a26-b582-ad568b39e1cc", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197270, "uuid": "daf93090-6a61-4c28-adab-d0c00f7d9635", "value": "3072:vn+TF5ApC+s+d5ZjV71TaFPcRysmf5xcB2C1KSG5B:pp1s+jZJVaFP3d3c1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664197270, "uuid": "16273d81-781a-4fdb-848d-d1377dc4b4c6", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664197270, "uuid": "f29ea801-7241-4356-806e-600bee41079b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197270, "uuid": "ba0acd34-d0c3-4138-abc3-33a9458ace5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b01ae5-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptBot)", "timestamp": 1664173802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173802, "uuid": "863a6829-cd58-484d-b864-1d7dd23bdde6", "comment": "Malware payload (CryptBot)", "value": "e2342964d66c6ea58922daa2aed54d7c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173802, "uuid": "5f5ae984-fa04-4524-8cd2-b7b7e9af713b", "comment": "Malware payload (CryptBot)", "value": "0eae88088ee12fbbbffeaad58ce925cb599a38ca839a49f5a91c948fe5fa2686", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173802, "uuid": "1a00c272-85a8-4224-90d1-288b9a01f1d7", "comment": "Malware payload (CryptBot)", "value": "78d7528e23c7af493a5581e4a7ff160fcb3456a0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173802, "uuid": "02a4a486-6c68-4970-b093-df10ee7f03a2", "comment": "Malware payload (CryptBot)", "value": "84da5b5cbc6089eb91bd0683e00f5f0369814e1e66125b020b8823217987a45963c8bb5313ebbfeaf423325f13095c19", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173802, "uuid": "5966e135-9a10-4e5e-a49d-5785ca5ad188", "value": "T1F9C5E3F7B9B393F3A7C06E2494C878A40D55D6334D44A17C680152BC9A3B3EA51EFA36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173802, "uuid": "0258f34d-c162-48bc-ac64-1c41b5c3bde7", "value": "ddccc155b1fdc537a66884e418ebef90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173802, "uuid": "8e2d0e5e-daae-44ed-b437-386f50702716", "value": "24576:YnWT1OgGnsPIrSTX1Yk0xYKAl4KdpRy/GoE8u7ubsyPKvcQ4XGrF8elKB9+JSI0h:QyV2uX4AlAb5kjFlml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173802, "uuid": "0a90858a-24c6-4a54-ba5c-27e01bd4e2de", "value": 2567168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173802, "uuid": "e896a876-a7d4-40c1-ae7d-b1e4803202c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173802, "uuid": "4065da8c-57ea-47ae-9ecb-d7f0e2c6bd50", "value": "library", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afa9b47-3df0-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664233831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233831, "uuid": "64d38a29-a9a0-44f8-97c7-293e918eb737", "comment": "Malware payload (Loki)", "value": "419afec80fe2985d7ec3a4f4b743ba7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233831, "uuid": "d0f29071-2d74-4c71-88ab-82cf9dc643c6", "comment": "Malware payload (Loki)", "value": "0f05cb1b46ce9bd63fecf64c99cbf2ac0136dbcbd87068c582103d671ca01871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233831, "uuid": "7fd932a9-e60f-417b-b872-442ba5c2170c", "comment": "Malware payload (Loki)", "value": "401eaf64885601d915e765e2f5b9286f6c1c7d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233831, "uuid": "a5b5a2dd-36f3-4bb8-83e0-27016a3c14a3", "comment": "Malware payload (Loki)", "value": "145a63c2b4298f6d51edcaaa60f6740d33214a142143e871281210156f63a3d94e61511da9da012dd159e05cd307e1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233831, "uuid": "ef66ba50-e536-4c29-9b0b-bece40a2acb6", "value": "T12E05D0241671C50BCCAAA570DCD2F2711EA85DC5876FC24B0DDC3DBBF63A29869913B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233831, "uuid": "a1e8c788-02cd-43d6-92cc-e82092dd6763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233831, "uuid": "230bea76-a1b2-4a00-a0f0-74bbb819368e", "value": "12288:jdV7uikFgsvSZ9IuDVlbesu2TFZGyetPWA2v4A:plubgLDVlbu2nbeEA2wA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664233831, "uuid": "e55ef4d9-9cb9-4d8e-8818-fb187c88d0c0", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664233831, "uuid": "0d085560-c27b-46ac-ba99-ec3dd1478598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233831, "uuid": "ba8666ed-93e8-4514-9988-b915e4624d90", "value": "tfWsfoMcfMz3shm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42468680-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664200691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200691, "uuid": "078efab5-e3b3-468c-9df0-ea3f4c70c442", "comment": "Malware payload (Gozi)", "value": "1eed97b02e792dc7bee2949d26dc6d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200691, "uuid": "7d7a42de-35de-4db1-8dc6-805c7b3ce8bd", "comment": "Malware payload (Gozi)", "value": "0f24c819947ad410e0d85d41218f8a940317aeebbac32630fb29ac5917c4ca46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200691, "uuid": "fd0ca673-1690-49aa-8139-80d1833fbaff", "comment": "Malware payload (Gozi)", "value": "e8d8733502980550a6d067530b71a46a13a37ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200691, "uuid": "3868c10a-8737-43cf-b429-fc9a5a90b0eb", "comment": "Malware payload (Gozi)", "value": "c8be9d9cacfe3958a4c8e10bdbace8bf6226f0ccad26bc7b972f41ff9bb986a7c843bb107d711c820594a6dc11614f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200691, "uuid": "c3384d3d-745e-4a5d-95fd-d468a33e28ca", "value": "T11F346D5EA3E10995EDABD5B5C953D217EBF234492B64D30F53B0CAA66F17322B21C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200691, "uuid": "4720869a-8c8e-411e-a258-d66061157dbe", "value": "3072:UlfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqAdw5VgCK5hcjxOxJFocW:UlDosEPR66q9KgylInd6oqAdD5DnFoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200691, "uuid": "62dc8025-9f92-4110-b676-5db7574f3aa2", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200691, "uuid": "1f4b3fac-0bc8-467a-a02d-145dbe0dec9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200691, "uuid": "3af8f6f0-f171-4d7b-a24a-8ed96377dfad", "value": "51f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ca630f-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664214983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214983, "uuid": "f76e015b-84df-42f7-a89e-3c9ce09656f8", "comment": "Malware payload (RedLineStealer)", "value": "2ae08b2b339f8593d743991cce0c747c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214983, "uuid": "040d8220-90d4-492f-8932-a36f0c3c83b4", "comment": "Malware payload (RedLineStealer)", "value": "0f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214983, "uuid": "bd6f01d9-2a7e-46ef-9cdd-2a1dc6bc37a2", "comment": "Malware payload (RedLineStealer)", "value": "d99acc1fc5702475f27c729be631fb0c4d2f1625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214983, "uuid": "eabbd7a1-ccb8-458b-9731-1b8667ea8506", "comment": "Malware payload (RedLineStealer)", "value": "ede2e6f90983bfbf574bb6fb4f0d89238970c8256a08472fbf481524f60c30331053bc0a7f91269d8649375f55e431c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214983, "uuid": "f9fe9ca2-9077-45ad-b5f7-c1a114380c4f", "value": "T190D3E022BC90D473C02385752934D591BABEB8122FB5494B376816AF5F313C26F7A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214983, "uuid": "dddc0366-832b-4828-98d7-85fe20c855f0", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214983, "uuid": "24fbc3f6-4179-4f2b-af50-36d80e1a346d", "value": "3072:YKiT13Tc5d/Lb4dc+oytXrlvfYa1f+Mxn5B:E1E/vD+Z2aJ+Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214983, "uuid": "0000544e-1c9b-4bed-9b5f-21b0d79a2960", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214983, "uuid": "1b4c3d03-f1bf-41be-b098-b18950667317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214983, "uuid": "b849bb70-8343-46d6-a1c7-a026a4f9b02e", "value": "2ae08b2b339f8593d743991cce0c747c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3050f8-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180446, "uuid": "cbec8d8f-ebf2-42be-ac42-819106f3baa4", "comment": "Malware payload (GuLoader)", "value": "89fa0abca9d43a841debbaa17dec8363", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180446, "uuid": "4a1ad89e-e7fb-4f00-9fdf-257f52b083bd", "comment": "Malware payload (GuLoader)", "value": "0fff4fa9d8641b257752a262478ceab180cb5d24a4061a7d9c2342d4564496a0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180446, "uuid": "a1afb663-954b-47ea-82a4-648bd3f94cb1", "comment": "Malware payload (GuLoader)", "value": "58decaa3580975f352dc3c00dde3c758fbc7d5b6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180446, "uuid": "ffe5a6d8-b9a3-4b5a-9fcb-cba76d6ee68a", "comment": "Malware payload (GuLoader)", "value": "04bce5349dbe1d32ef00335d41790bafc849089f1015191b227f55ca3a0620013f49f9381088ae50d3609eea4554e1f8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180446, "uuid": "5504ad0e-88e5-4034-8991-800d726d9e66", "value": "T1BD1473248524FCF4730FB168DC150E5E8099A1224FE1252CF76275E5EFA5B108BA6BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180446, "uuid": "8e42a0b2-da7f-4b8f-9e74-e2bcb0d3bc0b", "value": "3072:FNZxMEO/A4gNag4XAi9t+cYT1ZCrRQVevM8K4Ec5Cbt:FNZxMd/A46liAuYT1ZCrROe3Ecw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180446, "uuid": "f2bdd3bb-e79c-4c4f-8361-7c0d67f94e54", "value": 191009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180446, "uuid": "20ff3609-5acc-4297-b116-9df7efbd82c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180446, "uuid": "838ae29c-bbf0-41fe-9c37-ef0550cef9d2", "value": "Facturas Pagadas al Vencimiento.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed13aa5-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212846, "uuid": "f6ab60af-11ba-4378-af5a-6b1a3cda0caf", "comment": "Malware payload (IcedID)", "value": "bc56cd4b450e2e765c83a5a5260a7f14", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212846, "uuid": "ba66b46b-7ab3-455c-be1d-5676a1932b4f", "comment": "Malware payload (IcedID)", "value": "10c00de5df9f12d59e7113dfac0618f26a8b16a19312c576c616ac757e4448e5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212846, "uuid": "076649a0-7081-4d55-a9b7-07e53969ee4f", "comment": "Malware payload (IcedID)", "value": "4f71714b7208ca4dac5a57f68281245ae629cbc6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212846, "uuid": "d4b04f3e-cfcb-4eb5-b52a-02126b2a22a9", "comment": "Malware payload (IcedID)", "value": "e27587793afa44f43632ff012e17be402cd9b5fcb826b7d0d1da54c2bb7a4be722ba97c067b2c568cd0fafdbf59321de", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212846, "uuid": "00dc3034-639e-4959-958f-7e2881a5692f", "value": "T1C615F101DF54206BF00B693E371369D7A8621C2B704BDE1E6B86112E2AD7FA0FD36D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212846, "uuid": "14b62af9-dead-4274-ade6-32eca52a4475", "value": "12288:UxLQVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEPHNxrp/G7obtDufWG:C8V2jUeQRI5wPN/uHNGsZqfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212846, "uuid": "aa4c06b8-e474-470b-8b30-bc4fc6063683", "value": 886892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212846, "uuid": "4f79148a-87c4-4720-bd2e-8c1fc4abed02", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212846, "uuid": "4ce29522-bfee-4d85-b529-3b50c503aeaf", "value": "neorealms.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868ee1c3-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664181049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181049, "uuid": "2347cf0c-6c01-4d08-8308-f78219efee66", "comment": "Malware payload (AgentTesla)", "value": "676841d9d559d269ce233595d5a028bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181049, "uuid": "57428a88-33c4-4209-ad44-ee8c812df5a0", "comment": "Malware payload (AgentTesla)", "value": "112dc41a2dfefecd437219db319a9359c036e1319a4361dcfa2f7e9b2d25620c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181049, "uuid": "343947f0-0c24-4bd8-a09d-981749f3d315", "comment": "Malware payload (AgentTesla)", "value": "6839653c8693b81ec8825d2b77ff8d764efc94b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181049, "uuid": "2f7d41c6-f85c-400e-841a-3d2efdae1d4f", "comment": "Malware payload (AgentTesla)", "value": "d658571cfb29034ce15ff96a07bd0932ff9021ee2a9decd56700cd04c1eb4ecd1f4bd8cdd3afd97d1e34982eafa7796a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181049, "uuid": "a8e35ac8-08b0-4760-a6da-bac23193a4b2", "value": "T15935F12627FB8E07D22576B8C5D0C2B697B49C01E163C2872FCA5C9FF0967D58A90787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181049, "uuid": "6cf9de7a-f806-452b-827a-d17d07007465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181049, "uuid": "fc2b14cf-b4d4-4adf-87a4-db0453bf10f2", "value": "12288:+Eyiy2sz74MUBhVBE4SskO5DaGv8pLBqTRQV+qXQ2kJw:tDxsIBEzBOIKQV+ZZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181049, "uuid": "a2f83945-7510-4e53-9c29-d6c558bb6cfe", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181049, "uuid": "b994461d-a27a-40fc-aeeb-f96154a1f204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181049, "uuid": "a72f0fff-7673-4593-8a50-1edffdcf7247", "value": "676841d9d559d269ce233595d5a028bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f38cac8-3db1-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664206726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206726, "uuid": "6c06c42a-e3ad-4012-9999-7f1259879a59", "comment": "Malware payload (AgentTesla)", "value": "46ad033d87bfe0829043c36680885411", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206726, "uuid": "ad36ac46-0de1-4c37-9445-d7e231938221", "comment": "Malware payload (AgentTesla)", "value": "121d73e43400fe5a870587386f67630392dd8051317fba9e3d3374f019269c12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206726, "uuid": "7cb0f3a9-4392-4261-ba7a-7eb7f7a75dc1", "comment": "Malware payload (AgentTesla)", "value": "1a1e934f95c702b716276014bd8bee205a936ba1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206726, "uuid": "4fd88d7a-e070-41c9-8a42-c29f3e53a0df", "comment": "Malware payload (AgentTesla)", "value": "3f27c162f8cc4e9c00cca1ffb8540db9e2a0d825d0057e1d25cc7e795be8417bd19c0f81685cd4338cc0c25a9e1ba932", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206726, "uuid": "8029190b-1f8b-43a4-98f6-46c58b91087f", "value": "T11045E0141765C906C8AAA574E8D2E2701FA86ED4836FC74F18DC3CBBB737358AD913A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206726, "uuid": "f0a740c0-b6b4-4d74-b62a-6fa8daef0ad2", "value": "24576:xBJUxGCCvinKShiFoHe/7pD1vAHc/JiUY:xB2rCbShiFF/vBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206726, "uuid": "799eb1c7-9a97-4240-b89e-0320a3dd6861", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206726, "uuid": "907e6330-90f8-4f44-8949-a18ad0642764", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206726, "uuid": "c6ead958-e6cb-454e-822a-d2fe4474c475", "value": "Egypt Order.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6546dc85-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664179275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179275, "uuid": "d301912b-815e-41a5-b241-97a13e3d3d6b", "comment": "Malware payload (Stop)", "value": "2eb05bbf53759b8711315c294677a31b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179275, "uuid": "77d9d8fb-889b-4a7b-a406-fe43f6c4acdd", "comment": "Malware payload (Stop)", "value": "1248ccc30f075f16e065e12487f2ff751bce845bc770b2430043e877c54bebfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179275, "uuid": "9758c351-3a5e-4bf3-a93a-f756a485f1f4", "comment": "Malware payload (Stop)", "value": "b239be283bed86213e82a9297d7c8e095b29127f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179275, "uuid": "f754c641-5b4c-4810-b89f-6eaa97473426", "comment": "Malware payload (Stop)", "value": "5b9f30f7fd262540f217e39159471f9f2150070fc3b6fe5cd469943cbd6bc42d1f1966e3495da2b6b11a32ce07e64b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179275, "uuid": "cd24cd4f-b3d9-4c18-9027-c2af510c1024", "value": "T1ACE423917FA0FA52F1324A3D8C1591E1E30EB4931365A5432785EEAB1F316D27B7E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179275, "uuid": "5b9d264c-fd36-47d7-8cd9-7b1e99a757cc", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179275, "uuid": "a08391f7-b8b1-4a46-ac53-9486392fc47b", "value": "12288:BLNT7FxXQCYTbag1ly5r8pMTeDm9M4Lvs/a0Va2u0tpTo2i5K3S770G44yc:Bl7ZC+zQm9Zvsy4uATol5K3270a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179275, "uuid": "7e0f5358-2494-40f7-8434-bcea30fcf082", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179275, "uuid": "ee177873-27ce-464d-98e8-7ca738bfc046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179275, "uuid": "12585e12-79c3-4684-8df5-5948ebec10f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518638a2-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180531, "uuid": "90b45055-d940-4dc7-aa81-72c4d7d3a20b", "comment": "Malware payload (GuLoader)", "value": "06acdf5de8b3b26b96a9147836decc49", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180531, "uuid": "e80c4322-179c-4d56-9686-1d412b77a349", "comment": "Malware payload (GuLoader)", "value": "12dd0148f02ed0a257b41784311a98b98db4a501f8f94a2b65c5a9bc3cd10451", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180531, "uuid": "61bd5aab-4247-4ab6-8b19-377fafb99485", "comment": "Malware payload (GuLoader)", "value": "c7e68cbbe9a5ec40e10a2013512c24e768b0c53a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180531, "uuid": "5a1d7b4a-2a3a-41ad-a522-9d23e1599a53", "comment": "Malware payload (GuLoader)", "value": "83ae66ec2e99c4923a71f668b267a97f75e25d02b02d8cad7b83ab133df76c470ef4abb0c99fa5be4526a48daa2135bc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180531, "uuid": "615b6955-5540-4b40-bef1-1cf146720e17", "value": "T14604813A9959DCE4B70D793CC0094ADD884DF383E72327EDF52031A9BB9A7408B155EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180531, "uuid": "ca681f5a-529b-4069-a7ee-d2938a267aad", "value": "3072:Fmi1FFbPmgq17iT1Kd5nTuZ6RlZ36CsBFX0FevM8K4Ec5CsW:Fh5rmgqKYn6ZWZ36CsBFXAe3EcwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180531, "uuid": "48459719-61dd-434f-90a6-459ef9295576", "value": 185378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180531, "uuid": "9f432b81-ab07-4a74-9fb7-4c8344fd9cee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180531, "uuid": "adccf6ea-5146-494f-be56-cb01f73bc66d", "value": "SOLICITUD DE OFERTA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e76192-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227325, "uuid": "ad339424-8e82-44aa-bd49-b2673074c5c6", "comment": "Malware payload (Mirai)", "value": "4b58be675fda6eca0859e16d88aeff89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227325, "uuid": "e1e0aa27-15f0-485d-a784-b50790cd2f07", "comment": "Malware payload (Mirai)", "value": "1371a4e1b36844e5acddcd48c46b385e9122133f967ffdd691bc3138ce5a616c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227325, "uuid": "a5d6cd2b-f399-421a-92cd-8131a6af8b9d", "comment": "Malware payload (Mirai)", "value": "1c5656e0b85d0d5c73f07a3b3cc7e4038b7fe5a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227325, "uuid": "cb1fa149-bb00-42b9-b0e2-b23015f8a32a", "comment": "Malware payload (Mirai)", "value": "3cbecc185e85bb64352439bef73792b8e57aa3499fb8f0028102db710bbbee20a938a9c1d6d0d407fec76b8880db9c6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227325, "uuid": "7eb0acad-dc92-41bf-bd85-9e3aefb80cab", "value": "T1FAD2E1D1E2A11D19EDEFCB703F9266D13FD71D9C47E29DE210969B11180B22B6025DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227325, "uuid": "6484eebd-1f60-40eb-a76e-516e7e3d4875", "value": "768:tRbRgPIaFm9O5HdV8tSEifMfA7ASGbOBZZ+sj0ZY4uVcqgw09a:tPgPb49G9eVFfB0Zwsj0ZY4u+qgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227325, "uuid": "8f817823-da29-4a6a-9933-f7f84f57e05c", "value": 30608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227325, "uuid": "88197a32-9890-4fa9-b84f-acf2566d1e08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227325, "uuid": "c54ccc30-f9ac-40f5-a1ee-a3903650da11", "value": "4b58be675fda6eca0859e16d88aeff89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadf7590-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1664180332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180332, "uuid": "3f8f58ad-ebf1-4d96-ab44-94f4e2203ada", "comment": "Malware payload (NetWire)", "value": "4d3137651038dfe44ccf6440f6281dfb", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180332, "uuid": "0064a789-7193-4813-b77a-34807d9a83c0", "comment": "Malware payload (NetWire)", "value": "13c9bc1d2ac60ca5abb5a235d7d27d8c6f06e497da360f391785044d413cc29e", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180332, "uuid": "6eb54242-6bb1-488f-a5ec-440b02a3d00f", "comment": "Malware payload (NetWire)", "value": "2d28e875fca6e4f945b5165b03f9aa7747764836", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180332, "uuid": "18e5e8b6-1399-4e8c-9131-f0257e92a230", "comment": "Malware payload (NetWire)", "value": "94823be0baf84a1668fe8bce63b4e0b9b62d8b56335f67ee630e99abb89b64931767ae318f21aeef45dff880d2813d3a", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180332, "uuid": "c733bfc4-3311-40d3-a868-3b6e07af45ea", "value": "T10DB3D503AD448587E41843B9BC934EED2E19BE08ED5726FF30617FDA3E742528D5B12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180332, "uuid": "db8f5f5a-2460-481f-9b9b-77c0cede64cd", "value": "3072:z9xEtjPOtioVjDGUU1qfDlaGGx+cL2QnAB9pWkmanzr0O8yFKdshErls4:JxEtjPOtioVjDGUU1qfDlavx+W2QnABU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180332, "uuid": "8f873dbf-b1a0-4c25-9322-56b5d25870bd", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180332, "uuid": "c5599f52-c308-475a-8203-1e4eb991645d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180332, "uuid": "e131bbfc-089c-4688-a928-1300c1a359e5", "value": "PO 0767532.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c907a851-3dbd-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664212084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212084, "uuid": "c75d8b34-f4a2-4871-8997-164175fcd7af", "comment": "Malware payload (AgentTesla)", "value": "167499da1cce8c972ec866212572ff6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212084, "uuid": "99395711-8fb2-402c-a475-72c6389298f9", "comment": "Malware payload (AgentTesla)", "value": "142aee505d9fcccf44056a13f42009003caabd6811c2fd63c20df8a48e9f6683", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212084, "uuid": "e8f2cf07-0365-4be7-9cca-1d21f7ea4718", "comment": "Malware payload (AgentTesla)", "value": "67204ee2ec2af87b8d060e9f0fbac2ac5398cf10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212084, "uuid": "1d058ae9-8259-4b50-8e43-fe252c216c88", "comment": "Malware payload (AgentTesla)", "value": "e752791d3955468efa64d81dda81acc7d666c86334cacaa7541b0d5ed5ba7910d933a8f27c67f9da8157dabfd49c6a64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212084, "uuid": "240c1e7d-0411-4c97-bff1-f896de820727", "value": "T1370533E1B9276587ECE51DF20F1D3829E0894BCF9248E62FAD75149D83FE35A864142C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212084, "uuid": "eb4baed0-2636-4130-9100-bf91b1089269", "value": "24576:VX4919m7z0mXkvFQnIerKLlQ0u3q9T9Wit:ha19mcFQICKLlCoT9WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212084, "uuid": "c3231e9c-a914-4ec6-9f25-8d3e17e89892", "value": 856916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212084, "uuid": "5aa2a837-9c4e-445f-a369-f9d28a32b237", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212084, "uuid": "3dfb05dd-5a80-473e-bb8f-31a2fde7c84e", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032e251f-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227214, "uuid": "378e7092-c721-4b4e-a959-07bc150c6bf9", "comment": "Malware payload (Mirai)", "value": "7efa66b91d9784ce61066ffa1e8e96f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227214, "uuid": "6536e827-f093-4115-90d9-ce97dea62161", "comment": "Malware payload (Mirai)", "value": "142d1adb1da218179713a4a8206836085470e0fe11cc44be8d10965817e44268", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227214, "uuid": "becc22fe-d8aa-4372-a864-a039aaec7615", "comment": "Malware payload (Mirai)", "value": "9cc50615d43a41fa453e0d9b864889399263188b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227214, "uuid": "7d40ccb2-c3d3-4f8d-b745-33357a25bc54", "comment": "Malware payload (Mirai)", "value": "bc9e7898655e68af7fbb05adec5c265b6a96bc3a7a648ee2821b5590bf211d7eb645d609f7491f205d6ee4743eadca92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227214, "uuid": "cea70904-87d7-4b93-b928-8d9a10620c79", "value": "T1F95302213E974221DC706F3AACD442A87BA72FFD788930364E99404CF1FD898DD985A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227214, "uuid": "7ffe4f04-0921-4134-b657-1f8026697d48", "value": "1536:P4NxOuyWp1KbhxFL4bpNWYxLY4zsifmx9:gNZyke94lTLY44z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227214, "uuid": "59e74069-dc8b-498c-938e-9cafc072a103", "value": 65380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227214, "uuid": "aa2af150-07e8-4334-bbac-3e2c156585e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227214, "uuid": "4ffdde1a-6ad7-48c6-9c33-903ee13aaec7", "value": "bk.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c994af-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664180947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180947, "uuid": "65d7b9ad-d44c-4c83-a03a-b469d70d45d7", "comment": "Malware payload (Formbook)", "value": "7388350bf9b3ebf5b2844567dc955104", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180947, "uuid": "549ded07-05f5-4572-ad72-fdccc92a31bd", "comment": "Malware payload (Formbook)", "value": "14b54b7a4da97a23f3087f1b7641136dbd2d54930722dbf44afbc582e8aeb93a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180947, "uuid": "e8394460-ba6f-4e44-b0f9-0b72fd8c9f82", "comment": "Malware payload (Formbook)", "value": "f800d42c08489275a2afc0a4fceb8c8f65ef5da7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180947, "uuid": "5d5e7015-55bd-424d-8c9a-ce75bee95724", "comment": "Malware payload (Formbook)", "value": "4bc94def46f1c101cb8c6356761eb6caa1e5a0df2a338cf360394e37f28d37daeda87343aa82080b7ee93ce9ecadd955", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180947, "uuid": "bc659def-7eb3-40f5-a5f4-b73e3e35e083", "value": "T1EA25F1370BEA8B0BD152B5B895D0C7F5A3A9CC10F56BC6977BCA6C1FF08A4619760311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180947, "uuid": "70b9b75b-1b18-4115-8d36-fa8f649d59e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180947, "uuid": "1a457b64-993e-4e7f-aac0-99d687197de0", "value": "12288:YIBRztPkLPntp0mfogYFuoTbT9DjSt1uopLUzU53YW6B+8sEd7yy:YIf5ip06o1u09DjIRLdI5+vEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180947, "uuid": "a737c324-97e5-48cd-8c5e-16b970eb842a", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180947, "uuid": "4688d0d4-5342-4972-813a-eab69967b3fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180947, "uuid": "1ba259b3-577c-44dc-9ca3-eac18345a547", "value": "DHL Shipment WaybillDoc_TransportLabel_3950350973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b1ecbc-3dad-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664205039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205039, "uuid": "3b76ffb4-62cb-4a07-8c4c-821f1dadd15f", "comment": "Malware payload (IcedID)", "value": "4a94ea3988c8c83e6618aaa256ba3b6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205039, "uuid": "138927e8-d8d0-4064-aab4-90ed5f43d8ea", "comment": "Malware payload (IcedID)", "value": "14c55b751b375e41af83f4c53753ec849ef368396cfc0e2830d92fd31383fab7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205039, "uuid": "87f8662e-f328-4738-9de1-a70046a0fda4", "comment": "Malware payload (IcedID)", "value": "1ef1dc961fdc47643fb0572daee1d80c018bbd75", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205039, "uuid": "8eb1064a-229b-4526-8918-cbbeb50b662d", "comment": "Malware payload (IcedID)", "value": "545fc95af4262a7881d246257faf072f56282b7d75702e0bfbcea057eeb465a65f121fc12d5b4d07bf9b6a64700c5fff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205039, "uuid": "2677df04-972a-4113-807a-2ecb8c4278ce", "value": "T1F06408D9B792B0A6C3E37574403F010BE27B6E91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205039, "uuid": "a64ba8c1-4544-414a-b410-ee513125ac95", "value": "591e93c0276c7f6b587ad25fb1904529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205039, "uuid": "2360acef-2d66-4f35-be42-668beba0705d", "value": "6144:UiaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AFN:UiaxP58X2ikP7U1AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205039, "uuid": "397fffb9-dc3c-4db6-9615-cd283819a4f7", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205039, "uuid": "a3efb632-255f-478b-9ae0-e1c2cd80e137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205039, "uuid": "e1883554-f768-41ba-90ef-7866f873cefc", "value": "4a94ea3988c8c83e6618aaa256ba3b6c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d8d7ff-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215871, "uuid": "baa6bc64-19a9-469f-8a46-06e721879985", "comment": "Malware payload (IcedID)", "value": "f1b461547f3468c1778c0aa5fbe659a2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215871, "uuid": "63123ed8-0f1b-48b4-8be3-79ffbb8a7a0d", "comment": "Malware payload (IcedID)", "value": "151e6e9aaffbc08ecaaba6feee9868708a69a686d67a64af41f749a05c1fa220", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215871, "uuid": "3204991c-948d-44f8-89ea-34a897a77536", "comment": "Malware payload (IcedID)", "value": "b0a6659cffa96b61cb489ff494bcbe0a765792c9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215871, "uuid": "85dc28a0-34fc-49aa-9361-76a8bbae0198", "comment": "Malware payload (IcedID)", "value": "e81b3b6ae0bf9af3174900f80d167278a0d89942d8312ae25a1ed5e4fca1cb4cb28a3bee2169676d7373fcfb50ce63fd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215871, "uuid": "e08643e2-fe7f-4d34-b738-eb3bcdd0f374", "value": "T10E15F105CF50216BF00B683E361725D7B8A61C2B704BDE1A6B86112E2ED7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215871, "uuid": "98ee1b77-c967-4490-9dd3-a36274d36c81", "value": "12288:EVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEsnjPTx7trGxzFZjFDGO:EV2jUeQRI5wPN/RjVtr+ZHKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215871, "uuid": "42a1b51b-a63a-4f83-b16a-e039fc52ab94", "value": 886640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215871, "uuid": "3a9df040-a31a-47b1-9716-4d549d1e9043", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215871, "uuid": "8f263d8b-0d68-4bb6-a43f-5b01d11f7d3f", "value": "johnsonprewitt.doc.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe23a512-3dd5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664222481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222481, "uuid": "fda87c10-b6f4-4283-b398-47415efd4ffa", "comment": "Malware payload (IcedID)", "value": "0c790ade0e13967f93beb4d2026f7cf2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222481, "uuid": "058ce671-355b-492b-8051-2f4b07c71dba", "comment": "Malware payload (IcedID)", "value": "1630d71da594875c9aa1fd50a955a8adfe02a3bb54d1aa610873cec89ca32911", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222481, "uuid": "242143a0-a74e-4a98-b03b-7de97c7b5be9", "comment": "Malware payload (IcedID)", "value": "f45c50bf7431bda1d1687030910181bc6acc9252", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222481, "uuid": "02f1b0ab-4d90-4e02-ba1d-ea10f049caba", "comment": "Malware payload (IcedID)", "value": "b8fb6f4108418e5c218aae0008cf9c8fbf215221928567f2c1aaebde6e43d3ba9e7add93f235262926f76204abd9bbdb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222481, "uuid": "a1841d2f-e96f-4568-af83-4d4759ea8492", "value": "T14315F105CF40216FF00B693A371365D7E8A61C2B308BDE0A6B96116E29D7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222481, "uuid": "5c960e17-3b30-4d38-8af8-820fd4a170ce", "value": "12288:nmXVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEQHAgz5PprKMmD:4V2jUeQRI5wPN/uU5xuMmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664222481, "uuid": "ff53e7a4-4b9f-422d-ae2d-a79ccda44aae", "value": 886974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664222481, "uuid": "c3b4cf94-39fb-4f28-ba3a-2d74f621de6a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222481, "uuid": "9ae84c07-6915-4fd8-8718-6df3faf4ea41", "value": "mobiletel.document.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb46ded4-3dbc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664211659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211659, "uuid": "7a6e1e8f-9d64-411a-b571-f593eabc84ce", "comment": "Malware payload", "value": "1c6d09e4351392dcc3a33c1d5559dcd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211659, "uuid": "0f232415-ae89-4d0f-8915-34a6b0badca1", "comment": "Malware payload", "value": "16a2f37bf17f5910fe04573fb087b559a9c5956bee545553ed74643d5809ad3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211659, "uuid": "88199eba-170c-4e3d-a29e-19ac9a5bbb01", "comment": "Malware payload", "value": "da977637c9a53ea2ebc07db1930f37b3135cf6d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211659, "uuid": "9a4049e0-febc-45cf-b413-b4c8d38eb9af", "comment": "Malware payload", "value": "05dfc9ae9dd2760b9486fd19a2cd43b58d645947cddc65a30eaf7cac759fc4d9d64019502a2cf666d89dc1251244bce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211659, "uuid": "94d323e1-d849-4476-bd70-3824384af0ea", "value": "T10F76333271E486F6D0700A72CE9159ABB5F9F39107605C1F27D08CBC9D396ACC56AB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211659, "uuid": "2a90019e-cea6-4820-9207-c384ee16fdde", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211659, "uuid": "e398868d-d525-4661-a824-28717d4d6e97", "value": "196608:91Okp2/vygzo872WEYL+YrifiJiqkjcFzmjb7T:3Od/v7zoVwCY6iJpFzo/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664211659, "uuid": "b504f122-1ef3-4579-a60c-e6da20bab1e0", "value": 7584276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664211659, "uuid": "36f701a3-00a1-4eb8-81e1-5c0604fa5bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211659, "uuid": "cb16f02f-0306-45eb-9613-576c00231b33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19276365-3d87-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664188597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188597, "uuid": "b2231d71-9610-4b58-9bc4-49fded5e77c7", "comment": "Malware payload (Smoke Loader)", "value": "478064ef2fd82ee5bc2d9f603f3b840a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188597, "uuid": "17fbd9b8-c976-4439-b301-7d6dfd3228f4", "comment": "Malware payload (Smoke Loader)", "value": "16ba3f1a51a7c10ec770d54496ef6964760e3181b60a6c5f4da34e8c6c66f29f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188597, "uuid": "702d38e9-8405-4662-97f0-05d63a3e8f25", "comment": "Malware payload (Smoke Loader)", "value": "9801f7a9be65ec207109805e00036869202709a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188597, "uuid": "151422cb-7d7e-4c3e-a31c-864dd290b291", "comment": "Malware payload (Smoke Loader)", "value": "4b8880be160b6fd5fd0309347d63d2a3b4355f7c4e550d8a90c0e35d204577c868c71d75c3bc5460a7afbcec07e9d185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188597, "uuid": "2a49489f-cf43-4580-aab2-cc85eec0cb1f", "value": "T112E3F151BE80E8B2C01199741D38D751F63E7C60493B49833B986EAF6F722C36A76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188597, "uuid": "970ced87-bea6-4468-8bae-3a65e44296d2", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188597, "uuid": "a79e0929-e57d-42b0-b1bb-1821a52d99d0", "value": "3072:ajeBZz53nOdy60n8EGEZgMwl/E3b+CzVDCGVBbTOwhP5B:aUek8EjZnwls3iMVmGzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188597, "uuid": "0e54cdcc-0ca3-48fc-bc2a-71075e00fde7", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188597, "uuid": "25ba8dee-976e-45a6-a9f9-7b07d7fc22b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188597, "uuid": "3e2d2116-8807-472b-9b32-850c2bd185f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132882a4-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664201471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201471, "uuid": "41958eee-ad08-493a-b071-ef7305ede6f9", "comment": "Malware payload (AgentTesla)", "value": "ac03ef0f1ec77313fd15ac602d06c8bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201471, "uuid": "52453697-884b-41e5-8d64-761a49d43e05", "comment": "Malware payload (AgentTesla)", "value": "16cc568d2f7b7c7193c183b51383d69840ec0cb9cae4ba931367bd45aaf37b88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201471, "uuid": "09bc5b9d-aff1-4b17-8adf-df40b07b087d", "comment": "Malware payload (AgentTesla)", "value": "141560112543283541e471af19ebb8ade56ae549", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201471, "uuid": "741dac9e-1214-40d7-bb1a-0c49045a8908", "comment": "Malware payload (AgentTesla)", "value": "f8595ef4b18a8b25674cd532536b5d31a23122ebbe5d586191bcc8ede239e407885b772cd8c845f9916a13344f341822", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201471, "uuid": "a8a048ec-bbbb-4406-b8bf-0b9325e979d1", "value": "T183B13CB087082FDBEB1A60B5D9587F2D0D16F66951CB2984395CD5F00F8FA30AE35802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201471, "uuid": "d9a46461-c5cd-4dfb-bf96-3f23a5cbc03f", "value": "96:8Hp0quBtTz+Su0V+MtLDA5WyJFvkGxllSn27Ya4pee+uwHMxHOzBbqb:8HuLtP+Su0ptfAWqlSQYzkevHEbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201471, "uuid": "a87acabf-fd9c-4d51-99f8-ba7455e3eb37", "value": 5331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201471, "uuid": "2f492788-b7ad-4f1b-b0cc-ea5d73fc29a6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201471, "uuid": "73ec0a13-1ee1-4f23-bc05-e2853fa4f51d", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.30287.29826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e4dbd3-3da7-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664202681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202681, "uuid": "daeee415-5ac3-4825-8173-a7189f1b01c2", "comment": "Malware payload (AgentTesla)", "value": "8a746c543a8a6ae8ee4af431b878b70e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202681, "uuid": "ece7e207-ec73-4648-99fb-992e58dc232a", "comment": "Malware payload (AgentTesla)", "value": "16eb3843463270afc6d5583d41f6e3388f09c89c60b6901ae8f707366e773b04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202681, "uuid": "61cce449-3e39-4cb2-9545-ca1725d2f741", "comment": "Malware payload (AgentTesla)", "value": "4dddb2dee40bd74f8081ef65f4f0fe21d561efba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202681, "uuid": "fc5b7863-4614-4d4a-86c1-3a5e90c5e7a3", "comment": "Malware payload (AgentTesla)", "value": "ca66d2619deda3d69244b03b73b89d1367884d834e468e259c8dc72e66219ad6f63548f383ad789f20ba84c2fdafafe9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202681, "uuid": "be919f87-023c-4318-a0ea-b4700e8d0733", "value": "T165F42309CCB5B37C96EA58FB22C7F527D41068D37132F9123A4A05BDA72966CEB0853D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202681, "uuid": "26420eb1-520a-4be2-95af-ed3a5e26da80", "value": "12288:jTN1KzzLVtelUwX1mylU9ZW8wjGaatphidyB4Ulvd00GjJRzzDKVtT1PiNjNGx6f:3GzzptHyJaDaatz4UlvdDqwvi9yG97K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664202681, "uuid": "55abb277-9ea2-4175-b08f-a5c66805324e", "value": 751826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664202681, "uuid": "52c44454-b63d-495a-a99a-250f2fe55122", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202681, "uuid": "531b4ba2-8e4d-4428-964d-8adbb693bb94", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e51a2f-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215280, "uuid": "5c47369a-ff70-4d80-a961-ce68d447f060", "comment": "Malware payload (IcedID)", "value": "119d9873a73ecf1bb09217add9f7993e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215280, "uuid": "fffccaf0-3374-41d1-b71e-078231f21c20", "comment": "Malware payload (IcedID)", "value": "16eb58ed162137bd71290883d35032cbe2f7d68fbfd3b95a9ba2f61a55112db1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215280, "uuid": "57caefdb-1f9a-4314-a5d8-0d4b783c5454", "comment": "Malware payload (IcedID)", "value": "d527335c5f23f183db3293f27cd4fce68d2f42cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215280, "uuid": "267be3e0-f107-4fbb-b018-eaa8a1d1754b", "comment": "Malware payload (IcedID)", "value": "232df62f90fb40b017fe322c50bd4e63d8c332840fcbf5c27bd769a39c743c3c75b74f0e65b7b2993b5806804c18f4a2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215280, "uuid": "07d78605-7437-4fb2-9f72-d7df7187d339", "value": "T14115F105CF40206BF00B693E371365D7B8661C27348BDE1A6B92512E2AD7FA0FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215280, "uuid": "7ff4cd0c-8c45-453f-80c3-0afc4f7aef4c", "value": "12288:VgrSVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEeaG9kaRw+RWGgQ:VgeV2jUeQRI5wPN/NkARWGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215280, "uuid": "67063a7d-d243-400b-969a-fed628037188", "value": 886548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215280, "uuid": "540f0826-57d7-4b08-a63c-43f8430aefba", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215280, "uuid": "250cf99b-4ed7-4e40-a636-dcceea518bbf", "value": "illwriteitdoc09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd1ba77-3d5a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664169569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169569, "uuid": "57767555-d4e7-4297-ba98-ed6a439c6033", "comment": "Malware payload", "value": "3bcd92bcd73498c9ae419fe960eb383e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169569, "uuid": "dfc3dcd6-c5e3-4a1f-bfe5-83183dcc64c5", "comment": "Malware payload", "value": "178add5aa7634cf9ededecd6b991dad7ccd1f2487e3103da0014866c1be13187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169569, "uuid": "70148c42-ac6a-4c8c-9bb5-96721f004efa", "comment": "Malware payload", "value": "a112fec38d25869ba55b6eb9b1d934a7ad9a1d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169569, "uuid": "c8378b2c-538b-4722-ace5-17b02a883450", "comment": "Malware payload", "value": "99a7e83f7502329b56da0f77288d38dcbab30d951d91dc3de01333bf51b3afa6646774e1b70db45598a9ce195d1b5e53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169569, "uuid": "d400e7c6-2260-46c9-a2aa-430bfe4348b0", "value": "T11E7633A03AEDC7F1E0571133996116A493D69B8C0C90DABF13AB8ABE5D7CE4CD067D48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169569, "uuid": "37fab3e6-f0df-4eac-9bb4-668b50d4cdb0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169569, "uuid": "5972446b-18d2-4989-b810-071ef4e03451", "value": "196608:91OZRyxGkFYRAbSw9i3GaGyrdhLzuhMUhtClAgADO0I2Fq:3OkaKri2qfL6eAgADOdsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664169569, "uuid": "f70d9dfa-7832-4c7e-bcda-302595703c8e", "value": 7604075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664169569, "uuid": "931a3464-f17d-4d6d-a4d9-c3d3060075d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169569, "uuid": "d87ac655-45b8-4684-839c-56841afe41f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c766d8-3db5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664208371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208371, "uuid": "87fcc707-7cb7-4f21-9afd-80b24e9b3b59", "comment": "Malware payload (IcedID)", "value": "b985a77773a2d5226c31af6f3a108757", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208371, "uuid": "945c9e6c-5d1c-4cc6-9c3d-98300daa0673", "comment": "Malware payload (IcedID)", "value": "17a9a57035525ee568e49a9378b3f44f44e713205ac734c5d404ea5d0b75c65d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208371, "uuid": "5bc5e6dc-407d-4817-aa39-4970eb9eb6cc", "comment": "Malware payload (IcedID)", "value": "129aa01a276a17870bd6a4255f9db171b2dc7206", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208371, "uuid": "1d30e537-67cc-4138-8061-ec6979c677da", "comment": "Malware payload (IcedID)", "value": "68456f8e578908284b60ce5bc795814e3fd5b84dfc02d742e9a3729ceeed9706c00441f4babfdc32f747860ea9fb14cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208371, "uuid": "faa77f52-79c4-4178-9ae3-1c47d0c58785", "value": "T1E26408D9B792B0A6C3E37574403F010BE27B6E91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208371, "uuid": "39e8a007-bdd8-4f5f-860e-c7d813169980", "value": "591e93c0276c7f6b587ad25fb1904529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208371, "uuid": "85d5ce92-ca14-4122-82ed-b83be7f227e9", "value": "6144:niaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AFH:niaxP58X2ikP7U1AR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664208371, "uuid": "a96606b6-50e0-41c3-b083-3e0eef34bf40", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664208371, "uuid": "ea9e51cd-c2b1-48cb-874a-185365121592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208371, "uuid": "c36d208d-df1f-4c04-9884-4d21170f985f", "value": "b985a77773a2d5226c31af6f3a108757.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14692965-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664201473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201473, "uuid": "c41ecdce-ae3c-43a8-8352-9163f0271e09", "comment": "Malware payload", "value": "0a483db7de2cdc770473ab94daf5062d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201473, "uuid": "8820a601-1987-4f9b-8b62-33a69c55cefc", "comment": "Malware payload", "value": "17f2438a8bbd9ac5a40d6315ee68720395ff47a3a8c7d81175d9beff41476e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201473, "uuid": "aca549eb-7e71-4356-b438-a510acbedc2e", "comment": "Malware payload", "value": "a75b50e3b60364babbf4b3d2de259fd9bf75dadc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201473, "uuid": "55c6d060-d4ed-49ae-9a87-cc508a8c3c65", "comment": "Malware payload", "value": "257017e6e5f553b388e710e8d7e2f81495a7d0b95599de1d7a980186382508df0bd946770526be3b379f1896b608805c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201473, "uuid": "45c6e347-09b1-4ae2-ac25-1d78b5fd52c3", "value": "T1B7426D4AEFE54236EDD253B89C1793C82638E6606C13D34E788452AA7D0AF9C5F11F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201473, "uuid": "135831cd-ea13-4f2f-8f02-412803dc0dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201473, "uuid": "8a442b63-4a58-4193-90e2-c834d7b0ef3b", "value": "192:oml3UZ+YxoVjqqhvzS9iDA1DQp+AA7g+4OW4/4Ic6nGQrzXAY:o2E8YxoVRcYD8DC+k+IWLrzXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201473, "uuid": "50341aeb-0011-4e63-a3cd-499a195328ea", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201473, "uuid": "eaa3ef6f-4f1b-4170-81db-3fa43d4a693b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201473, "uuid": "ed4c9db5-ce11-471d-bc61-8fa0f6248051", "value": "SecuriteInfo.com.Win64.DropperX-gen.10198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113ded4c-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180423, "uuid": "f27ff36b-2ae1-4a8f-8221-4e275ebc4dde", "comment": "Malware payload (GuLoader)", "value": "1e54f2d2bde436d40a827f479a6a1921", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180423, "uuid": "af42bb08-c003-4a37-9da5-18452df7c223", "comment": "Malware payload (GuLoader)", "value": "18048a4437e07f55eda607f4f4a9d8dea0bbd3331c3c873eefe62af40b10bb92", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180423, "uuid": "b4bd7656-c2f8-417c-b62f-d4596318b897", "comment": "Malware payload (GuLoader)", "value": "2bdf01b5896c33ac0ff93f7293325a5a15864d96", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180423, "uuid": "08776b04-ff88-410b-882d-d7529fff70f1", "comment": "Malware payload (GuLoader)", "value": "d2283f535286fd12a675e64511ff78b775ed4ebcda81d7470eedea4496446cecab1defc57cd1c09830769911f0c221fb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180423, "uuid": "c2b96cb8-f655-4b9d-be6b-456144d0a905", "value": "T17A14A57085A3D8EDBF0D32F8B48C0B6D8174897F46D1052AEBC121A5E7A073E67751EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180423, "uuid": "333bb7f5-83c9-44c4-8d1c-f96c88fc8dbf", "value": "3072:FD4dPo1LSV8liv/e+V0l+2IljCkxpaQVlnULevM8K4Ec5COhCsL:FsdPo12V8luSs2IlZpaQVlnqe3EcwyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180423, "uuid": "6ce3bfeb-2cac-4254-a671-ba973c4ffad3", "value": 198692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180423, "uuid": "c0df338c-5b78-4c9f-8c58-9e917cb00dad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180423, "uuid": "48651406-9f9c-494b-84af-2f4871a72fb1", "value": "195727592-042128-sanlccjavap0004.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba83fa0c-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200893, "uuid": "986faa60-df2c-4663-9264-b0431dba7f4b", "comment": "Malware payload (Mirai)", "value": "45a0019d600b36b2ba176b180ac601aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200893, "uuid": "f34e2047-7944-4699-89d9-668aab7ea331", "comment": "Malware payload (Mirai)", "value": "1854ee774ae1eea612385aa533e44f15de4dfd393eda9074e628baf733e1dd89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200893, "uuid": "7c3a83c7-d55a-48e2-af4a-82833566e09d", "comment": "Malware payload (Mirai)", "value": "61e5552a6990b12a84322e7aa36c801c27e8e557", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200893, "uuid": "371ec917-a835-43f3-9bc3-75f14fe5ae1a", "comment": "Malware payload (Mirai)", "value": "60eb583aec3633620f4e71691a5d42da9d0cc66e299714c29ceeeb1a5d730671a292203c61bb089d191e097e86539201", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200893, "uuid": "2f739281-da02-4b2b-86e9-30b3a9d15c09", "value": "T15B833A81BC819A03CBC112B6FA5F158E371267E8D2DEB307DD216F2136CA91B0D77A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200893, "uuid": "cd1cd090-92d1-4ee7-b84c-111c08788bee", "value": "1536:eNOWAx3cApv+cGANNZkM5tOn8cxgID6rlkvjv82:QOWAx3PeM5K8cxgBY82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200893, "uuid": "b271377a-53fd-469e-9566-e037587ba8d7", "value": 87356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200893, "uuid": "2270e8fa-e81a-4fec-bd03-630d389aed81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200893, "uuid": "38bcf9ff-9a34-4ff6-998e-8d4aed35fde6", "value": "tamkjll.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaedadf-3dca-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664217543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217543, "uuid": "3330168e-fa18-438d-983e-bc38dfc0371e", "comment": "Malware payload (Smoke Loader)", "value": "c8190e4806644bf2ac09a546941a15ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217543, "uuid": "842dbcc5-3e76-4494-ba3e-b3614c61ca97", "comment": "Malware payload (Smoke Loader)", "value": "193344e0b6658427a8082b787bf15d1ee97119418a21a27a2e0f3d0355013f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217543, "uuid": "8da62f77-6831-49cf-84b2-5a607b2cb13b", "comment": "Malware payload (Smoke Loader)", "value": "d4dc107c1e63f161a387423898b179c54ab45792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217543, "uuid": "ed6b2b27-b51e-4518-bef0-878a27c7c7af", "comment": "Malware payload (Smoke Loader)", "value": "8b48f4230e56c8ecd8a4b1fac3c62373f84b1edcdc1f941edeea591e119001768b14e29a348f66e56a3e3ec1ee63c5b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217543, "uuid": "39d2df1d-8017-491d-a6f5-f2b7b776c98c", "value": "T1FDD3E1223AA09473C5234A752C24D245DA3BF5215A358D4B3758267F9FB23E27B7B30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217543, "uuid": "cfada39a-9fef-4823-b5f5-06cdd8b62907", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217543, "uuid": "3a51c0db-ea2c-4e95-84d1-11db3f80e245", "value": "3072:r33dTc5OUB42+1m+Pzj1eDpsI9jaEr5oH5B:jYqPMD6gri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664217543, "uuid": "3012dade-6d40-46c8-9f90-b28e0bb51f7b", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664217543, "uuid": "40ba2a58-aa1e-4bdb-8cad-ea49ab35768c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217543, "uuid": "6fb7f11c-866c-4fe0-a8b3-da075787fa36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b38b90-3dd1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664220692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220692, "uuid": "fa885c93-f799-402d-b6be-ca0447b769fc", "comment": "Malware payload (IcedID)", "value": "5de660dafdc6d7e701302c7d6f015b93", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220692, "uuid": "8fb07197-4558-4da4-b0c8-1532983527c5", "comment": "Malware payload (IcedID)", "value": "1965899f73d123cc4f4cd43f8678e3e98a60ef8b3d079e424619e06d58fd6824", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220692, "uuid": "ec58078d-207e-427d-a3b8-41ed113ee0fe", "comment": "Malware payload (IcedID)", "value": "b4c2328185b0ca336788bf853f4eb35c1d986bf8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220692, "uuid": "834dd49c-2483-4d67-94ed-3825fa2e152a", "comment": "Malware payload (IcedID)", "value": "6851c3d6b5e93b400d7b8c0378750fe61559267ceca0bb2f01783e8c692e0f00571f2fb9751af2f50095f6cc39c85b1f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220692, "uuid": "1cdb68c0-d1b0-4b87-a8df-a76d006ae5de", "value": "T14C15F105DF50216BF007693E371365C7E8A61C27708BDE0A6B96112E2AD7FA0FC36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220692, "uuid": "d6db9389-6f3a-4b66-b4b2-8ec3f28ebfca", "value": "12288:0WhVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEoxM/KD3XA4k:0WhV2jUeQRI5wPN/2KD3w4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664220692, "uuid": "a6b48f1b-cebc-4fd8-baca-004868f249c8", "value": 888254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664220692, "uuid": "69840414-9043-40d8-b8cb-f4b133dae444", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220692, "uuid": "6b619724-3954-40a3-be56-e913b15fb3f2", "value": "laughingchickenfarm,doc,09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a53d28-3dee-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664233173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233173, "uuid": "5afd3cee-62c5-48e0-b620-922bd6349814", "comment": "Malware payload", "value": "ba37323b68625840db30bb2aeafacdd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233173, "uuid": "ab39750b-c7d3-4df3-9f58-788a62234741", "comment": "Malware payload", "value": "19878213005efd7a38da43ec0d3f238cbdfe3c797b45fb1e57514228ec1e6103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233173, "uuid": "291525f9-5a48-4cf5-b14d-b3a08f561c23", "comment": "Malware payload", "value": "2cb247a74dff069c43d3d1bebd09bf87a2abfe0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233173, "uuid": "0d33909b-1f41-4051-a6c3-0870960b0b74", "comment": "Malware payload", "value": "e63addbc157a0ab4d9cba04483d9046ede74a89ffbda3e8f151efac47122077f6e208fc4e8575a0aeeee24b727c91a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233173, "uuid": "b05454bf-99fd-435f-938f-32aab98865f2", "value": "T1E6D3E16039A18533D81B497C1475DA52267BB8223ABA84C73E88167F1F723C17B7E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233173, "uuid": "a3659b95-b6db-4853-a3bb-b9a028205d65", "value": "838f718910cdf3a4ebf0855233529379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233173, "uuid": "22de56d7-751a-42b0-aac6-74f898c0bbf8", "value": "3072:ut9Q9bRBTI56wJoOlTEJN8g9ipieQjLW5B:u3Q9bfcEZ9SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664233173, "uuid": "7b5f92c1-162d-4a31-99bc-b470c3e7b1c0", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664233173, "uuid": "46d59a58-eef3-4fde-bdb0-de1e6500a847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233173, "uuid": "938ac319-6d5f-4bc2-9edc-28d2bca6a422", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff660659-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (Pony)", "timestamp": 1664213464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213464, "uuid": "c0edfc38-edc0-4c75-beeb-0693468160e8", "comment": "Malware payload (Pony)", "value": "c9571839996d324f24d6f352b35b6102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213464, "uuid": "f0d40149-3375-4577-b690-f60fb45e89ac", "comment": "Malware payload (Pony)", "value": "19c12165c512d8be136814349b0d0f86b9d3242d6ef5d282e89cf2f155c07586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213464, "uuid": "143d17b7-eeab-4657-9c16-3bba0924ff4b", "comment": "Malware payload (Pony)", "value": "0b6a37d7f70d6ab13e2af34eb75870abd14be65f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213464, "uuid": "16d80ac0-ff77-46c4-9d20-ea8923e407fc", "comment": "Malware payload (Pony)", "value": "b3f5b418130b8cbdf6a8f370e349cbeeb2c6aae685e15eeefc5a2bd58286e6abc275ecee1b9920b66db15a72ae8f5875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213464, "uuid": "cbf43cc0-ef35-484f-94ca-eff5d9d70edb", "value": "T103E3D04B07A1689FEC4B9B71177253E792256E508B03E6E7A7D0BC091B704D898BC93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213464, "uuid": "e76e4fbd-d805-4e4d-88b2-84af223b89db", "value": "36235930d35f4cf793e220d58f2fa05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213464, "uuid": "2830875a-956a-44a4-9495-70fb37a77a9d", "value": "3072:5PZdafpDAdAejCHggOaMISTYpAPppppZppppppppppQppppppppZpppppppppppo:eDAGe4ggBMVTYOPppppZppppppppppQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213464, "uuid": "b7b6caf3-07c9-4ecc-b652-b5e0b8e1cc13", "value": 145168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213464, "uuid": "e78e2100-303d-42b2-b210-6fb69542999e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213464, "uuid": "c62aade1-5ddc-4b50-a3b7-abba7b8099b4", "value": "19C12165C512D8BE136814349B0D0F86B9D3242D6EF5D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709b79c5-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664184448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184448, "uuid": "85bf6ec8-6df7-4e03-a301-c961a287ad3e", "comment": "Malware payload (Stop)", "value": "63c6278806d99856110ec441deae9d18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184448, "uuid": "897b899c-be89-40c2-99bc-0f13b170d821", "comment": "Malware payload (Stop)", "value": "19ff9295fd27dc7dad35ee3414782858076d92555d5ebe72c4d378e9485f893a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184448, "uuid": "2a0a1af8-9f8a-4d48-831d-5e3541076e7b", "comment": "Malware payload (Stop)", "value": "5cf5e24a5e3362fe9fdcab6fe845af0e6869a184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184448, "uuid": "3d23b852-7701-4d9e-b319-47edb846ffc9", "comment": "Malware payload (Stop)", "value": "f151270bf91f3a46e42a908e9f7fe543ea08578c2572dfcd4d1ed9cd5cf06cd360aaca67dd45743c3a168f4b1c6c5ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184448, "uuid": "a6e99846-924c-4626-ad38-b5cbb260f497", "value": "T18EE423023345D476C92365713C72E5E525AE18211633BA8B3B4CEE1B5F773E2A9BB702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184448, "uuid": "54b09819-1899-4322-ba2f-4463a4a9cc9c", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184448, "uuid": "9d1d166a-a0a7-497d-9c77-b38f86349cac", "value": "12288:sftggtAG/FRV1r1bRu0aVzqj43xRp4POLN0BfxOpCFVu6o3MP4dMb:6pAG/t1PmVR3aPOLG9xOEFVu6P4dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184448, "uuid": "aeaa1d1c-3026-45c3-a9da-d40bfd47945b", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184448, "uuid": "b97c41e6-6efd-41ba-a058-7b0e9d4adbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184448, "uuid": "cef22dbb-e543-48ca-bb3d-521071755f61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea00e69-3dad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664204927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204927, "uuid": "1c7ddbe9-0260-40e9-afa5-c741187146c5", "comment": "Malware payload", "value": "50dbec17a19a3586e318c6821c72128c", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204927, "uuid": "5fca0f37-4b65-4035-a798-a631ec2cd9cf", "comment": "Malware payload", "value": "1a8a912f1284ea9a56ae555c9ea0143272a29375ffe0ca4259e58eb1d577e148", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204927, "uuid": "aabe0141-43ca-47b8-b387-c673c8b82139", "comment": "Malware payload", "value": "f784319ff57566985b0fcc177c64119d76cbe287", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204927, "uuid": "f3da97d9-27a2-49f7-bbfe-78dfdb3a3a13", "comment": "Malware payload", "value": "560cbb43d6bb56ea001f1b8ccfb9047983538d0eab71178dd6b0261ba7e30ae9c29d123859723bda173af4ff5bf29bc4", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204927, "uuid": "894cbf1d-71ab-4e15-8cba-c77c4e0b9070", "value": "T19014137EDB40BAD83D85C478091C3B504DE47AB4BE45E33324E664B9B1E4E462A325FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204927, "uuid": "6463cb48-f272-4957-baea-d026b2832b3a", "value": "6144:bsKiMluYBMPvTi6Xl+ETPZQogmcFMS3ZN9+yuPZCGLbRdA4jj:eMv826Xl+ETxQoVcegZayuxCsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204927, "uuid": "c3b1d82d-028b-45ef-b8af-42f7730deb02", "value": 203013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204927, "uuid": "fe267caf-1750-4e5f-9179-adb9849b9e72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204927, "uuid": "ac39645f-fe81-4117-8950-c607e35c443a", "value": "invoice(91522)#950019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4622c5fa-3dbb-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664211006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211006, "uuid": "db70b26c-ff01-40ed-98ce-1866f5e93816", "comment": "Malware payload (AgentTesla)", "value": "57233030dbfa0f2bca06292c8d973906", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211006, "uuid": "050ca547-1d0e-4da5-8b9e-6f554925bd2c", "comment": "Malware payload (AgentTesla)", "value": "1ad3e733f4de94d172df691571ee5e38fddebfb449591b8f0f7e6536df7a9a97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211006, "uuid": "a17a2330-ab5f-4e03-9a43-51125bdad6e9", "comment": "Malware payload (AgentTesla)", "value": "74fb4029dc5e35389521f77b50d681346e383924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211006, "uuid": "c2105781-9b09-4c91-9452-fb85c3fda642", "comment": "Malware payload (AgentTesla)", "value": "0c2c74835cfe7bd5c3cafc6383ad85f2b62bb6f1a5ae5134a22ee7e5cf13aec56f9fcffb0d0f7c4040e764310df35090", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211006, "uuid": "2235ea9b-86b1-437c-91a9-6abab3723365", "value": "T13A25085831E6329EF46BC6B58FD87CF59A56F272431F5177607302898B2ED82CE90872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211006, "uuid": "6c739d13-53b0-4fa2-9741-48d6b76fe79c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211006, "uuid": "73315d67-01da-4bec-a28a-6b2413dec13e", "value": "12288:FAGApSA9HDgTm9tpti+HzXyG61/YixXCCFSXqjJ5nUMbQ+XZnW4hWnZpKKQhnLsI:FArpLjgTspti0z2vZCCUajrZbVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664211006, "uuid": "b4f45a26-66ec-4b54-9b98-7f40e1a2efbe", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664211006, "uuid": "dccc1f01-4a1e-487b-8486-e8bbc008ea36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211006, "uuid": "f0b96a53-c33b-41a8-8ed2-e8c334f32a73", "value": "NEW P O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423e7199-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180505, "uuid": "b1cf6c24-2848-405b-92ac-54a4f34854ef", "comment": "Malware payload (GuLoader)", "value": "6a972ffef3fdbef39b6c1600bb70e6d5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180505, "uuid": "b8f9a36f-b52f-41a4-82a2-a0e416145d4c", "comment": "Malware payload (GuLoader)", "value": "1b0f177cbbeecbbdd4a515809c99971357ec1594027a5502f9160b35a9884768", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180505, "uuid": "96884ef9-71ee-4b16-ab77-faa982a5428f", "comment": "Malware payload (GuLoader)", "value": "c3e21c97ba26432c3947ac9be6293d9495bc11ae", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180505, "uuid": "31603d2a-67fd-4c91-a647-cbbdb03eac5f", "comment": "Malware payload (GuLoader)", "value": "98727c610f6df42eafc214707fa76a13036515589838e7974d83381aa3a312a24cf709081dc53725850f7b37beeb2dc1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180505, "uuid": "37d1c3ae-454b-4441-8e49-890c09b74a67", "value": "T10A14C8384D57D9E7BB5E7068D9130A19940F85037B3209F9E527C8F9AFE238A47091FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180505, "uuid": "a8883f9c-44e7-4028-8932-b2aa8fa83839", "value": "3072:FFLx2H5rPScaoUsxMSCgt87gLeyAml/mrx5OjH6Qu8mRr/gV9ubNgHevM8K4Ec5m:FFV2HGgmgLTWeH6Qu8mRzOubNie3Ecwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180505, "uuid": "74b31412-17c4-4e33-b2db-6c3c3e604f55", "value": 191320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180505, "uuid": "1b622de9-c792-4b50-a991-cd566c524c08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180505, "uuid": "f6f0f3c3-bd21-40a7-8aef-193b9a874f96", "value": "Biznes.gov.pl - NOWE POWIADOMIENIE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ce1ed6-3dc8-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664216830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216830, "uuid": "074d4053-96aa-43cd-a5e8-822c5b26f315", "comment": "Malware payload (ArkeiStealer)", "value": "73f780f7e9f9d66d33e5a54c9a438bb4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216830, "uuid": "0ee44e24-7cb1-43c3-a428-d30f80b8ea0e", "comment": "Malware payload (ArkeiStealer)", "value": "1c53f738a9b801e8bee50006506812fabf93b585b30715e417d66c8fa003688a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216830, "uuid": "55fc2822-b728-4749-8ee5-a44d7d2e6d3f", "comment": "Malware payload (ArkeiStealer)", "value": "0e975b2412e62f1e5e52e432f25c1b7450d7497f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216830, "uuid": "0f458499-1d86-4382-bb8d-8d09d3fb0136", "comment": "Malware payload (ArkeiStealer)", "value": "b4e1dca4abbf1e3a1aad8cf531c9dff837f2929341d3fcb3898d5c13ae6cbf961a55048bf5bede34228aac205791ff68", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216830, "uuid": "1ce82b9d-ff38-48aa-8386-b704190af1e6", "value": "T156D3E1017591C0B2C02786BA8870D680ED7FB4212AB499473798569F6FB07D2EBBB357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216830, "uuid": "8c8e3ca1-8143-41ae-9895-37409fb10798", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216830, "uuid": "789c0334-27fc-4028-8405-7cdad56b04a3", "value": "3072:4PCcTc5fkr/3q0Hme9JMPOAdKa0VjnnkNT5B:5kry3MJMldKVdng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216830, "uuid": "49e34141-126d-4065-a836-72aa40775f72", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216830, "uuid": "b20d5433-5146-406b-b1dd-764707bf1615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216830, "uuid": "bf197cd2-4df4-44d3-9d75-d84cd1357e83", "value": "73f780f7e9f9d66d33e5a54c9a438bb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc645043-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213459, "uuid": "a51d91ab-a480-4723-a88d-2092f21456dd", "comment": "Malware payload (IcedID)", "value": "b6debba043c77e3ff010ad5c197a8d3c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213459, "uuid": "31711c16-f4cd-4b86-b5a8-f8ccfd0094ec", "comment": "Malware payload (IcedID)", "value": "1c54e6547719dd745928ee44e318e98f4b9e5603f70648c53f8efe3587e7c6bf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213459, "uuid": "15ebc47c-2517-4193-9d29-34583244d119", "comment": "Malware payload (IcedID)", "value": "a05522b3ac8efcd36c0248a9164dd0c1a9f1e456", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213459, "uuid": "cf73ed76-52cb-44a5-ab6a-6fef6797e00f", "comment": "Malware payload (IcedID)", "value": "b6d0b390038f79fe8f82683dbe266d939bca6f9cd3095d9baca316fff0f7cf185cf3f1255d9d97a9f20efbe039150f04", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213459, "uuid": "1cca8fcf-449d-4b86-9aff-782f99c1d6f5", "value": "T1EB15F001DF50646BF00B683F371765D6B8660C27308BDE0A6B92512E2ED7FA0ED39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213459, "uuid": "c9f54e04-4085-4504-8fc1-035623de8726", "value": "12288:h3wfVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEGv6U0DDK2HiFH6dyf:FaV2jUeQRI5wPN/ZiUiDKiy6gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213459, "uuid": "877661f7-0980-43cb-96cf-9cd002a7eea8", "value": 886971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213459, "uuid": "6c7349d0-5331-465d-9269-5cefc6bc9f5a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213459, "uuid": "bf5cef00-be4c-4773-ad70-3bfcedd5e42a", "value": "midday-invoice-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d752c30-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174404, "uuid": "97145ce7-1183-4729-b7ab-924086207e80", "comment": "Malware payload (SnakeKeylogger)", "value": "f6f8577d980464238f5e43c43080765b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174404, "uuid": "6e1c7f5c-12ce-4f5f-9670-06ea573412c6", "comment": "Malware payload (SnakeKeylogger)", "value": "1c5933af77d575f80dc8e9a48b9ef594adab4053cca69f6838cf9bd96f8fb7fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174404, "uuid": "6d15dcad-2dd8-4aac-8701-04558820938b", "comment": "Malware payload (SnakeKeylogger)", "value": "c898fd717388fa203e9b0791fa9a6b58c5f30084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174404, "uuid": "a71c39e7-9442-4f7f-98a5-1444eb2b8dfe", "comment": "Malware payload (SnakeKeylogger)", "value": "31fff8d50ea0e64dca86b0fe3a85465ea898ea8b871979ab69456f0bac24084869d14a8a75a8d3482c46360acb2c1364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174404, "uuid": "99bff4c1-e104-4092-aec1-b2cc77c54f65", "value": "T17705292035EA561CF47B9BB94FD4B8F649AAF721262DE1BA24B013464733E85CCD1C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174404, "uuid": "98497b97-6a3c-4924-b954-bcc756312113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174404, "uuid": "f422529c-dc8b-474b-991f-fe703a1e7d2d", "value": "12288:Ycs6eJBVFOxZGARnSASQonfEur4ncczTPV0ge04aqjJ5nw0:q6aVF2SvQ4c5HrV0ge0CjrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174404, "uuid": "bee8e1e0-a015-490a-80c1-035373014f6a", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174404, "uuid": "5d268910-ca21-4bdc-8a9f-fbc9da62baf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174404, "uuid": "4838c116-02f7-4b75-9299-a8c5de190006", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6296af-3d81-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664186399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186399, "uuid": "f60f5ceb-fe25-4633-8a1d-22c44f9eef14", "comment": "Malware payload (GCleaner)", "value": "e42b401cec560e56868796967aac71cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186399, "uuid": "983bac50-e6a9-4c4a-8ba3-282c3b6ecea2", "comment": "Malware payload (GCleaner)", "value": "1ca85f35f45a1c3fc54b60fc901f3121bc2ab27a1d74f12d850d0def6bd8cdb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186399, "uuid": "8cf878e0-71f2-463f-98a3-70f13f848b7e", "comment": "Malware payload (GCleaner)", "value": "e343feb3489aa96a4610306a3127ac0d6a644dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186399, "uuid": "525bffac-22a1-4eb4-93c3-f8a365d86b4b", "comment": "Malware payload (GCleaner)", "value": "49b66af990b87455fa2c6e72e6f75b31471f0fd204e810cb089202bebce263530d9f8d68f61dfe44faa6b52d63f07af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186399, "uuid": "bc9d982c-f6e8-4e96-88eb-120109e07060", "value": "T1643402607D80A832E80A7571D833C69166BFB85116125A41B3B46F6FEF327C16E313DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186399, "uuid": "4cb086c9-bd5a-4c69-9314-07aa93df8158", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186399, "uuid": "4c9aeb75-9481-4e88-8de5-2f86eb94c34a", "value": "3072:qXTK95z5NMp4rKGLskPxX126aAFtwy7YAszKMEeczBq0OvkdYfKM3BfyA8H5B:2FpW70AFyy7YAszRuYivT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664186399, "uuid": "dbbd68f9-28e3-4517-8913-f77bbb37c456", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664186399, "uuid": "229dca45-c823-4250-8c45-061eb6c2dc57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186399, "uuid": "45517684-b50c-4387-9b2e-8ac3a06f2dca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54016cb4-3d3c-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664156483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156483, "uuid": "da869787-38ce-4591-a874-d7aa2d6a8050", "comment": "Malware payload (Stop)", "value": "0cc335b0efb3525dc311d892aec05b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156483, "uuid": "2c02830c-6dda-47b8-b629-8e5fae34f49c", "comment": "Malware payload (Stop)", "value": "1cac2a5b63d2f0d69432757bca189d5a1e7b47838849d8b4c969a1dc406f57b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156483, "uuid": "552e398b-b632-48e2-88e8-9003ee6c273f", "comment": "Malware payload (Stop)", "value": "73f1d038086f691ea976420d776db29bbec04cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156483, "uuid": "d58270d4-8a47-4fb7-a04e-8b42d02e4929", "comment": "Malware payload (Stop)", "value": "297c66802b632ebfc96dfdd6c0f8b77c699efed38325e4d30a86598690645e6f304f71342b016422c43eaead2616ba2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156483, "uuid": "22b3b797-92e2-452b-843b-b0f1c8edf901", "value": "T193E4231172E0C6A2CA83A6B64C648A755F7DB82620341887FF6C3EAF6F303C5757535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156483, "uuid": "6db65f5a-e775-40c7-a29b-aed4793c24dc", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156483, "uuid": "5a460eb6-bca1-403c-8603-bbadfb15f5e4", "value": "12288:C+KAqK0oGiRgfkh3irpF7aQp1kvIs8H1Xuox6iflBtNvaps4Nj:Cnw0ri7h3iNF7N3s8H1XuJuBOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664156483, "uuid": "e4b04ae2-93e9-4068-8ff6-0cc58099dffc", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664156483, "uuid": "f9e9bac9-dfff-4bee-b357-cef6b7059f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156483, "uuid": "34a2aee2-8795-4fb6-b46b-e2cdf16c9939", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce614c3a-3d68-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664175586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175586, "uuid": "534d90e4-d245-46d2-91d5-03986780c42e", "comment": "Malware payload", "value": "09693961d60308bf24d79a51e079c92c", "object_relation": "md5", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175586, "uuid": "a938ef7b-2885-4087-8ae0-ab10284ec2fb", "comment": "Malware payload", "value": "1d878b980bb5268e75bf97fb2f664520268bcb935f6aac24c777ef68d1948510", "object_relation": "sha256", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175586, "uuid": "3b5dd0ec-7d55-4778-a951-00ff83e4f09f", "comment": "Malware payload", "value": "a057a5d13224f1769eaabf35ab6963745649da0f", "object_relation": "sha1", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175586, "uuid": "499754d3-a1d2-4649-ada9-d78c06c76d93", "comment": "Malware payload", "value": "6b79741302432cea6ea0924e7351b7ca96e2fa1c4238be19d2f4270b035b21d1c9e8460f4630d86088105292123d49d0", "object_relation": "sha3-384", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175586, "uuid": "a41308c8-ac8a-469b-9552-c397c0354ae9", "value": "T14DB47E22B2E24437D1635F75DC6B926DA836BF502D2864866BE51D0CDF397C3382B2D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175586, "uuid": "ca8364a7-9e35-402a-8021-85ebd1c03750", "value": "b27842d03165b361b8c1cc4af7711a6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175586, "uuid": "ad996852-c517-4aa3-8425-891e07fb985f", "value": "12288:pAERPntA4GZzrpAS9kTV9Voshd4Kfdyk8on//hX:p9R2NZzrpu1BHrokr/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175586, "uuid": "a024e5a1-0fe3-415c-a414-fe73192a9b2a", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175586, "uuid": "f49f2e35-dc84-40e0-b918-857f85490b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175586, "uuid": "4afb286f-3180-47af-964a-ad86d2a9464a", "value": "1d878b980bb5268e75bf97fb2f664520268bcb935f6aac24c777ef68d1948510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0857ec-3df6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664236361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236361, "uuid": "1656857e-d7a8-469d-925a-7c17ed1370b7", "comment": "Malware payload (Mirai)", "value": "c115258be5ad0108959d01a04da1da29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236361, "uuid": "1c121e00-33ae-482e-b5e3-f53d3b9574dd", "comment": "Malware payload (Mirai)", "value": "1e15ff005c75b07dce2718efaea91fbcf5af075077cba47486e4ac03e4249ae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236361, "uuid": "245802d5-cce4-4067-aae7-02394a92c452", "comment": "Malware payload (Mirai)", "value": "d5c5b3c0d321932bb0a040395bc2a4ccf404b261", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236361, "uuid": "50413b11-9887-432c-a93b-f21b36f47cbb", "comment": "Malware payload (Mirai)", "value": "b0f718c52243c4bc2d55c08888d60c0b80c499ab51a70a2f7de9ff2d526ef1cd6034ecf8b78ee6a6e9d90c318679e54a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236361, "uuid": "a0120155-50dc-4144-97d7-b6d6ae244a25", "value": "T113131895BC829A2AC2D026BBFA6E518D332563ECC2CF3217CC245B05778652F0E77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236361, "uuid": "56b7e0e0-b7bb-4c9e-8e65-92bb1f56d29c", "value": "768:R0EH0dko8GI0fUNeLL7bJmdEBahzdKBQuqpPov3bTcSPYYt5S6K7/NnF:Rgko9ICbJ/khzkqpebTcaft5S6K7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664236361, "uuid": "2f111117-8a63-4fbb-b407-51b5b2c8ec02", "value": 44116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664236361, "uuid": "2517b34b-0adb-40f8-aa84-9340cc6b905b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236361, "uuid": "04fb9e8f-ec27-4a1a-bfd7-3e2f80ce094a", "value": "c115258be5ad0108959d01a04da1da29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99661840-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212864, "uuid": "c4e9d193-631d-420c-820b-d7fd8c529b00", "comment": "Malware payload (IcedID)", "value": "6995afbfec138f40a0d06ed8abe5be49", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212864, "uuid": "6c5b7211-9539-4924-9a81-fd03c9162d66", "comment": "Malware payload (IcedID)", "value": "1e4fa679abeb3f756d4be4834e7d2681e9e4a889c369722da4777e8008ce4323", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212864, "uuid": "01d2f640-b0d6-4785-bfb6-26d56bf2ebe1", "comment": "Malware payload (IcedID)", "value": "3af36a1c0c91c36927211997072f06ccc4608168", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212864, "uuid": "2dffbdbc-d321-4c68-93dc-50cd698929f2", "comment": "Malware payload (IcedID)", "value": "326cfb8e1cae96775f37381f8ad1b930d1c7cb8bf16bf5117348a2035dce85ad656bd96ee29f88e8821528d3943a58a7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212864, "uuid": "889a2e86-7440-4333-8948-7885f9e01272", "value": "T19F15F001CF44646BF00B693F371765C7B9661C27348BDE0A6B96112E2AC7FA0ED39C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212864, "uuid": "5b8964a8-bf23-47b8-952e-b70886fb5837", "value": "12288:XVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEARPzv6U2JWa6dFoZ:XV2jUeQRI5wPN/tziU276MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212864, "uuid": "9134f9d7-b12c-4a72-9848-12e2f7342152", "value": 887238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212864, "uuid": "c6409959-741a-4332-85ca-e1880f24f812", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212864, "uuid": "89b6f9d7-a8c0-4099-b2f5-fd992135f93f", "value": "netutah-file-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c521fb92-3d86-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664188456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188456, "uuid": "cabb4992-af10-4e0f-8c1f-3c108a9d633c", "comment": "Malware payload", "value": "21bcb8c94f1ffe5aae1cce21a4acdd31", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188456, "uuid": "d7e3c6d1-b547-4868-86bb-c15070b95ec2", "comment": "Malware payload", "value": "1efa9a6e2c80769be8d10b403fc2a05a6c8803b398e547b9b616f66169f33f3a", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188456, "uuid": "00679815-a55a-42a6-b7f1-9d9d90471c25", "comment": "Malware payload", "value": "e8dabc359af124d1e6c0e0dac9877c8d34fced1b", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188456, "uuid": "a56e1a6d-e54e-4678-816c-3f48bbb4621b", "comment": "Malware payload", "value": "74a90fa1cb5ddac96bf2600220e5ed65dd1b07efe19da1544d81059e18b16cf34ad758e57b787ada5de354f266f9e8c8", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188456, "uuid": "3272ced7-0142-4725-973b-358f46d4d12d", "value": "T1C0E4D059F2C16EDBE233983BE1B712821128FD615645D64F60DCF20F36B26421E67FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188456, "uuid": "0e99549a-48bb-49b2-a23c-7e03b30670e2", "value": "12288:ciXupIuCH0bz1NInOlNT15kQfnxeYnWzAlNT15BQrxs9V:ciX6ITonx5kAFKxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188456, "uuid": "73cf8c01-d184-47be-b256-3c768a379884", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188456, "uuid": "2efe5e61-5733-4185-8f3f-54ec19f2f134", "value": "application/vnd.ms-powerpoint", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188456, "uuid": "8b67b056-d35e-4172-80f5-3e3663931b9a", "value": "attachment.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f170b7cf-3da9-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664203562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203562, "uuid": "5131c69c-4542-4da1-83d5-b645dd44b017", "comment": "Malware payload (AgentTesla)", "value": "3bf9d17f79b46208fcb8dff15f76680d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203562, "uuid": "216d4a8f-aa32-44b6-a16b-2bb8b812aec7", "comment": "Malware payload (AgentTesla)", "value": "1ff6f3c8392423b5bde4173795b2978516b7a1aa77df5843742eab359a9ee405", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203562, "uuid": "12aac881-db87-4899-801c-0d4e984cb9f7", "comment": "Malware payload (AgentTesla)", "value": "bc009db36a54a1fa60cd4ccdd8bfb648a17250e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203562, "uuid": "81976674-73b5-443e-9c21-9c8a4575eeb0", "comment": "Malware payload (AgentTesla)", "value": "950851199c396670ab19e9c5702aaef1d4b6785da3eb90d10bd99a5d05b831e11f407f80db7c7ddc0c44c6d8499c26c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203562, "uuid": "8a2d0764-6924-4210-862e-d085316c1625", "value": "T11E2501270BEA8B4BD1027678C4D1D7F6A3A9CC51E167C78B3BCA6C1FF09A4659A70350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203562, "uuid": "68c55892-2a89-44ca-b42a-3d6930832b24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203562, "uuid": "008346a7-3508-4ba4-8575-7ee9c5d4e97d", "value": "12288:fS4XzcaQ8w49N4u92WidV3GTkVBX5BAFlVypt8M+nD2TmI0Fa8HOn9Y4:6gRQ8/36WIDXnAhM+nKNp8HU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203562, "uuid": "dabaaabc-e21e-46cb-8fb0-d5028d4b1aee", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203562, "uuid": "824fd0ef-f4a1-4fd4-b3e7-a057eea3c289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203562, "uuid": "c8b3586c-a2af-49af-9d8e-de1d27b38c32", "value": "RFL QS30033-AHS09pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ad79f5-3d39-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664155085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155085, "uuid": "0e59253b-4ec8-400e-b0ef-bd837d57376a", "comment": "Malware payload", "value": "141bededaa73a6614b063904e87c04ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155085, "uuid": "14da4102-64e3-4168-be80-3b8a71968234", "comment": "Malware payload", "value": "2061dec80f6d248a35748d31493ed5337aa980c3641777faff8f8e5d22d1dc30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155085, "uuid": "9f595c4f-0f29-4afb-bc2b-5aff3e4f6bf1", "comment": "Malware payload", "value": "2a804f1c925e9b407eed4839a778bd7601683bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155085, "uuid": "0384ccb0-0208-422d-843d-05ca6119536d", "comment": "Malware payload", "value": "4ecb673b5174afc760b0877ff9d46185a94b7fc2994a98da8f26b4b997872edf9d654770c26fda47e83f78f5bf5ae0c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155085, "uuid": "ff148d84-46b4-4dfd-9152-c8a4f1a692af", "value": "T177E3D942622BE1E4E42CD837590731F627CA6D615E0FAD167059BF373C721E4BE0A62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155085, "uuid": "1e6534d1-64ac-4699-a43e-c47a921b03e7", "value": "aef439f1829f69458eb455e4017c94f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155085, "uuid": "541a024e-ac1b-4028-882d-263fba57a0d4", "value": "768:C/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgTA2:C/roM7ZJfUQWgY54vNd+4tNfuebnwP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664155085, "uuid": "b8d87c5a-7e60-4f80-b850-f12216166b7b", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664155085, "uuid": "a6be3be5-0786-4f29-bd60-49bc50bd289f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155085, "uuid": "bbb24ad2-cb12-4c6e-8e92-b7b6ed2ce2f0", "value": "2061dec80f6d248a35748d31493ed5337aa980c3641777faff8f8e5d22d1dc30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0097b758-3d4a-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664162356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162356, "uuid": "3e6f6661-1c1c-45fc-93e5-f9801ad7bab2", "comment": "Malware payload (Formbook)", "value": "b4edde699d6ff6fe9254184573c0e54d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162356, "uuid": "550ee585-5b8a-48b6-ad4f-b6a56e96f9fc", "comment": "Malware payload (Formbook)", "value": "20a9f82d7c88dc2cdf95a495a071bc1780e31df525d1334137c7cb2fe427a56b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162356, "uuid": "b9b284c8-ba38-4653-8c49-2202fc9b34d2", "comment": "Malware payload (Formbook)", "value": "464fceba0ac7b32b482f7157dd3ead4198e2acc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162356, "uuid": "a2970a7e-9a80-4050-a429-8cf15df8aa7e", "comment": "Malware payload (Formbook)", "value": "90266bd750d0c3571cf830dfd9025ec4fb1ff543db2136a3013c7109d5dfa64a83c46ea996aa8652fdc792fbc770c873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162356, "uuid": "50db11b0-107b-400a-a0e7-7807e0997c6a", "value": "T14105BE14162DCB06C879A974CCD3E1705BE79DC5426AC23B8ADABCB7F136348E993361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162356, "uuid": "07b0465b-c883-4e9b-a4a0-e6390c8e7174", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162356, "uuid": "7d317f7b-184c-44a4-bd88-a147eab22ab4", "value": "12288:ortd1hrTpn2BnmSFJ+P/Qwr95zHc+5gmKgNjORJ6v8:orrpEmqJobj7HmJ6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664162356, "uuid": "1f5a2de0-12d6-4fef-bca0-1ff61be4ba5e", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664162356, "uuid": "5f5281ca-5ca3-4f75-9416-ee9e4d527cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162356, "uuid": "1de991d7-e104-453e-beee-4e66d6d492f8", "value": "Purchase Order CW286240-A & CW274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6592bac3-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214495, "uuid": "72acf1b6-b024-4a0c-bea6-c233b3726e29", "comment": "Malware payload (IcedID)", "value": "6f8f03cdd01d74468bd130c6bf0026c8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214495, "uuid": "9163b081-6c48-4527-91c4-ce4a3a64cfd0", "comment": "Malware payload (IcedID)", "value": "212a3bd1d47d54ea3bc940531f8ca8047842970f87697f2766bcb443d6576ce2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214495, "uuid": "e6ebb21d-3950-4e1b-9c64-6dbdcbdb0b6d", "comment": "Malware payload (IcedID)", "value": "867c63ddf9eb11d52ed37031619584b20950e0c0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214495, "uuid": "99185bdc-e5f6-4699-901a-768241f3748f", "comment": "Malware payload (IcedID)", "value": "9666c45fe03f046cb5458ec2f90c1d8b044d9be5c87daba462e84f5c094b9e82d532a5775913479aaf6516eeea81eb72", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214495, "uuid": "158f7d6b-1d56-49bf-a54a-930b8f9e68a9", "value": "T14315F105CF40606BF00B687E370765D7B8611C2B748ADE0E6B96512E2AC7FA0FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214495, "uuid": "5372b8f0-4e20-43c0-8bde-332b7d800fac", "value": "12288:tVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEdGenZn70NzNmWcx:tV2jUeQRI5wPN/1c01NmW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214495, "uuid": "f33b8531-b514-4cd3-b87b-602fcb02c29e", "value": 886912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214495, "uuid": "b03d0b0d-1a23-4c5a-9cb5-176e1a6fbece", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214495, "uuid": "7bc1051c-e95b-4a8a-b7c0-7e1b03d42df2", "value": "jobeysdocument09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e31434-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214675, "uuid": "1a2e03c7-a79a-4644-af55-987f5d5b4746", "comment": "Malware payload (IcedID)", "value": "10a5d966940ea1c905706be520951f93", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214675, "uuid": "6cb6f2e8-76ef-4eac-94ff-c6740b20f01b", "comment": "Malware payload (IcedID)", "value": "213d3eb70ec15b26498f49724494a0d342d7af7fd491c375a0ae056b3689f77a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214675, "uuid": "1cdc43ba-cd03-495c-a903-32e19aa63f76", "comment": "Malware payload (IcedID)", "value": "2193b386d1ec69067ab48ac97321fa32f1bba5f8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214675, "uuid": "4d328386-8204-4dfb-9c9d-1ce763938edf", "comment": "Malware payload (IcedID)", "value": "6ab188722cc05a6f7c9ccc81ce8a05a649fc77f05a4a1f7157402ec282ca66bbe6d8e987e3d3fbfbe175787e5aba924c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214675, "uuid": "ef12229f-0ef8-41b6-a30b-7013177cbb04", "value": "T14E15F105CF54606BF007683E371765D7A8621C27348BEE0EAB92512D2AC7FA0FD35D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214675, "uuid": "1cc26fc3-36a4-481f-ac09-74351809e69e", "value": "12288:XVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEvh6lHxuNzNVb:XV2jUeQRI5wPN/0IlE1NVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214675, "uuid": "6f915522-f633-4ea1-8be4-a4e65cb852bb", "value": 887060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214675, "uuid": "8efd4c04-e6e5-432e-a362-1f9ef41fc7bf", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214675, "uuid": "5ab92204-c316-4338-b525-64bc7734f9fd", "value": "itechmotion.invoice.09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cce3399-3d4b-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664163021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163021, "uuid": "b718ea60-fb2c-4409-b602-e3d8b084a507", "comment": "Malware payload (Stop)", "value": "d9becde143bdb439f954d4bbdff1f469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163021, "uuid": "e97a9ebe-a5ea-4355-bf3b-cbe94d5cd3b3", "comment": "Malware payload (Stop)", "value": "21c31e59fe6f893f297561fdb55832c61f300adcdd02b6857124ac933ebb5262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163021, "uuid": "f2c21c79-c7ed-424b-8f98-f9612810fd54", "comment": "Malware payload (Stop)", "value": "fa9ab41c02b45f4e05777af6e9873a542f132fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163021, "uuid": "d767001e-505b-4524-837d-6cccb65b6110", "comment": "Malware payload (Stop)", "value": "41b929a760f9748af6cba0e3edf3944fc2a20c0b461eb6fac05c1291e5b589d79dc230e8f535d271c44793105b3115bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163021, "uuid": "168a1534-452d-4935-820b-789ad702ed09", "value": "T18FE42323B390E9B6C4A2557142326BA18E3CB813B17C818B3F6C6FAF5E646D1553E347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163021, "uuid": "152e4429-5704-4c44-966f-639f0bdd3e38", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163021, "uuid": "43349be9-d54c-49cb-ae49-3342fb140485", "value": "12288:vAeab/quWTWzxLkO8Hw+AN2g3QmXuh5yZyyBGfCv4qoSvIL9:vwSBWzxLpKw+ApZcyBRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664163021, "uuid": "9e08e15e-590d-4fa8-a1eb-4f24ffbb2de9", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664163021, "uuid": "d9f97a14-cb20-4f19-bc6e-1e0fa3e4147f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163021, "uuid": "005b2088-fb16-4de1-8e0c-f8e99631502a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cf8873-3df5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664235965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664235965, "uuid": "2d5003ad-e4f8-49e1-aae0-ea51e1099771", "comment": "Malware payload", "value": "a3d5684007652c49f45dd24322eb99e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664235965, "uuid": "0a6ea4f7-a09d-4e93-a55e-1cc5ad623f63", "comment": "Malware payload", "value": "222b1442b339ab21478da11948bfdb665bc775351c2ab7895aba7753988c986e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664235965, "uuid": "410649b5-9ff2-4c04-9b04-806130775f5a", "comment": "Malware payload", "value": "62a3e7bce817534eee60df274af031ef385123c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664235965, "uuid": "f2e52af3-9d43-495a-b9f2-f940d741e9bf", "comment": "Malware payload", "value": "6aebed6e3eb0e91078b33d911bceb89e8084fee01b3b04e48f4dd4e88ddefdaffebcb8d6f1de8de148338b1cd765cf75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664235965, "uuid": "7bd7e30c-5cb6-407e-92cb-535b83a2aff3", "value": "T15563AC207880D433C46BA57A6878D292BA7E712217B19DD73B98427F4F707D2A27D31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664235965, "uuid": "89e4ae0b-6f51-4a7b-afb0-2fde57bf443e", "value": "838f718910cdf3a4ebf0855233529379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664235965, "uuid": "a5899bc7-e0cd-485f-8e4f-34f594234599", "value": "768:B16uBebIDprq351GHMTfMHAeuwJ1SPNw3TPeLl5NAxd+mrtdWrX27TUvUvH4ycb:BF3rqTT4ANgSPMTI5NAHQI8UvH43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664235965, "uuid": "e12b037e-85d9-4b70-af87-8a0af03e496b", "value": 68605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664235965, "uuid": "3ea4accd-cb30-42b8-a2e3-d8055948bf92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664235965, "uuid": "05a8545b-adc2-4ae6-a268-d90426f4bc8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03f486d-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664174703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174703, "uuid": "40af6ee9-43f7-43a5-aedc-26df0a5962c8", "comment": "Malware payload (Formbook)", "value": "263b0e103167af2d0b7b3a81cf6fefbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174703, "uuid": "9f19239c-7337-4d01-9baa-ccb7bf3e9e4a", "comment": "Malware payload (Formbook)", "value": "22ddbee8b6beef1e5e438920b314ee4189ae3c2e71c05af0c21551dbef095bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174703, "uuid": "c9fa3d4b-c6a3-4e54-9642-c885a4888989", "comment": "Malware payload (Formbook)", "value": "e9891492bcec73f2c2719427e4c2ed6b17701172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174703, "uuid": "9095a930-6b6d-496c-8ab3-37fad9458ed0", "comment": "Malware payload (Formbook)", "value": "25b612df8025b14d5e0e3888524216feaaf9252f229436c4b434cf5983eead7513bcc0a8c2fe2e6baf85ea65a02822fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174703, "uuid": "7f780c75-42ac-4532-88e4-d3fc9d380223", "value": "T11635CF1C53628647E8582631C8E5FB3407600CBCA69BC7CA74E83E7BF9763E56873166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174703, "uuid": "9d7e7175-da57-4c20-9e2c-2e3d90c00744", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174703, "uuid": "2e533a0a-248a-442a-831c-67da3eab9fe1", "value": "12288:PlkN47yYV7uikFgXqRnqVid2WoVUEKM9rRG8QXBMqlpXfhtMKOmKs:yYlubgmnqoWXcXp7XfhHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174703, "uuid": "c73cab50-0bbb-4753-b4f5-32dade85eeaf", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174703, "uuid": "952124af-b558-43a0-9cdc-e4497009345d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174703, "uuid": "6dff95ae-9f18-43ce-bcb6-45d490d5204d", "value": "Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a69e29-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196057, "uuid": "172edae3-fe54-4751-b94d-32fa9bf371ea", "comment": "Malware payload (Quakbot)", "value": "18ed16c7c98444c28129ba2249c2419b", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196057, "uuid": "8f7527d8-996e-48f0-860a-b9f8f94b491b", "comment": "Malware payload (Quakbot)", "value": "23c8468d2ada0f33f983ab49d0bd953a09b6deae99fec3631d1305aebf2f0f11", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196057, "uuid": "c47b730b-a507-42cd-920a-94516bcd1885", "comment": "Malware payload (Quakbot)", "value": "3f0128c2efdb1f8803dfb0aa373aac7995eb7d8f", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196057, "uuid": "8f034994-9f57-4025-bc0d-069bd5fc87c3", "comment": "Malware payload (Quakbot)", "value": "28c06b53952c474d2996a59e5ca80f3f6bcea3dc09b8196220e9ff0f07ef4cd4e9839df75558ee3dc04261c86541ceb2", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196057, "uuid": "ba99c184-df06-4271-b0af-729eebda5e33", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196057, "uuid": "0b428a21-0cbc-4c86-82e9-21b01a5ef0dd", "value": "3:mKDDEAvFHEAMLQ:hQAvvMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196057, "uuid": "7153f6f2-f685-426d-822b-abe2a51b3225", "value": 43, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196057, "uuid": "114a14bf-a7c6-452f-aec5-9706e6feae4b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196057, "uuid": "192ae502-e59b-4e7b-8f3a-39280fa9cecd", "value": "mongoosesFavors.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5658d453-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664180968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180968, "uuid": "9d023651-144e-4a8c-b93e-a1d7822f18ae", "comment": "Malware payload (Smoke Loader)", "value": "8fc4630b87098ba84a8a6340e3648b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180968, "uuid": "baf52e74-6569-4ea9-ad66-32f5f39dc508", "comment": "Malware payload (Smoke Loader)", "value": "23c9c50675b9187e564d4c4bb7264321bc60c411863658671ee759cc10302da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180968, "uuid": "181ae57a-7fb2-418e-9169-846ac0ca76c7", "comment": "Malware payload (Smoke Loader)", "value": "2baf80bf027b9b44573275f726dc6c919bbfd052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180968, "uuid": "a641576a-7b4a-4786-b8ca-12e2f74940b6", "comment": "Malware payload (Smoke Loader)", "value": "2732e3ff6ccb2956b423920e7f70ff9c5d508300baff4afa78fcb8d4f53c6c77a0db5ecbede9eb0499cd5b541c337241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180968, "uuid": "f40d9f39-011c-417a-ac90-2151d9d5c938", "value": "T1DEE3E1007751E8B3D5105A715C26C3E59B7EBC320A26194B3F585FAFAF322C1ABB9325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180968, "uuid": "7255f00d-e377-4019-98bc-36bfab1988c9", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180968, "uuid": "d1d13ccf-7704-4105-8685-fb71cd3346b7", "value": "3072:WeN9oERnG5T2VHZ6EhSoOlIlNgPIcJ7/8L1rBlXM+5x:Dm2V56+SoOQ8JTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180968, "uuid": "78cdc282-7042-4c4b-a682-f3d1a4f960fe", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180968, "uuid": "6dcbb762-4462-4ee0-adca-7d14ceac53f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180968, "uuid": "b55e771a-292e-454d-b560-3ecccc8dae5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420df50d-3dee-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664232903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232903, "uuid": "365bb905-cc7e-4d5e-b52e-4dff4bd35a20", "comment": "Malware payload", "value": "2b1ea0d64803b1dcd65a7777454818ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232903, "uuid": "01d7be88-146d-4fbb-9428-c4903dfe32c9", "comment": "Malware payload", "value": "23fd1ddc7d1befcbb150dbcd8dea334d7262de525938393cdf63af103894a75b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232903, "uuid": "f769b970-88dd-4dda-ae45-2e828eb32b06", "comment": "Malware payload", "value": "eba3258af6ff70c5f97cf03469dcdea946539c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232903, "uuid": "9efa5004-46db-48ff-a7d1-897b71bf448f", "comment": "Malware payload", "value": "5a69fb868f1069b91f52047745985eeba71ad24878d4e77d935223cb1ddce60b64e115297d5b17611666a4416f28ae4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232903, "uuid": "55965e86-d63d-4e14-a87f-019cb49d9314", "value": "T13E24F1B17C807431FD6AB1B1D4B2E9802A6F789612664A06B7F423294F637D07E383D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232903, "uuid": "66e081fe-8f9d-41c4-953d-c77028442652", "value": "d7d5eb29f8cc9aa72be1b48a07c02672", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232903, "uuid": "bb9f2c47-10ee-4979-9a0a-4f632516d924", "value": "3072:dWf74T85cGB54g0+YAqcqSndYiKaNXBuUP5xg1Ap5H3UAcWj55B:de7LDR9d5NXwUPDg1Q3VcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664232903, "uuid": "24853503-c5b7-47de-8f25-628ba6d7e883", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664232903, "uuid": "3b5ec01e-9dd0-4764-9aca-2ccf2c50d5dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232903, "uuid": "0c52ba32-d7f8-4ae4-aa43-9896aa961e57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca8c2cb-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213889, "uuid": "63f4fa4d-eae8-4391-b1db-7ba7af8fb7f0", "comment": "Malware payload (IcedID)", "value": "319cfa12370a523d83f9c30a3e048e96", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213889, "uuid": "eb288618-32d2-405d-ae2d-5624399da8d1", "comment": "Malware payload (IcedID)", "value": "242da7effd209f9d7c0f497b508b4f5c4ea0802c1ad45028bcaf088dc721ab4e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213889, "uuid": "855e6b0c-5931-4aeb-912e-7cde5dc68727", "comment": "Malware payload (IcedID)", "value": "32f8aba73cbd8bdadf5cffb69ba164c99cec319e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213889, "uuid": "f2cc4f2f-b92b-4ef1-9015-b9d912464f90", "comment": "Malware payload (IcedID)", "value": "28713de82a1264dc84c4831c3628b00149f7d53c1d15f6d2196aed27ad2c7d09ac294391c6c37ef71ef9c175513571cd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213889, "uuid": "bfd6edfb-a8b8-46b8-9dff-f0f60a676946", "value": "T18F15F105CF40616BF00B683E371725D7A8661C2B308BDE1E6B86112E6AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213889, "uuid": "92da97fc-b953-4801-9228-707d310e02b3", "value": "12288:3sHVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEPmnjPvxzxzFZjFPa:aV2jUeQRI5wPN/CmjPZHPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213889, "uuid": "b2bb9439-bca1-4846-812c-ea60baebba1c", "value": 886889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213889, "uuid": "1361050f-2917-48bc-8940-5d49054e2dd9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213889, "uuid": "484472b7-f8c9-47d7-a4c3-0399861ffefa", "value": "irvineonline-invoice-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d116dd-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664189930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189930, "uuid": "87b1d4e0-ed79-43ae-87ed-50b0e8346197", "comment": "Malware payload (AgentTesla)", "value": "e5651163f60eed45e9430554f39e5647", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189930, "uuid": "c3ae26da-27ad-4919-beb1-5c79cf4c8866", "comment": "Malware payload (AgentTesla)", "value": "2433477944afcf9883276c65f3630271007c913ce5f5c4ae7ee58c398451f89d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189930, "uuid": "1bc6d257-2299-452f-9c21-942f39f82b18", "comment": "Malware payload (AgentTesla)", "value": "32930f2ed6a96bde585626fe4c727aeaa29a35d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189930, "uuid": "7cb71fc8-5755-43f9-ac07-e25141293df8", "comment": "Malware payload (AgentTesla)", "value": "559d264866bba86ce66c4612bb1c251ce439ed94541547dc16d03fd70a3c7ca8ba8f3ff0cae3c926e197bc57c98edee6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189930, "uuid": "aa6c1472-ad7a-48bc-9abb-dae1a5134add", "value": "T1089423D2279A4C78E405FB68F943EF99A464A94106BC674FE71708B0D435F80AB48BBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189930, "uuid": "57154aac-3ed8-4c8c-9f55-39ecc1a1eb3d", "value": "12288:6NH6wwB8n7f9teYxZ49AhBMgxSJiOMQHmS:vxsBteQZ4oBIGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189930, "uuid": "07b492d4-34b6-41f6-88c5-2156e594213a", "value": 426802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189930, "uuid": "189581a5-9638-4c11-8f0a-71bb28535ba6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189930, "uuid": "9c9eba87-ee6d-4fec-b68b-daa1f63de02b", "value": "321 Amita Technical 16.09.2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330f2228-3db7-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664209256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209256, "uuid": "334d7ff7-667d-4255-8ba9-6b75cc671512", "comment": "Malware payload (Loki)", "value": "9290419a773303abeb831c251efcb80b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209256, "uuid": "19d1b0ef-baa2-45ab-a6a7-f1d50410b7ac", "comment": "Malware payload (Loki)", "value": "247ecc90addd62e315c2f31490836a6f0b73293f508c6722f5e92269e19005ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209256, "uuid": "fd34fdc2-2753-43ca-91a2-6a9700dd416c", "comment": "Malware payload (Loki)", "value": "495553c98f010f97d51d48b908f08f0f11153b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209256, "uuid": "4f55f2ff-a14a-4dcb-8f33-d1b55915903c", "comment": "Malware payload (Loki)", "value": "3c997b93b1f1915f681d199f06513cea13db2961e22b59cd5db135aad2e3c9412352f22d12f1a671fb4480d1b8d87d8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209256, "uuid": "3e0e8d89-07d6-4908-b528-2a7fdf35dda3", "value": "T195831909B7E28BB1C45C56B4C0E7452007F3EF8B233BD7563D84669A0E2239D6E99BC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209256, "uuid": "3f9fb56e-e1cc-4132-ba52-fbd8e75d3418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209256, "uuid": "7ae68e6a-bcbf-4784-85a4-0b143b25466b", "value": "1536:hbOpyDM0emAgcde+EL7dVxH3c+Z44IUc3YMRXFLUuo:lwyI0o0rLl3BIYMNFguo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209256, "uuid": "2ab8b860-7917-4487-b09c-647eecd745d5", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209256, "uuid": "5014bad6-3ef9-481e-b991-77ba3b7cb63c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209256, "uuid": "cd659a02-c5b7-4856-a745-071692f4d5db", "value": "SecuriteInfo.com.Variant.Strictor.274687.10747.1752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681ae39d-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196030, "uuid": "1d6f5518-8591-425f-9746-e5a8fe5195d1", "comment": "Malware payload (Quakbot)", "value": "998521a98c9294b5f372a2b52cd7dce2", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "H436", "colour": "#E0E36D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196030, "uuid": "c9974b6c-c0fa-4d75-afb7-73c17fcaa81f", "comment": "Malware payload (Quakbot)", "value": "2490324f45500536f05c162d9aa028e152cc44b124ea86ab2474d4334b2dbe25", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "H436", "colour": "#E0E36D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196030, "uuid": "df965c74-f936-45c6-9764-865d70177303", "comment": "Malware payload (Quakbot)", "value": "68f1bb89079ec19b2fc907e31546af14e5f9a825", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "H436", "colour": "#E0E36D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196030, "uuid": "6707ecfa-b2fe-4707-b663-a5fbe38a1dab", "comment": "Malware payload (Quakbot)", "value": "9d815da0fb273315888176f50d969a4df35bee84fce69fcdb316619da910e87aa34659066293c59d3b95a219b56bef18", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "H436", "colour": "#E0E36D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196030, "uuid": "f82490ea-2df9-436a-befd-b66211b23ca3", "value": "T1A7D4236070B61574B62DD2388C10D60FD6DF2E5FB07963B826B9606393DB8C529B983F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196030, "uuid": "71180181-51b7-4f0c-93ec-ecd05d4ef92d", "value": "12288:4/6VhsPRwhiAc0igPEmnJ+Mq/R1VUJ7RKvycOkh4BZyZA9URq06Kde:4oSwPc0iORAM6NUJ1KajZym9FgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196030, "uuid": "4ece7d3a-0cae-4ddb-89c8-6c0a135fd42d", "value": 606156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196030, "uuid": "5d1f11c5-0aaf-48c2-8b25-cf396984cd2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196030, "uuid": "833bcddb-6eab-4da2-afa6-a1a4b46876b8", "value": "inonctnnIdu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396c16a0-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664189939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189939, "uuid": "5ad15529-a59a-49c5-8142-b09e65685012", "comment": "Malware payload (AgentTesla)", "value": "30bd7653c681d10b01d6a13ec8c8b58b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189939, "uuid": "6f66b128-7673-42d1-a1f0-db246be11559", "comment": "Malware payload (AgentTesla)", "value": "24b0889aeba0fa92e2cfbd9f9a5ccf708bfabe6b1425a9f35ce59b012f14b4ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189939, "uuid": "2f00ad62-57bd-4b7d-8a99-b832e6129e6f", "comment": "Malware payload (AgentTesla)", "value": "7b7141c5d26c93708063cbe03086fb923d90a852", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189939, "uuid": "69a74be8-02d6-4906-81c6-1f06cbb9fa11", "comment": "Malware payload (AgentTesla)", "value": "40e8a4a9363befc7758bef31f1b30d30b055a85814931c707bc4938d0d4bf394cb09ca407dc1f86d5adacbacb4c80070", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189939, "uuid": "df22f040-076e-49a4-bfa9-b3e58018454e", "value": "T107E45AD6A7A8F922C5BFB3B132552824C6A7D4D7CAD5DB5B048C84DA3BB33C03991487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189939, "uuid": "c3de6188-bc48-44dd-8c76-8b6f7e743b55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189939, "uuid": "61244bf6-3051-4f22-838d-6aad7b7558db", "value": "12288:oNwhgTwTzsnKTbfZnPJXTKTSaBmXT9ZKXThZAzNh2lqOutEgIZVRZhQzIZVRhLuG:+1+VC7b/lwGxAL6tWtpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189939, "uuid": "0ab799ae-1806-40e6-8906-bfaa43e1c0f5", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189939, "uuid": "ce32e9c1-717f-4029-b8c2-c50b90bf7d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189939, "uuid": "01dbd04f-46b1-4921-b831-2bc769239205", "value": "WAYBILL BXEF673 PX SHIP 87327438239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef6e11c-3def-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664233274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233274, "uuid": "f5a0ffa8-1b56-4a31-9c97-f19439f80b42", "comment": "Malware payload", "value": "fcb6f4d697befb1bf4e27fbf9542d416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233274, "uuid": "9ec83ee0-a766-4eb4-9b57-832ec53dc019", "comment": "Malware payload", "value": "260b245ec810ce9976c7fffe68fc9184026c626f0c4e6adbb32af368a3ed0383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233274, "uuid": "4a06382e-87e1-4d7a-87fe-47afb28f748d", "comment": "Malware payload", "value": "da7c682797ad41fa2d198035094a1f03dc4b0c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233274, "uuid": "8c5d2b67-269b-4e96-887c-834347bd4154", "comment": "Malware payload", "value": "e053d282e7e340eaacc314ab15305a66f8ed3878d38457426ba6197f0b0103b184cbede0cea299b527447b59763f0635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233274, "uuid": "23fc4a93-9f84-4c56-b810-4475a74391db", "value": "T18676337276EBC7F6C4B00D33C9445E89AB66C23529858CAB33DF61156B60E00859AF7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233274, "uuid": "2b25bcf2-1917-4afe-b128-196ace02d705", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233274, "uuid": "19c4fb4a-79cf-4929-963c-e0b172c4d4be", "value": "196608:91OahaG70iNwKQc87uTxHTm93+OG88qYeYJOqvQsjy:3OaPz8aR+LGFOwQsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664233274, "uuid": "e6b21c41-d175-4ab5-97be-ace44b172be9", "value": 7639545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664233274, "uuid": "df94eec5-a0ce-48aa-ad5b-560da6ee5eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233274, "uuid": "544f6207-6477-49c9-bead-2d873f60667d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d37d53-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227220, "uuid": "4440c8d2-a0cb-4690-ac8b-5727833b265a", "comment": "Malware payload (Mirai)", "value": "e3946e48b458e249046a2de5a8a616a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227220, "uuid": "87ff9ce4-daf8-4fc6-ba7b-3c8f7bbe20d7", "comment": "Malware payload (Mirai)", "value": "26a9438190fb84e6fb49314239758e831dccf599d84bc165e9225fe3801ed0cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227220, "uuid": "7aa639f5-1b6b-449e-824a-13e820d03b05", "comment": "Malware payload (Mirai)", "value": "c6c3677cdc22a7901d92dc0660d6e376144eede1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227220, "uuid": "d14c414e-5945-4d2f-93ca-9a91aa300280", "comment": "Malware payload (Mirai)", "value": "c7210a6753c39bf3c632fade72f4fc1d057bcff3e91e2223c289bc467fd9ec257ab690efca85c39cd664b49e803b8e08", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227220, "uuid": "d8a8bb6b-416d-47ec-9216-5eca9f233303", "value": "T135D2D1229E45A1A0C6A09075FF54C4436E634EFCE3EBA1333B64466CF28B01B6675E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227220, "uuid": "6608422d-fb85-400f-ab01-a92f214cec90", "value": "768:KI0W6OrP0YsFO1ZxbCZ7xmIPoxQxFafqs3Uozv:KHWVsYsFE1IxhPoxTPzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227220, "uuid": "ae206392-fe36-4417-ae43-f20fc156d582", "value": 29336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227220, "uuid": "fad221f4-0d37-4abd-b5ad-d4832d71a390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227220, "uuid": "69bcb167-d738-4290-b7da-484949c28d72", "value": "bk.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a92b0b-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664173233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173233, "uuid": "3f5c2ec9-d2d1-4a0e-9931-1463dd690db0", "comment": "Malware payload (ArkeiStealer)", "value": "695bb0b0b3a88527dab8997cb9ce619d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173233, "uuid": "31d1343c-0adb-4dbb-ae3e-19ff6e61f58c", "comment": "Malware payload (ArkeiStealer)", "value": "26e423bfeaf8fa1f0f046324ea87ee588c32db09306c156e765b2ed1b4e03627", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173233, "uuid": "82be7aea-8a7e-4b06-bd0b-711ae6578563", "comment": "Malware payload (ArkeiStealer)", "value": "36cf8b831545c9b49b1de99b4d3a8f5ca472fd30", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173233, "uuid": "861948d7-f7b8-4262-96f3-b714d857ae2d", "comment": "Malware payload (ArkeiStealer)", "value": "89f0f7568e6b77451e87d64e93414e524187e28bbcf2d863c797e889bc28ec5b23198e1915407d96eb886643da6241b7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173233, "uuid": "9c1164a9-c983-4ef1-9241-97994dcd41ec", "value": "T127F3D19B7AEC517DC83A9A39C48B2BBCC0AED25097ECC71D9C09C4D05152E858BF652F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173233, "uuid": "0986f98a-f061-4b02-9562-869555eb5e32", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173233, "uuid": "84e79fc2-aeb9-4eb1-8a98-8dd583350a46", "value": "3072:UIcp1WBLtwqdr9ugrYFxSK6FVhP6d6q8zAqPbH26qzwGOoJSp8Bb8EG:YsLthdr9uCiSl1qkbHUcy8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173233, "uuid": "fb14d155-b2f5-4a7f-bba3-9ff5c34722c6", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173233, "uuid": "06245b3d-2404-4361-863b-4b19e02f5643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173233, "uuid": "c0bffaee-8b66-4a17-94be-973fb5a2d99d", "value": "695bb0b0b3a88527dab8997cb9ce619d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb1ca3a-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213189, "uuid": "b7e8d135-1275-4b06-868d-1c40ea115cf8", "comment": "Malware payload (IcedID)", "value": "be8e99d469cb9571fd571166449f1b5f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213189, "uuid": "94918447-5982-4b0e-b315-2d73f62d9fd4", "comment": "Malware payload (IcedID)", "value": "26f492c47084b37acb68702cafda4256054eb8b07dbed4d215ea7844827efd4d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213189, "uuid": "2dc6846b-7573-4b8b-890c-8d1e16e83ebc", "comment": "Malware payload (IcedID)", "value": "2430200d8e58876a05598f93fa7007f06c67675b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213189, "uuid": "68792cf0-2c7d-46a1-846b-19d6b87a3475", "comment": "Malware payload (IcedID)", "value": "7afced1d0dacc7bd231a3df0fadffb19ecee076b70ee4bfb6de6b3d931bca2f9b19739bf0315afa83e2f55b6a71400c7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213189, "uuid": "e92b777f-b7f0-4549-82c8-8064918774df", "value": "T12515F101DF10206BF007693E331769D7E8A61C2B348ADE1E6B96112E1AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213189, "uuid": "1a1f521d-fa15-472a-83e6-7805f718ae5f", "value": "12288:tcVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEwSHNxhp/G7obp9b6dGRn:SV2jUeQRI5wPN/HSHjGs19bTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213189, "uuid": "93e38df6-b496-489f-98e2-08e9a291f312", "value": 886725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213189, "uuid": "b40cd72d-6b8c-47d0-b9c4-8447019cb831", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213189, "uuid": "0940b64b-3936-4221-8fe9-30f51cd5c6dd", "value": "mirafilmes file 09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3415eedf-3d86-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664188212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188212, "uuid": "2783d9ab-f70a-4167-a3af-b88a6ba4eec7", "comment": "Malware payload (Gozi)", "value": "ea6c8a28d5ae3a5da5eb457511e73591", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188212, "uuid": "6a7f3bc9-c75a-4610-833e-c42c8e0d4c13", "comment": "Malware payload (Gozi)", "value": "270450d4639aad9810bbaa2d175869c2db771ea2c4fd4a48e5fa76232250636c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188212, "uuid": "6e6297f3-15e0-4938-ae13-68a63a555ae5", "comment": "Malware payload (Gozi)", "value": "c5bb4d225577a33893f72adffb1e68fe40ee52f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188212, "uuid": "9921334f-5f6c-4a50-9afa-ae9d3973e5f5", "comment": "Malware payload (Gozi)", "value": "233cc3f4aea5c28597eeb129285ebddbe07aab2f227ceb2d369327a50e50673a899abc233101ef4767fd47aa69b06654", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188212, "uuid": "5e1867c9-3d9b-4492-97f8-e70986eb6119", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188212, "uuid": "488238d3-346c-4ba7-9192-698e6f81287e", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188212, "uuid": "2c77400f-457d-4d23-9ffa-6b724eaee4c4", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188212, "uuid": "de903f51-6517-4bda-9d73-e3ccd950ab6f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188212, "uuid": "4ca14996-2e79-4219-9819-790da014c377", "value": "60d0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3156ae2-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215081, "uuid": "a398d716-05c2-4717-8caf-d070599b963a", "comment": "Malware payload (IcedID)", "value": "2f6c56f5be2405f2cd528e0629958810", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215081, "uuid": "e223194e-a6ab-41be-aaae-f31b345b818e", "comment": "Malware payload (IcedID)", "value": "284250c6ed4cce821821c36bcb7782d27c3a095fd24fb761ad4d86bb454e0af3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215081, "uuid": "f37018b3-8fcf-4ab8-9d90-f84c4cb1e06a", "comment": "Malware payload (IcedID)", "value": "a11e8627742ea4a5e60d21fa62ab3b442adb51c5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215081, "uuid": "8a852f68-df3c-4c7e-b4e2-50cedf0d760b", "comment": "Malware payload (IcedID)", "value": "5595f6de2fff6225fb94035c48c37f78f420c0d451157657d80e48c40bbb329b1c193739b5aa42fd06bb2d2dbbb70d94", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215081, "uuid": "720c6dce-0c47-4a15-8c6e-a9266818e0aa", "value": "T14315F005DF50216BF00B693E371365C7E8661C27308BEE1A6B96112E2AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215081, "uuid": "fb38ea51-6ca5-49b9-a00d-8218978fba43", "value": "12288:uVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE7+uMesywD/XA67Gr:uV2jUeQRI5wPN/UlQD/w6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215081, "uuid": "f8f534c6-3624-4d04-bb34-d5ad6c71fb9c", "value": 888285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215081, "uuid": "12aaf1e5-e498-4aa7-b3b0-ab35cb261e00", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215081, "uuid": "e43ea123-35fe-41c7-8e58-40b407e08d37", "value": "letsachievehealth.doc.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2433fd2c-3dbe-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212237, "uuid": "f1d525d2-2c0a-4b50-afb8-68a76665cefb", "comment": "Malware payload (IcedID)", "value": "d05a32a24e9aed7c05e4e8dc5f373c99", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212237, "uuid": "7877e8d7-db95-4562-9dbc-fe7012927234", "comment": "Malware payload (IcedID)", "value": "28c39e238da2f920b7407370ada35aceedb457205a4dd3531e238b1f3c264b0d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212237, "uuid": "ebbe77a1-9cab-49a8-b26e-1975b361843d", "comment": "Malware payload (IcedID)", "value": "4a76d21449c32c2c063a1445edd0d8e3792abcf7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212237, "uuid": "b728ac08-15b3-422b-a2f4-eb395d52d678", "comment": "Malware payload (IcedID)", "value": "389955931c089110aac480ef80fcd3f08d70242e4364291af9c37e68677d9f4e0ecabcfa319818a5679ea6979f7b941b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212237, "uuid": "b9b112f8-b6ce-43a5-87f5-fe47aaa46537", "value": "T10315F101CF40646BF00B693E371765D7B8621C2B348ADE1AAB96112D2EC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212237, "uuid": "1b32246b-830d-4316-853f-e11976aed524", "value": "12288:tVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEOHNxwJWW/PXSYqGEPRV:tV2jUeQRI5wPN/JH8BPXSYqzRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212237, "uuid": "2acc1f29-72fa-4694-8403-959ee64cd26a", "value": 887199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212237, "uuid": "9a6801be-0a4d-40e4-87d3-c2e056502570", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212237, "uuid": "41f765ee-0a8c-4629-a9ce-3d0b8a21f728", "value": "myfairpointfile09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b002b7-3d37-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664154422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154422, "uuid": "35303f39-91af-4a28-af1e-aefc9747cf5d", "comment": "Malware payload (GCleaner)", "value": "6970df15625d8034fe17ba68c98e66e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154422, "uuid": "174857f9-e3ec-451c-80aa-0b5ed343ef7e", "comment": "Malware payload (GCleaner)", "value": "290d0d478e4cf909c199514732579ba6f7cf40857395890b03a29cecd17809b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154422, "uuid": "04c4658a-9cf1-4928-b141-a40b8d8fb7e4", "comment": "Malware payload (GCleaner)", "value": "835dedd9e91296914989d78d27da560be1f61007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154422, "uuid": "a42ac249-cd21-454c-942f-518d972fe0d2", "comment": "Malware payload (GCleaner)", "value": "bc0c369e0eeb26c6c1983a7214adad60b97bd198a0249ae36cd6721fd76e543cf85671804f1c55bb78f28879e0547863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154422, "uuid": "fe623128-115a-4a12-83d3-81277d672193", "value": "T1A34401113C40ED32C97A79768472DBF42AFEA8501425568637FC2DAFAF307C0667939A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154422, "uuid": "0fb6f7e3-77bd-42a3-bebc-834d42fda496", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154422, "uuid": "d9362d14-4441-44a3-aa8d-e7baff7c305a", "value": "3072:Ok6QSUz8jQ08z5NokodcV+MpLsHdPdvnTE83U/hhSvw/oqmm0FJtqEWPKt/oZDEV:sQL6dU+MCdPdvQRSJqmm0FJtqPKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664154422, "uuid": "ee71bcf2-e226-4c9c-9a06-ab64a562429d", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664154422, "uuid": "ed90e2a2-a8cd-4051-86f0-526070ff1bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154422, "uuid": "4c8818c1-7c9b-45a5-9759-c649c2070c89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69a5ec1-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214684, "uuid": "234fcc77-a73f-4c1e-8242-a51ae45508d7", "comment": "Malware payload (IcedID)", "value": "a1d1744bb2396c4a25163e8f93f4494e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214684, "uuid": "ade527a0-c1c9-4511-b33e-ac7459116687", "comment": "Malware payload (IcedID)", "value": "297216dc24f4d311ab548ded700e850ed72aebcbff60e9a21574f9b651b33273", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214684, "uuid": "ccc513bf-50c4-43ab-8afc-ade61111b7fc", "comment": "Malware payload (IcedID)", "value": "641146ee5bb50b6eb8687cf4d5d6cbc39e9f1d8a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214684, "uuid": "54c83acc-14c1-44aa-b539-f4b3b2b98bb3", "comment": "Malware payload (IcedID)", "value": "f2852fb8d222358c4d89dab68b9d61e5de6a993866427c72db7230357f15d79af4fed50b9675c9e5425b3b28c01c7caa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214684, "uuid": "f3214a5b-4196-41e8-9fbf-56b12f8e26e4", "value": "T16115F105CF50616BF00B293E371365D7B8620C2B708BDE0A6B96516D2AC7FA0FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214684, "uuid": "0a49be5a-8057-4af7-8d74-f26ff399bbea", "value": "12288:QtVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEmYA+JWmDuiAMf7:QtV2jUeQRI5wPN/ZZ+zq6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214684, "uuid": "92ca16d4-f0dc-4fb1-820b-78ddf368ae9f", "value": 887072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214684, "uuid": "fbba0206-368d-4c70-89c0-fa669182aa57", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214684, "uuid": "4eca5093-1781-47c7-8858-56f771fef591", "value": "net-incomminvoice09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2537dd84-3dbe-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212239, "uuid": "992fb830-a4dc-4a4b-8121-4104feaeef6b", "comment": "Malware payload (IcedID)", "value": "20eff5d8573be396b66c486dcbf57ce5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212239, "uuid": "756d78ce-a903-4fb8-bf3f-1a537ffe6ab4", "comment": "Malware payload (IcedID)", "value": "29764707bbe878fb00cd85bac9323de74328e33f48d34fbf2073c8ef4aded411", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212239, "uuid": "0e2ebf10-26cf-4ea3-bbb7-ea0bf1cd767f", "comment": "Malware payload (IcedID)", "value": "f206b2abfc128d8776c95829898eedf81b308c83", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212239, "uuid": "280ef070-8d2e-4005-948d-39680a1eac8c", "comment": "Malware payload (IcedID)", "value": "962048df7d5f5a223efb474fbf51c779bb6829ab093af3fc0a323a8d9bd16427479612620d602ec7ae2701f3a067a61f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212239, "uuid": "a92d5ca3-ec51-448e-a4b3-1c0b8c79c722", "value": "T1CC15F101CF54616BF00B693E371365C7B8661C2B708BDE0E6B96112E29C7FA0ED39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212239, "uuid": "59e6209e-c1a3-498c-bf42-7e8582772156", "value": "12288:eKVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEOLpcVU9gjDuMo/:eKV2jUeQRI5wPN/ZcVZjqz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212239, "uuid": "59deab23-c7cc-4689-9863-86406da545f1", "value": 886949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212239, "uuid": "afe36f01-7bba-4f00-a2c7-2b23f7424950", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212239, "uuid": "0408fd9c-af94-419f-8709-c9d5e9f05bfa", "value": "myfairpoint-invoice-09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915e581f-3dc9-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664217145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217145, "uuid": "ea1e30c3-335c-496a-aa38-200c1e6c95f7", "comment": "Malware payload (RedLineStealer)", "value": "e209973c7877c1bc52ae6a4d38e9c81e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217145, "uuid": "bf3781d5-48c0-44e8-9e95-15997b9e5889", "comment": "Malware payload (RedLineStealer)", "value": "298b3c76504a69def11fe214f3c2f202865e79facb6d85321c828a854e091227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217145, "uuid": "cdb3d984-c2cf-4263-83c9-f9cc6d699d7d", "comment": "Malware payload (RedLineStealer)", "value": "ce1ecd7a639ff2ce86c717fc86173c297e59f761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217145, "uuid": "738c5214-b8b1-4730-926b-17b49139e28b", "comment": "Malware payload (RedLineStealer)", "value": "12b8c6067a8575be74627e6bef77547e97660e00be8135de0e9926b3db09b7fc25b700b3fd46ac51c7c8635ccf1a47cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217145, "uuid": "a0ac5017-afa0-4cf8-b93b-780489c4b3c4", "value": "T1AFD3F1213851C472D47259301830EA41AF7FBDA59A7A558B7BC87A6B2F713D2B73E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217145, "uuid": "b26f6720-926d-4bb4-b51d-57a4b5b105a5", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217145, "uuid": "a52537c0-d6cb-4e02-9cf8-9bbc1f962e7a", "value": "3072:aiAgTc59oKURbZY9vnDZKNCzJWsSVq1JNgK5B:XHNGxD/SVoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664217145, "uuid": "cec3822d-7233-43d7-a384-d395a903b2ae", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664217145, "uuid": "57c032c1-4ea9-47c9-9e72-8e59dc6b5bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217145, "uuid": "534e40ca-c9e3-4ca1-a01f-0eb32821bbe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0d14e2-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664191554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191554, "uuid": "8ba768fc-4505-4b0e-bdb3-2813d2256857", "comment": "Malware payload (GCleaner)", "value": "619d5eba0f27dcd50ea17ebd501aef84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191554, "uuid": "4d0abb89-10bb-43b2-bcf1-2ef0ea4fd113", "comment": "Malware payload (GCleaner)", "value": "2a0ce20f5e283adc24a614b80a72226f5abe6de811dfd0e8fd57a71eebf76d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191554, "uuid": "4272c112-567e-4964-a6c5-309ad888fbac", "comment": "Malware payload (GCleaner)", "value": "15f3d197b96e1f724da61fda2bc831dee8bad975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191554, "uuid": "717eff69-310c-4faa-a84a-02743f7c8ba9", "comment": "Malware payload (GCleaner)", "value": "780ef04c2a77872788cf08f743f117faeebde16f1d5ccc406ec992e10e2ebba69f50bc959785f77a981bcdb2b9cbe862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191554, "uuid": "5c1555de-848a-4d08-8af7-27351eb7eeff", "value": "T15E34F241BD50E832C819B2704832D3B419BEFC5262755E8273F45E6FAF263A17A78393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191554, "uuid": "82267e51-ed4f-4078-91df-82c50423128d", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191554, "uuid": "a13b3487-87ba-4fb2-8fd5-6085c8d2fd7c", "value": "3072:KXLWTz5AThHUgf7pMLYhOBY3nVTDyMyRJOBopod63KahRN2wvRWrV3IKSwXfBO8/:4R5dMbuFTDyPrsAyEnPvRY1S6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191554, "uuid": "acadc1b6-e8a7-4848-a89e-d269f8437a9f", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191554, "uuid": "55aefad1-2acc-4f16-90dc-921392f93d74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191554, "uuid": "02e4ca56-a68b-4aad-aeac-ca88e4157b65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6db41c-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227366, "uuid": "9e538bc8-aafd-40b3-b2af-a7b0e6404da6", "comment": "Malware payload (Mirai)", "value": "5dca89ea9186c8a3be02423b552c0a30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227366, "uuid": "339dc31d-485c-4d10-8fc1-5946efcea3ef", "comment": "Malware payload (Mirai)", "value": "2a56999dca4e02fda84d9f075b0edb4fb8d24061399a91a7941562cdcf81da1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227366, "uuid": "ac28686d-da3d-494f-9c8e-89843f117cfb", "comment": "Malware payload (Mirai)", "value": "7f900e677efa82784d1d4c187226aa51ec3c0c2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227366, "uuid": "996b4f0c-98d9-4e12-8122-147f128a9bbb", "comment": "Malware payload (Mirai)", "value": "654887217978dfe8416e5ef51b385e67c0959ef5bedc8a856d66a1f4dbe7e0e4eedbd4e934372f2fa354a6ecc39b046f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227366, "uuid": "28cf0094-3a69-41e2-9daa-28e9ee9d7418", "value": "T1A453AE62C9642C28DA254A74B810CA749367F43483972FFAE545C27CD027DEEF1AA3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227366, "uuid": "d66a496e-25de-4cde-81e1-09ddca6d864d", "value": "1536:5aE+4+P+6rId8KxAxliyad35YKF75BkJ3cCHpuDyu:5j+4+P+6G8KxArTu5fFQJ3cBOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227366, "uuid": "80b3e0b3-f3a7-473a-a58c-fa8c7a14289c", "value": 64304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227366, "uuid": "bf1acede-0ec4-44c4-ae5d-d7fd9148fa84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227366, "uuid": "c244c82a-97d9-46e3-8717-9b2aa6297dcb", "value": "5dca89ea9186c8a3be02423b552c0a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c080fc9d-3d3f-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664157954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157954, "uuid": "73850e48-86c4-49e3-b0d6-4d5a8161d875", "comment": "Malware payload (RecordBreaker)", "value": "6221a2f056c1c169a5f1f912a6b98877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157954, "uuid": "2f9c3d35-7438-41ad-a56f-5ef7837e1729", "comment": "Malware payload (RecordBreaker)", "value": "2d17f7332b469876ce6cca8a251ca570b0bf5ec2207ff2aceff459d6e10f5c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157954, "uuid": "26b4e0fd-274d-4673-855d-871cf1ee6498", "comment": "Malware payload (RecordBreaker)", "value": "24c4bd73d7ed67cac28eaf6b27256344730fa340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157954, "uuid": "bf567a36-5515-42a3-8d94-4c8fd95efe23", "comment": "Malware payload (RecordBreaker)", "value": "71b7c8f44bd0e88d2c69606ba534ac3bab6f44d360e751971481f3f1d8cc0f47adb9b58b1108cdea4ab803eed291d656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157954, "uuid": "50d8cfe1-fd8c-4c5a-8fb3-bc809e2452ee", "value": "T1EF758E613A918077C23B353546CAE379F2E9A5304E7496872B914E3C2E255D3A93E33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157954, "uuid": "4811de20-6ab6-4a3e-bd43-2a2ddfd1bb6e", "value": "e1dc193f9171d192f93b0c96cd907f7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157954, "uuid": "e2026ff5-62ed-43a3-9757-7025efa566f7", "value": "49152:gPia6cbHXiLlqK7+8ICM6ZIeMp2qEeLxS+1VxnT2:G6eHy5qK7+NB6ZIeMpdjS4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664157954, "uuid": "db2609b5-1058-4df3-b6fa-73748cd3f652", "value": 1667584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664157954, "uuid": "fc193f17-42fb-457c-8ef4-2294c2a642e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157954, "uuid": "04d2068b-96a4-4b42-8267-9a4b7d6c7671", "value": "6221a2f056c1c169a5f1f912a6b98877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3ee6a2-3dae-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664205357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205357, "uuid": "2d21d17e-2128-4596-910f-b1531cf6d3c7", "comment": "Malware payload (RedLineStealer)", "value": "d60909eb4d445d948740877e759b7b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205357, "uuid": "396a3d1b-87ae-4b3f-919a-ef01a43587d0", "comment": "Malware payload (RedLineStealer)", "value": "2d241ce3d2981c29545a11c13ec0ecd7e021759d35dea0c762bb0c63bb1b555d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205357, "uuid": "6d9ea408-9c46-4b2b-8d3b-b4cbefa55c11", "comment": "Malware payload (RedLineStealer)", "value": "dc8a672358fa25efbcefb5e4074aab7acdb413a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205357, "uuid": "ced912da-df94-4ff0-b009-3f8fa5bc8b09", "comment": "Malware payload (RedLineStealer)", "value": "baa5965910f2ff4f51fec1a9efea641f241e5c5bc98298eca22b36af8ff1a481ad5865ed87f7335afa62e1280949b67a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205357, "uuid": "6557596f-1df0-452b-96e6-6fdeb73aa055", "value": "T19F1623A5AA0EDB30CADC5078CDF1644397591E832712CE3BEDB93F167885DE298C9E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205357, "uuid": "df9d2c0b-b598-482f-b680-90a2924ea1f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205357, "uuid": "47d44c23-d8bc-47e7-94c4-61c28406db50", "value": "98304:FvJ7zh1f+X5wDg+kkq/0j+TdWRRsuwaxhYDU4PQv2Vph2XpR:RPl+XWkkqMaTdWb0aDv2VpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205357, "uuid": "9b214fc2-59dd-499a-8fb6-e9d5c2ff4b42", "value": 4060160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205357, "uuid": "bb129ad1-0900-416e-b5fd-bbccca556a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205357, "uuid": "2cb7102f-b39d-42b9-a705-f9b9b91a8b45", "value": "chrom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aca3d9-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664180838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180838, "uuid": "862bfd93-48be-4290-8e02-884467c8478f", "comment": "Malware payload (GCleaner)", "value": "0a05f41b20bfb3d2851dbeb52a078ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180838, "uuid": "719e08a5-90cf-428b-a2e0-de107212e0e0", "comment": "Malware payload (GCleaner)", "value": "2d2ab419d9e77e11d2f91b000c5be55dbdd74181bb43262c183951b3b628057b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180838, "uuid": "3995802d-20f6-4fea-a775-d596f5aa2217", "comment": "Malware payload (GCleaner)", "value": "a469c7cce66f943c2aa617f44c88f9f816a137e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180838, "uuid": "b39155be-ec93-4296-a160-7494f91e0f5f", "comment": "Malware payload (GCleaner)", "value": "dba28f2142d9c959482cf3d7699738e5c2ca4d7264dd5a3929930f965294c534d6f49adb6550912b0d965a6ffeeee1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180838, "uuid": "76574077-ca69-46b3-8ec5-548f47be33a5", "value": "T16E3401117F90A8B2DC1874728033D7D52B7EB96050125E06BBB95E5FAF72A923E343C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180838, "uuid": "0e142829-b3a4-4be9-8c07-6fda64a1321b", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180838, "uuid": "e9ce46d4-037d-4612-9546-aa93a18f7d2c", "value": "3072:BtmjlbG5Jy57QvzR3b54hzevN4M6KSxu6sVORShkqqdHdRCCCw9OhpBa5x:uohN3Ns6V4/KiCkXd9UCC+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180838, "uuid": "af74129a-63b2-4380-a420-a891dc134625", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180838, "uuid": "986b2259-8fac-4cf2-aed0-16a41a919d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180838, "uuid": "f3e25ec6-0950-4acf-9df0-6e4698832175", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e913a40-3da9-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664203235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203235, "uuid": "aba1b7da-c643-4c31-ae5e-dfc327754ede", "comment": "Malware payload (IcedID)", "value": "098c3c5c6e0bbe646f1693c047eaa194", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203235, "uuid": "459f5850-fcfe-4f41-9621-58fa96eb0490", "comment": "Malware payload (IcedID)", "value": "2d3264a11359894617abb0886850cf0730df02d2d7c689d1be9bce09c4b378dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203235, "uuid": "5962a58b-5e00-4d3f-895d-c6fddf08ba81", "comment": "Malware payload (IcedID)", "value": "96e1fe3fe82e9d8302ee5219d48f14078dcc6679", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203235, "uuid": "44845295-7841-4554-a128-277ed72e5483", "comment": "Malware payload (IcedID)", "value": "ec8b73f47e6c46035815521bb3cc350ad241b6e12244662b9e8c553ecc583881ce3ceb7d5b4b09bf273394da3bd7a234", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203235, "uuid": "9b7b0f4e-f81d-4a3c-9d6e-df3609eb31d1", "value": "T1246408D9B7D2B0A6C3A3B474403F110BE27B6D91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203235, "uuid": "9087508d-2af4-4a2e-b0f0-c10f13201fa0", "value": "43477103f62b5dfd408bf7b94c0e3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203235, "uuid": "64a5b700-81ad-4cd9-9cc3-aab7687799f7", "value": "6144:fJIId9kP7+sYAdo9ZvHsJge7lfh+mQVri2VrpgEhBv+:z9kP7I/sm2lfv29pgEhh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203235, "uuid": "cc3325d9-8415-4e16-be88-ab6b11758986", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203235, "uuid": "a0ceda75-f376-410e-877e-d61da1aace5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203235, "uuid": "997d7a04-8624-4837-b947-fe8164764d31", "value": "098c3c5c6e0bbe646f1693c047eaa194.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa82e4eb-3db2-11ed-9266-42010a9c0072", "comment": "Malware payload (Nymaim)", "timestamp": 1664207309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207309, "uuid": "32df47a7-ac59-4d6f-9c93-3db4a9090b77", "comment": "Malware payload (Nymaim)", "value": "553f7155ec1a9cac7a147a4e878b62dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207309, "uuid": "7e76429f-4e91-4701-bf37-a9a89aaeec00", "comment": "Malware payload (Nymaim)", "value": "2da0e38b12f592fd9fbf4a14a8922edc5df7d3b178d519f13295f5bc4826d3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207309, "uuid": "670ebfaf-d97c-4129-841d-a711dd87f8b0", "comment": "Malware payload (Nymaim)", "value": "e4605d6344a6967f06921b71501db4bb5765299f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207309, "uuid": "8cb60086-7353-414e-9d38-0cbf6fcebe2e", "comment": "Malware payload (Nymaim)", "value": "a900a6257f3bc149c3f0e494955fe80bef64aa135a2f5622bc69c51525ecbeb3ba4ac33fba92b13fe3ef67397bb0c440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207309, "uuid": "1d8dd5d1-6ca1-4963-88ee-e45630b80f76", "value": "T1643402517E85D832EC59A0314836C2B155BEBC5206285A42B7F43E6FBF32BE16B343E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207309, "uuid": "1d92bac1-a924-4ee5-8d7d-a7becb240d00", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207309, "uuid": "9e19387c-23ca-4e35-9ee9-5fed2ec89657", "value": "3072:JU36zTc5oHVGtM9S4no/APrOfEMkLouMLmFuZRWSFbDDKMg69OdRNSXTsaIqS3c+:9w46yr+EBouM8uZRJ1bgUOZC9q3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664207309, "uuid": "2f07c4ea-bf01-4aab-b5f7-8cd5ce4534ed", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664207309, "uuid": "31c787eb-09b3-4699-a8d2-64c8eb611cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207309, "uuid": "f14448ec-82ef-455a-91f3-7f89071f672c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f3cf2f-3d6f-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664178342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178342, "uuid": "318c0ed1-853f-4b0c-a458-d2d8fc454526", "comment": "Malware payload (SnakeKeylogger)", "value": "40d7bb5426ea0c365ff58964726736f9", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178342, "uuid": "d86cc64e-eea3-4094-999d-3b453c0bc61a", "comment": "Malware payload (SnakeKeylogger)", "value": "2e5740dc3cb207bbd42b3de571c2dfcb58e8250d0e92bb5e67caf754c39affa9", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178342, "uuid": "84200ef4-3793-4f39-9264-4d82e0d6f92c", "comment": "Malware payload (SnakeKeylogger)", "value": "691a6f440f7a7be3897a8ffa8968dbf1ca87e1bc", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178342, "uuid": "952776a0-8530-44ff-b558-36804801c336", "comment": "Malware payload (SnakeKeylogger)", "value": "2e3ca03523a8b9ea5cc89ceb1cc9ff6a87f3ee87f2250b5926eb701e318d86d19db374a07b43b0d36deaf3488e618710", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664178342, "uuid": "008488f1-126a-4195-90fd-a9215542dea0", "value": "T1D5F423F732F967B8F44DD94603B13D7A2D1AE092A101311A09D23D7A4E3CDFCA5AA5E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664178342, "uuid": "93862969-bfb3-418d-94ca-c7da35c471c1", "value": "12288:8QV29lwA7bMhgvojxS5O2XtVY6kXLOvC1FdyxmgcVPJu2EM7c7V6znNhcIIxqZVY:dVIlHMhgvoyO2tVYHqvSFmEdXzNhcIbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664178342, "uuid": "d9d8250c-a5c8-4f77-a838-ae2248f67b67", "value": 729321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664178342, "uuid": "ace8ab22-95f5-4122-b7f8-2b84f261fdaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664178342, "uuid": "4bd5500b-b790-490a-a24c-a8ee8d7a6137", "value": "251 Ctns Sydney Invoice & packing list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18d8bcf-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664173847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173847, "uuid": "c8090aab-42ae-46ab-b81d-a68323e38770", "comment": "Malware payload", "value": "23c1e8f48ec06960bbd9969c1f404192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173847, "uuid": "490b2acd-3455-4237-b2d8-d74324ec93b1", "comment": "Malware payload", "value": "301d9c55653f6cd8211aafdaf130092cb7ef8ea2e54db2db97153c1c8abf272c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173847, "uuid": "e601e447-2809-432a-b815-9d808a794c55", "comment": "Malware payload", "value": "b9384151eb3f2dbd095fa273c248722e1cc74ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173847, "uuid": "b5afc555-8549-4667-8baa-35205854c2f2", "comment": "Malware payload", "value": "a01883004a1bf48377986c2b18729e4390677377b9e0bd5b8e5719ba671eed97e2efe09241036fed73694031ddf970c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173847, "uuid": "9f908701-bf2c-4a31-898f-706ce7a052a5", "value": "T1DC169EA605009371F1B822789E35C871DA672D7D271388C7B0ED3C9637BAAE6563ED43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173847, "uuid": "2301ac38-560f-420c-9809-270957a3f24f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173847, "uuid": "da2e98e7-4c9a-4eb5-bd8e-8af60eba5c7b", "value": "49152:W/PD/DL/D9CuZrr2h60qPAnDfvl/DK1zAb2ibtbelHi2btsTBrfwWXRxL56ZD0Mp:W3D///UUrPmfvVDWASmXnMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173847, "uuid": "5d87bea1-d7e4-4214-b232-5f967577c989", "value": 4036976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173847, "uuid": "e38f1326-25da-456d-9f09-dd05ebbbdadf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173847, "uuid": "17cf5d89-f558-430f-9fcf-0c35710f8bc7", "value": "software", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685a2bc3-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214070, "uuid": "9e0f9bcb-a62a-415a-94ea-5b3c090fa53e", "comment": "Malware payload (IcedID)", "value": "17a3015e867d12c51fa96b6533dc91e3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214070, "uuid": "7261aa10-4f75-4738-bb12-1b5f9381259e", "comment": "Malware payload (IcedID)", "value": "31a379b1373f69bea5ca9acdd5a908d787e3f6635ecf48a15f717e3ed7f30adc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214070, "uuid": "a147c434-edc3-44fd-ae67-31acc84e4759", "comment": "Malware payload (IcedID)", "value": "1151f6a40625cd9a3d3d79c09962759cb8810b51", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214070, "uuid": "2b82723f-cdf1-49b4-b451-531a13e05b2b", "comment": "Malware payload (IcedID)", "value": "80440f97af3c8834ec79c5ee835a9aac47a37f257d12aa0efc8f0ba212088292cf2a71814d035d6f7b95ad4033705342", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214070, "uuid": "086d59d3-05eb-4b57-a2c7-a1dd59df21f4", "value": "T14315F101CF50206BF007693E37136AD7B8661C27748BEE1AAB86112D29D7F60FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214070, "uuid": "f5258a68-9d30-424f-b319-4c5659c044b9", "value": "12288:BW7SVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE4oFJ1IR4H/kaGP85s:MuV2jUeQRI5wPN/tob1IRYcaM85s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214070, "uuid": "053dc5f8-60e7-4aa4-b60c-649601bdfb01", "value": 886741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214070, "uuid": "e53879b5-2ba5-4e43-a32c-0d0336b643e9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214070, "uuid": "0556f87d-0558-41a2-b990-a0c83bc9fc92", "value": "k-wine-file-09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756fab73-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196053, "uuid": "d71c1cf6-8fa0-4212-beba-8b011e2dc730", "comment": "Malware payload (Quakbot)", "value": "3fcfe2d081b471c6caaaf0d898c4868c", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196053, "uuid": "6e9113b8-c5cb-44e5-bc1b-5d50567e9ea1", "comment": "Malware payload (Quakbot)", "value": "31c56f4aa09b731e42f72f8346121922121e9b22c8de36a2a217e74a11fa43d7", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196053, "uuid": "7b7a02a0-a26b-48c7-88e6-cdfb714f1f36", "comment": "Malware payload (Quakbot)", "value": "e674d8c8b422c616fb9680a2b8605b0a062171e6", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196053, "uuid": "d0ac7890-19ae-4505-8680-849c7d84ae49", "comment": "Malware payload (Quakbot)", "value": "1610b717f8f8d5271e87b6bce8525992bc49cb217988b4476c5b80c4c2c4688fceb9270e09d58b985fc51e5432ba9fd7", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196053, "uuid": "4de51c26-d2e8-4bae-b86e-662093e5b299", "value": "T156D0A7CDC265A5AF9BCB21E2842997945586E1A86E20A0C33955C208152C05446B11C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196053, "uuid": "b6aa81be-bea9-4e0e-b6d1-bdf39a21988e", "value": "6:jOsdYFHUOy+ioWtpEmqIMVCSTfzi8rXPRljA:jRY9UGstqdxVjzzVtlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196053, "uuid": "e9471d03-2e02-43d7-93cb-f40bbe821784", "value": 221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196053, "uuid": "e301501c-ac3b-4e58-8eff-a156297b9bc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196053, "uuid": "916d5835-f0cc-4bf5-afdc-f97dc3340f45", "value": "impalpablePopularization.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e59134-3d51-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664165452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165452, "uuid": "a5182542-18f1-4182-820c-dbf62168033b", "comment": "Malware payload", "value": "63811376632fd7a3a20b854da5b60cff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165452, "uuid": "e69ad245-2813-4193-9266-e6d13aea8474", "comment": "Malware payload", "value": "31fe316bc8265764d41ee84f7a651857c78b64ef35254f7418de8dbe97bc4f04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165452, "uuid": "3e247c44-a7c0-40db-b91a-e99cf6d727a0", "comment": "Malware payload", "value": "ad203ae836a95e66d67fc1bc0129dde30a056549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165452, "uuid": "704cf5f9-35ba-4b91-bbfb-bb0894224dea", "comment": "Malware payload", "value": "232ca2da786125fa186e5cc9893cb9c8a212b776f70e3cf8b93e52aa9ba13c92409c16d190a9214469aaf6db8acfbb88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165452, "uuid": "a2ce436b-3f4b-4789-aadf-df7c14eaf55c", "value": "T1AE852301EBC658B2D1B21D35597E9B328A7DBD300F718EDB639069AEDB710C06B30766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165452, "uuid": "7825b02a-50c5-4391-a627-ae8c95168803", "value": "b4070734502a100c8f90bbd445995533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165452, "uuid": "15cbb76b-0ba2-4ea4-8507-3ba171b15eff", "value": "49152:bRxDd5GQQx8QTTWtM6nPS+L5G3z3/R64V2:bRvRQxrTz6q+F+vfV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165452, "uuid": "8ebb8688-d154-4448-aeb7-7bd63ae02045", "value": 1830776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165452, "uuid": "0252c16a-230c-446e-a648-77fb57144c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165452, "uuid": "5b57f70d-9d01-46c3-bc50-e72c6c7f44ec", "value": "63811376632fd7a3a20b854da5b60cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353b1470-3dd3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664221285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221285, "uuid": "f700ff57-9b49-490d-b02f-444b77a65dbd", "comment": "Malware payload (Smoke Loader)", "value": "28d8118cf4cf2ec566b49a370bda43c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221285, "uuid": "c64b076f-e979-490e-a695-edb9492a3dc0", "comment": "Malware payload (Smoke Loader)", "value": "32962c7fc6405676aa4d7b2e1eda93019c5161ebbb932145f7af73928b341917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221285, "uuid": "3dac086c-888d-4cfe-b2c1-fb7f779b5342", "comment": "Malware payload (Smoke Loader)", "value": "6a1603a6567e59687b3ca1e2fd3102e9abf02fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221285, "uuid": "86dfc703-76ab-43a9-8d9d-267172a37e41", "comment": "Malware payload (Smoke Loader)", "value": "2ae22422b5d24061c71b041705051555ad894b2ff1a7f4270fdcd0bcbeea92c224c760e1e2e0394316fa0e4e09375800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221285, "uuid": "045267e6-35f6-4488-af91-be863bf7937b", "value": "T11DD3E11139A0D473C06286B56C36D241BE7FF6622A7A4A4B3B1852AF5F713C27A3D317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221285, "uuid": "b21fd67e-e30a-4fc1-9838-fdadef7ccfc0", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221285, "uuid": "1a662dca-90ff-4a57-a706-6d3b374f48e1", "value": "3072:SIj/lT55IuPGW9BgA4vAkQ1MaTk0Qm8d9m35B:tauPGWgLAkQ1BoRRd9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664221285, "uuid": "c4f7b777-4fc8-4777-bf0a-707aa3900b07", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664221285, "uuid": "844e07cd-a4e8-420a-acae-c0ec982d50f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221285, "uuid": "a0338643-c203-4f04-8086-92ff278392d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21f3254-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664171217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171217, "uuid": "6b0ec426-bac6-49a3-8758-2b3bc51824e1", "comment": "Malware payload (RemcosRAT)", "value": "79d3383119947e851d1f558a8b7a30a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171217, "uuid": "5af50ebb-5244-4138-b8b8-5c984376b913", "comment": "Malware payload (RemcosRAT)", "value": "32cc036ec39f8778c6920c98f1e8c5adb49419c51f8e828df32f9d6ff98c483b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171217, "uuid": "d07ff14c-7d70-4f32-9d73-7ace522069db", "comment": "Malware payload (RemcosRAT)", "value": "9c422bf3a0894fcd564218df80bba3a64fe8876e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171217, "uuid": "4b8d57f0-3981-45eb-ad26-f854a385ef37", "comment": "Malware payload (RemcosRAT)", "value": "1917f8c7a95e5e8f2c54c60cad06e497cddc3e9cca58766acbe2dfa8d1537c477a4b4e11b9fffe2b666ebc0a39d1dc3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171217, "uuid": "51ccf3a1-b43c-4cf8-bbe3-38e5843fdf7c", "value": "T1D05501230BEB9B4BD011767895D1D3F9A7A9CD00E867C2E76BCA6C1FF08A4259771321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171217, "uuid": "9248f261-fa46-45cd-8bd9-5da6903f2a6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171217, "uuid": "2e281372-0054-4295-9c81-58a79f98578c", "value": "24576:UYCHRuAAlZGLfERudiblcRmia/YS6HZbNVmG++:UNxuAAlZGLfEwMKRmi4YSEqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171217, "uuid": "399e175e-1980-402a-82ba-0e55004d3f45", "value": 1289728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171217, "uuid": "5d5adaa5-69d5-4f82-924e-8ef40f0e53f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171217, "uuid": "301f9b30-489a-4d28-804b-197e2425e6ee", "value": "SecuriteInfo.com.Win32.RATX-gen.31605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe082173-3d9f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664199288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199288, "uuid": "63a0f7f4-bbc3-4c30-ab0d-8c3979e2d942", "comment": "Malware payload (Smoke Loader)", "value": "fb3f47276036557d9bc986fadf19f107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199288, "uuid": "c3f96c4f-0ea2-4515-8789-c04fed95dfbc", "comment": "Malware payload (Smoke Loader)", "value": "32cdf663aadf1b99d04782ce5fb742aab099bae5bdbf98e4f1fa35c056f70d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199288, "uuid": "967d552e-d688-45a9-93eb-e92fbc054213", "comment": "Malware payload (Smoke Loader)", "value": "24ef06a254f3524949fa02dcc2457bf83c2a8041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199288, "uuid": "df9f23b6-12b7-4547-b00e-44dafb8e9a04", "comment": "Malware payload (Smoke Loader)", "value": "fb15ef5be0d1402e31a4c2c7e1e60d9747782eafb9c962f432e186698dc09ff3a96ba1c857300b689671fef962d64b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199288, "uuid": "86608611-f586-41df-92b6-40849d40773e", "value": "T120E3D0507A84E872E02688345834D7616E7F7C26063A43477F4C6E6FAF723D2A67A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199288, "uuid": "7f77ea40-a70d-4a48-a5cb-f937b5e696c7", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199288, "uuid": "fe007bdd-54fa-48e0-9d0d-7432e9bc3d42", "value": "3072:Oc2bTF5iq+7eCkvZekgwA1p5BAOiaT+Y5B:+9gfZiaT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664199288, "uuid": "96c7b081-2d7e-4f9f-bfe4-74eccf9cef6d", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664199288, "uuid": "e13e3bd3-2967-4590-8f0b-0e8ef0c46d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199288, "uuid": "84c46115-fc69-452c-8822-032d08141c22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e1dfe6-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664201468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201468, "uuid": "5359caa4-82bb-4b8d-8574-08277030fe2c", "comment": "Malware payload (Smoke Loader)", "value": "343b7b455d63d6aaf68d56ca65ab2c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201468, "uuid": "440ea752-c8bb-4ede-82a0-0c69ff29f6ad", "comment": "Malware payload (Smoke Loader)", "value": "33bc5a2e13158908bae78fb4d6a3cff8953021d7e612a751c6466aebe79ec0d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201468, "uuid": "00748afa-b8cf-476c-aafb-53be539279bb", "comment": "Malware payload (Smoke Loader)", "value": "53eb6a0c1e604d6614dba1e7a8b8a16fe4b9ec36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201468, "uuid": "2c9eceb4-b075-411c-adf8-b8a59d14e361", "comment": "Malware payload (Smoke Loader)", "value": "29df014c830527706f17a33955e81684b93a632d15ea8e8d07c495ce3d212306b7ca3076f070b31250e5a77204afbca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201468, "uuid": "bb12434a-0d3e-40ba-ac5c-06a62c26fd01", "value": "T14A449E1074E1C032E87316364EFC97B99A3DBC20076659EBA3D81B7E4F306D1B6319A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201468, "uuid": "d059b731-671b-4b89-ba0d-d0726578890b", "value": "25b26328b2b1a79f84b10276a971a1bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201468, "uuid": "dca134eb-646c-4c2b-a566-2d5fac1e4bce", "value": "6144:DUyQ1DFLxLfXBJlcg0puIQQjadBAO/TBKtmPA:DUF1DFlLfXvK2VBK8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201468, "uuid": "01d74bb9-9cb9-4a04-8c34-27fb9837c874", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201468, "uuid": "3adef8c6-1589-4823-86cc-5041a3227600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201468, "uuid": "d179e9db-ae01-4a82-84fd-450106edd710", "value": "SecuriteInfo.com.Win32.Malware-gen.777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5dd139-3d82-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664186538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186538, "uuid": "787e9cbd-a3f0-42c5-950c-b7da71131b1e", "comment": "Malware payload", "value": "b80b22d11193ab71cb8cdbfeb37da16f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186538, "uuid": "508ebfba-2ed3-4d95-8366-9d0a4d12dc97", "comment": "Malware payload", "value": "3413d80c4cfdf5760bbacf307959ef194e4b9596a66d4078fb57d5a12ab10b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186538, "uuid": "8eb3c42f-c2e8-4544-898a-9edbc4d8d6ba", "comment": "Malware payload", "value": "b3335d1375a575e09a12dd8fdcd6d82595b021fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664186538, "uuid": "9bd17b5e-f348-4a7e-8720-42605a08850a", "comment": "Malware payload", "value": "240469d945543e5c23d5a0f4798e216b2d1650d9a0655d0f6766e664c2de710edff52a856c851ae8353414c0dc5dc30f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186538, "uuid": "166a9635-5a00-41d1-add6-d45d7bc6a806", "value": "T1B67633667CF4A8B4E46E51706E7C3FC094BDA45C4FB602AE63F61F0B197C48D4AB2909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186538, "uuid": "4b3625c7-aecb-46b8-ab4d-4f89b0ec391b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186538, "uuid": "cf00eeb0-4031-4370-b2c0-f7975f60224d", "value": "196608:91O6FYGFwHcq9FgHUkGW3+J0Wh9sNm7aIKw25S3YN/CPfxcN:3O6OlcqwjN3g0WheNKhKxc3e/Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664186538, "uuid": "cc1b5395-301d-49da-9966-95396803f7a1", "value": 7618801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664186538, "uuid": "4e8407ab-2873-45b3-bb9b-268307e5a6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664186538, "uuid": "eaa3cbec-df88-4023-a3f4-3598f49b4167", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ffd652-3d46-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664160882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160882, "uuid": "ce519a3a-324d-45df-8d83-e7bf5876c400", "comment": "Malware payload", "value": "9a915313d02345e149e6ba566fe85c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160882, "uuid": "72785258-7e3b-4b94-b06a-3a9473fc1ede", "comment": "Malware payload", "value": "34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160882, "uuid": "0668658f-31a6-4101-84f7-7ab63c0c94b3", "comment": "Malware payload", "value": "9cd7f14d85814c48be3fbf73891415978a7aa882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160882, "uuid": "b496f9b2-d76e-49d9-988f-777f07eeba0b", "comment": "Malware payload", "value": "13fda00b9f4f8aa3319e0b3ac1ecf2afa7603e2e3c662808997740b7f9972c74fb481661024dd8ae875dd2b9d0aa088a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160882, "uuid": "bc99af4c-14c6-4c95-8a23-4ec9bd28fad2", "value": "T197235C5533E412BCF963C0B4DA24951BD3B17C9136B0968F227089985FF2913AB9DB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160882, "uuid": "6054c64b-8750-4aca-9bb5-3a295117bd76", "value": "c56c322548250651361aef7dacf93eaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160882, "uuid": "dcb3db55-2d3d-45d5-9fab-5c761ddda1b4", "value": "384:a+pq5cI2c1nuQd/7ahphmL+Y6XM+c2iqiij/30qzpvUoSbBhDorrmUBsSltcO57Q:Tm2c9Hdwp2+Y6XMpbpi3lUrByvmptUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664160882, "uuid": "055f6843-74fb-4b41-8b03-b89cf602edee", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664160882, "uuid": "decb1a44-1fca-4086-98ec-6dd612b2410d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160882, "uuid": "51749126-6a38-4bc8-a7de-262a01aef22b", "value": "34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d2cc4a-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212851, "uuid": "da4f069c-1d3a-46ef-94cf-aa7348919774", "comment": "Malware payload (IcedID)", "value": "703830ca555b2fa4014f7056708419fc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212851, "uuid": "933d4935-840a-45cc-a8ee-3e0753611e25", "comment": "Malware payload (IcedID)", "value": "35637fabcfe49e7bf98dab87893339ed7da653369921b729ad28ccc8767b7dcc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212851, "uuid": "72844b4d-0193-4a62-b7ef-7ebf4175d525", "comment": "Malware payload (IcedID)", "value": "1334639b4ac131fe5ea08ff387a363688467b0e4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212851, "uuid": "db685b8e-078b-403e-bde4-5525f8f7d283", "comment": "Malware payload (IcedID)", "value": "fcdd253b11e2232f972a662896012e7a528b0d1a121ea89eebd4357d7e870dd3a4f14305604748c545339c3b38fc62f4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212851, "uuid": "ac4a3774-5373-4fc0-824a-97010205f5dc", "value": "T13F15F101CF44216BF00B297E371365D3E8A61C2B308BDE1A6B96516E29C7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212851, "uuid": "7224806d-3f12-49bc-b916-4ed29437c95a", "value": "12288:tZzjDVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEZa9AHz5H9f8XAMfB:vDV2jUeQRI5wPN/QT5B8xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212851, "uuid": "6114221f-b266-4bf8-bae5-5968a84ec3b9", "value": 887006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212851, "uuid": "4d13faad-4021-4827-a041-5a80f5dcbb7b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212851, "uuid": "79f1f6d0-ee88-4c61-bfb6-91fc93a01fb5", "value": "myfairpointinvoice09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d2c87e-3da1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664199996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199996, "uuid": "32aba4dc-3de8-4f06-a0cb-ee7fb6b9bda2", "comment": "Malware payload", "value": "4e22ad16fa4c41eacae8fe8f69f4523d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199996, "uuid": "6d974dbb-9a66-40b6-9b18-2afe4809a50a", "comment": "Malware payload", "value": "35f5d4a3eb371954e67215336e330ab49543ae041d9c9ba5ce0a64bbcde5b855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199996, "uuid": "e4037897-19ab-45fb-aa48-57d2c4711af2", "comment": "Malware payload", "value": "a3eefe3a04390ea28ee5e3963eafc95a351a3994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199996, "uuid": "06b61853-d18f-47c8-a597-ecf1f2778e12", "comment": "Malware payload", "value": "1dfdcb47a32f9630fbc425d9438e9212eb2a7b29e44bee3b3fb0cf8d5bb7ba97d86456586ad517fc40211836cbf48437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199996, "uuid": "ce388b1f-4185-4743-9f00-663e6803dd94", "value": "T1ABD1C511BBD8463BEEE64B7D9C63968053B5B3A25823CBDE9CC0A2075D23B540AB1771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199996, "uuid": "5b143374-f059-4a29-ae39-0ed5e109e442", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199996, "uuid": "62c72942-9c8d-43fc-9dd4-8b26b5219d56", "value": "96:l+ICm31pTqK5LheHhAo9zuNzgdytr7RJ7uBzMzNt:lNCOySLQBL5uNcytRVuV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664199996, "uuid": "a093c6bd-cb80-405d-b0e3-ad5a8a66a5da", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664199996, "uuid": "014e9904-8e72-4aa1-890e-1dad1db9dd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199996, "uuid": "fdd24626-93a4-44ae-a896-293fc89e354b", "value": "PO#5542 AB RFQ.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a03ab6f-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214072, "uuid": "1dd8c2f0-abbf-44ee-bc8f-5c132f9608b4", "comment": "Malware payload (IcedID)", "value": "a9847274c23186759e71ca7b38362ee1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214072, "uuid": "d286b036-3442-4ad1-a04c-e5db3dfb9004", "comment": "Malware payload (IcedID)", "value": "365a9fc593e0f936bf27b71a27557c47cb77cd9a8d8cd8531537a1fee844b6f7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214072, "uuid": "8d8edbf9-c132-4fc1-931a-8407c8116892", "comment": "Malware payload (IcedID)", "value": "5a161d34319b0c738a12d0bc571fb6c1c6f3e19d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214072, "uuid": "e2b1da86-9f54-4ca8-9237-fcc9afd5fc72", "comment": "Malware payload (IcedID)", "value": "eb858d028b3d982c496a75c39d801552156160e0da27abb89c16c4b517d3c4d2f7f1c629247b688957a7365132090879", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214072, "uuid": "9e3b72d5-9071-4033-8ec7-4c8372b7842f", "value": "T11215F105DF10216BF00B683F371365D7B8661C2B348ADE0A6B86112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214072, "uuid": "db2d75c0-51f8-402d-8e8e-37caeed59b26", "value": "12288:ZVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEBpcKp/G7objb1nsmbvDwQvJ:ZV2jUeQRI5wPN/WcAGs5smNvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214072, "uuid": "a49f2b5a-03ad-4016-975e-22c0e52ff196", "value": 887218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214072, "uuid": "a91df3ca-2441-4764-a67a-ab8bd40d7944", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214072, "uuid": "a3a8136d-f4ba-4818-b712-9da59534f548", "value": "mhslicensing.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb7b661-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664201761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201761, "uuid": "58cf9c65-a66f-472b-bdff-b4cff33032fb", "comment": "Malware payload (RemcosRAT)", "value": "25f562232c0fc74dbb8a66e98a68f824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201761, "uuid": "2dee49dd-8677-474b-a9f0-2d9ea741c1ac", "comment": "Malware payload (RemcosRAT)", "value": "36883560a0020cbce37e7ccb9121cd4b9eddaabe6ecf1d732c9d237c3ede30c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201761, "uuid": "a553dc2e-aba8-4886-93a6-68ef4ee39f68", "comment": "Malware payload (RemcosRAT)", "value": "b931e0a023f4f63bf9201065ce727639788a9478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201761, "uuid": "d5904474-4c8c-4195-8584-252895b909a5", "comment": "Malware payload (RemcosRAT)", "value": "a1b3d22c3a1e60e059229a5fde045fee6facd8c0f54da9c2e699eb3e0d9bcbb9140a87205c9ef134817d7fdb7f85aea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201761, "uuid": "8e49db1a-000b-4184-af17-5751a566b555", "value": "T120D39D11A58A2492C9043678315C7BA822256FD3DAF389DC186DB28BDDD9F03173B5FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201761, "uuid": "b7a75f5a-7429-41f6-a362-47489dcd5175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201761, "uuid": "d4b0f812-805d-4178-a79f-65c76c4c9ae6", "value": "3072:BqbSBs5bEg6AAAITTE4R2GZzuj7Fnkob8x4zJLqfU:jBs5bEg6/T44R2GZzuj7Fkob8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201761, "uuid": "60b299c3-d948-419c-9e78-f8e27f189137", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201761, "uuid": "3d7246e6-12d3-4f1d-b750-d1673d7f432c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201761, "uuid": "b8604537-4096-4484-9db4-1acccbc1cd75", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931eda4e-3d3e-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664157448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157448, "uuid": "60cf6b86-8289-4319-a0d5-c6d7834985c7", "comment": "Malware payload (Smoke Loader)", "value": "11581bd3de63c39576181f6078428920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157448, "uuid": "5bd854ff-beb6-40af-84a4-44bda1cd84ba", "comment": "Malware payload (Smoke Loader)", "value": "36bcd50056e237337fa39ea03e2f11d7916f932a3309bb7733998ceb6b66c623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157448, "uuid": "14971564-f0b7-4777-978a-324e616912ba", "comment": "Malware payload (Smoke Loader)", "value": "84a31cad67a3f33a584115c175aad2de75f926e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157448, "uuid": "c35c3a1f-6c25-4c3c-9cb5-11cd65f41d95", "comment": "Malware payload (Smoke Loader)", "value": "b47827f96a70f174f75343507437a8437fd553164ab5fef8035bef9bf9eb7e187c18d67f1b252c79e10aa30492ee0487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157448, "uuid": "41fa6588-0a86-486e-89ed-397113fc7c0c", "value": "T10B04E1123680D872C457467A8874DBF02A7EB9128676568B3B6C2FBF6F303D24775386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157448, "uuid": "bc1a5fc4-84dc-4aae-96bf-655d5f16237b", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157448, "uuid": "bc0dbd8d-721c-4887-89bf-b00f074f3078", "value": "3072:218QBM8mOs8uq35uH4O7RnRN/W3cBBBUUFM76G1YgHiRl2PIByqZKS5x:nY+4O7p/W8BUUFeYguvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664157448, "uuid": "f26336f6-9a64-4468-baa0-0ba120f7dcb8", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664157448, "uuid": "1e58bc43-af70-486e-8af4-daf20cb17f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157448, "uuid": "b33cb84b-b26b-4422-a74e-f7390b6e5417", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98476efb-3de9-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1664230900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230900, "uuid": "dc195273-c411-467b-8164-3aff37f1b36d", "comment": "Malware payload (Meterpreter)", "value": "1f9bbd4498c33a337f9100a4f7f7b9b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230900, "uuid": "8841c2b8-5a55-4676-a3f8-66987791c25b", "comment": "Malware payload (Meterpreter)", "value": "36e8d288cd4ed8be82d462513431c2b6fc216f0295699d880a949324e581c138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230900, "uuid": "b358b36b-3124-4339-bf3a-77a26d40a535", "comment": "Malware payload (Meterpreter)", "value": "24e482b132f6bd8c6215bd1ff9feefc1603f6526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230900, "uuid": "1bd57a25-0172-42b8-8464-fcd209293109", "comment": "Malware payload (Meterpreter)", "value": "e72f75b2cd8c307364cc4d70d668340edd58c54b090a25b9e1b01bb5ef2da3ebbbc558a668ac8b0d0f8f597affb7fcdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230900, "uuid": "962a1e8c-7640-43c0-b2af-ba2941818d86", "value": "T1B8E1656323581DF7E46C053846D3F877719CDE293B3F02760D18130B246112425B2649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230900, "uuid": "ea3689bb-5ef3-4fa0-8689-b71665d15ccb", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230900, "uuid": "054a037f-cd37-4dc0-963c-efb52cce0bd1", "value": "24:eFGStrJ9u0/6qHK2tnZd0BQAVl1c+HKZq5veNDMSeXixpmB:is0nt0BQi++HrSD9eS2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664230900, "uuid": "2fadca30-2df3-4943-9a6b-d34ede449401", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664230900, "uuid": "3e441911-77c3-47e0-b415-94cd898e8617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230900, "uuid": "a3b6049d-6649-4cc1-8950-bdfc10bd46cf", "value": "1f9bbd4498c33a337f9100a4f7f7b9b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5689fcd-3d69-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664175974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175974, "uuid": "bcc9536b-d9c1-4d2d-bada-ed613d760435", "comment": "Malware payload (AgentTesla)", "value": "de4b5c9ee1f88ff4b8261e9bed8e8042", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175974, "uuid": "fb1cd6ac-a73f-46c3-b093-0906cf947834", "comment": "Malware payload (AgentTesla)", "value": "375a5d6faac14315a9886baa834a66da53a604f5b7ba5e660bac8d396147b2f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175974, "uuid": "de0559eb-1b00-4457-a8ef-3dc7781d6bd2", "comment": "Malware payload (AgentTesla)", "value": "d2d7dc346136d98db46d7122ea617e9f420b6a3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175974, "uuid": "00394c12-3b32-4074-ac22-976d0db4cf19", "comment": "Malware payload (AgentTesla)", "value": "87f9c2f4744a1a7e7928e4806009a3c48e5b307869529149c635ecd75630528638e2fad56ba8260c4edcebe9863da94f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175974, "uuid": "ef6dd41b-dfbf-4bfe-9c01-83fa6db632e2", "value": "T15D35F1360BEA9B0BD011727885D0D6F6A79ECD10E477C29BABC66D2FF09B065DB61310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175974, "uuid": "70a8d971-09cb-426a-9241-1dc68d560ccd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175974, "uuid": "b7c57eb6-b337-4472-8265-7250801cc392", "value": "12288:FKf/wSnX6FRynSNkreILMo9ta8KEPVZ7RuNFYiHJ0AstKlRD2LVOObt83mbt3QCS:0f4ASNqecMo9taGVZjCKYOVOMt5BQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175974, "uuid": "adb56d0a-cc9d-4723-830f-1f2cf2342292", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175974, "uuid": "cb7b1c09-d97b-4010-a54d-d835c192cad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175974, "uuid": "f22bb251-f863-4b92-a8c3-c99854fd5492", "value": "SecuriteInfo.com.Win32.RATX-gen.29529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6766c0e-3da8-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664203061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203061, "uuid": "25d3d0da-6bce-4030-89e0-83e8cd07e633", "comment": "Malware payload (RemcosRAT)", "value": "493741e032e10f1c43bcde8b96cde576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203061, "uuid": "74754f6d-955a-47fa-a079-c96d6ca5cb79", "comment": "Malware payload (RemcosRAT)", "value": "37c8c1de3080b2fca7668b09f29f9505f35e379e589d9614ae9da078f9420202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203061, "uuid": "b1977518-8475-41fd-b01c-7b1ffeb3bfa1", "comment": "Malware payload (RemcosRAT)", "value": "f834508c65480cc1a72175e0cfc90270141aff1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203061, "uuid": "997c11dc-0bac-472e-9479-87244909cd62", "comment": "Malware payload (RemcosRAT)", "value": "61ce26af01bf1d23110ee3ca7d1131c3913b0803b525051ca7e22a587af4569148be0bdcfdfb00b62111787eee0fbf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203061, "uuid": "f92304a6-3386-45db-a119-144399e88321", "value": "T1FDE1E811D7984732D9B60B7A6CB383414B78F7508C57CB5E1CC4A15B5C327E149A26B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203061, "uuid": "a281863c-2618-40f7-8767-23f71e78a52f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203061, "uuid": "ed85b23b-0bab-455a-9f50-a3343dcb2eab", "value": "96:3hwnFNH9lu1pvtLQe3d4RjmdY4CEaoJFVBov//BzNt:3a59l+RtLDyc7CEaojVqv//D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203061, "uuid": "5fbd40a5-c3bd-4659-a804-9dd96b5680e6", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203061, "uuid": "5c43c2a4-a15d-4bd3-b7f1-80355d5b9de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203061, "uuid": "c50f9d15-aa46-441b-a966-c4e2ed31f4c0", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37393418-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664212699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212699, "uuid": "7d6712cf-5261-4e30-85c7-4555d0ab5641", "comment": "Malware payload", "value": "dc478aa2222a8e50313df4b9f598b09d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212699, "uuid": "6ce25a6b-a400-4232-88f3-859f64d35716", "comment": "Malware payload", "value": "37d17d2601abaa9136c7558a62a7ed34564cad5bbd1e30935ba71d08f24ed42f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212699, "uuid": "ca2df4df-fc9e-4067-accc-ddfaf2e33b88", "comment": "Malware payload", "value": "f40274025f8905706294d512187124626a99969c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212699, "uuid": "05577c90-738c-4060-af7f-99ab456f7b0a", "comment": "Malware payload", "value": "33ae102cabe549c636eefd620addf89166c6c15e38a77b7580f3083cd6df8ee3fc2685ea9465056fe35360fa10837435", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212699, "uuid": "93eec2a5-ed7e-4045-8fbd-a463253f370c", "value": "T12DD4D5C5B156C22BE6885E3A4C97D7F933B47D02AE45A603F08D732E3E7E294CA45781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212699, "uuid": "006c5d94-3365-4d5e-ad20-88d676eaaad9", "value": "6144:M7RoCEqhx4eKc5bpZHvcEd7HBYebsy797Q0RxnPP3QMPQ:MzxhbpZ3d7AyBdaeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212699, "uuid": "79fdc41d-8e8c-48ca-a4fd-d82b59b4b7bd", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212699, "uuid": "48d538de-873b-48d5-a632-c0a02e38e560", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212699, "uuid": "77c7d059-7b8c-4480-90d9-dafe4e7a17fd", "value": "SecuriteInfo.com.VBA.Logan.3856.32111.630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1bd12b-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664179233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179233, "uuid": "5d47a24b-68e4-427c-b2ff-727e31ded9e4", "comment": "Malware payload (RemcosRAT)", "value": "57f76540f090fe4e9e5141317a8136e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179233, "uuid": "d3a2df4b-5e30-452c-a015-3ebe78dbcf66", "comment": "Malware payload (RemcosRAT)", "value": "383f6ffeb727943af4e96cc93ab2615b14fd8b09c7e376aebc455ef82913f07f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179233, "uuid": "abe46539-67e8-4fb3-849c-065f38cb69b6", "comment": "Malware payload (RemcosRAT)", "value": "cc8c7a739fb0a26e6d0e55f5107fc76ea3345a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179233, "uuid": "5fb8a5b0-25e5-4e30-914b-dc3d181ea42c", "comment": "Malware payload (RemcosRAT)", "value": "e5937fb48ef8a480f375c335597a2aaf33b111f93daf273df8b2be93bc01f4aba506296e75ca2ec94587e562e605daf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179233, "uuid": "b1c967ab-35d9-4e76-8dbf-c46c79a7a437", "value": "T1E925F1370BEA8F47E11576B8D5D0C2F6A7A8CD10E567C3976BCAAC2FF05A0658B60350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179233, "uuid": "e496e1ed-d273-4051-9b73-95fdc010e2eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179233, "uuid": "28d0878a-48d5-4673-9efb-00812d19cc8e", "value": "12288:x/yEifpu0utgokp/WWd/HRmwQkuL5v6YNHC/AAyRp3LBBTgqKmdUsF:ByEihvuFBWhswnuLXM/AAUpsq4sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179233, "uuid": "21c4b9af-4461-4630-8b83-53841ac706c7", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179233, "uuid": "f64ed281-a03e-4a90-b987-4319e61a5487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179233, "uuid": "c94a25c3-642c-4d85-975f-1660bf8ab68b", "value": "FRT-2022-DDSP00001-B(01).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3c9c96-3da4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664201141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201141, "uuid": "0770b210-94ec-4b06-b014-3d1b00e48f6e", "comment": "Malware payload", "value": "1d5ad9c8d3fee874d0feb8bfac220a11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201141, "uuid": "613c5274-2871-48d3-b9dd-e8b72a2ace8a", "comment": "Malware payload", "value": "3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201141, "uuid": "6f78801d-d4ee-490a-b79e-c80fd44885e5", "comment": "Malware payload", "value": "ca6d3f7e6c784155f664a9179ca64e4034df9595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201141, "uuid": "8b47705f-f363-4a0a-9919-7fe0fde5234f", "comment": "Malware payload", "value": "964cdcef354189e04232b4abed3e517ac5395c81a80cddc479758a3ba09509310552adff49136a1741fad653a106c187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201141, "uuid": "62d06e91-6539-47fe-862b-c94f659961af", "value": "T10F725CCFFAA00457E4F0C93030656634EF7E9A7A0B968EDF6CF52E829AC0D472517295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201141, "uuid": "98147128-1736-4d35-b181-c32f26b18f0b", "value": "2eb516ca11536a75b455bb2361a5a574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201141, "uuid": "1085c37f-5322-46a2-87c5-74be9c9a241a", "value": "192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201141, "uuid": "da65a2a4-e0e5-48bd-8d65-d7329e99b247", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201141, "uuid": "90ab07c9-b7a5-479b-ac1d-cd5424ca84ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201141, "uuid": "f5ed624a-29c9-40a8-940f-f6f25416171a", "value": "MEMZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd5b2dd-3dcf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664219904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219904, "uuid": "56b043ce-fbe9-4a1f-a327-6ddc0349292e", "comment": "Malware payload (IcedID)", "value": "8201f1bfd204972dd1c2cb989a7c8cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219904, "uuid": "e3a95435-5fa9-4981-a0c2-d4c3605de4d5", "comment": "Malware payload (IcedID)", "value": "39af395246a555cdca505f3b7358db16b107bd186b9cbcf18fa573acb4709a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219904, "uuid": "1dbd5704-d364-45b7-91fe-666e5dbc51e3", "comment": "Malware payload (IcedID)", "value": "73ae0872d685685e2395894c743df925dcfd19d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219904, "uuid": "641f02cb-2332-4554-9b75-afef5d8776d1", "comment": "Malware payload (IcedID)", "value": "c04b6b6006b9df2e77c34121df8c542f7824964b17ebb6ebdaa166af6dd48c891e0a1ce23062f66660e5ae61e4bd60a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219904, "uuid": "50cbbf8e-7a62-46ba-b099-a337ebfb8aa2", "value": "T1CDC45CA5B5C13026E2739279A0AF6546B2769913B00B89E4F17EE4E0DF749CE0133F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219904, "uuid": "7eaae8c5-7357-4755-9c70-3434b80cc61a", "value": "19c10135117a704516e8404b24282c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219904, "uuid": "a7815747-eb29-4476-b9f8-ec5386ded625", "value": "6144:x+86v2VKRnZEvCijwzDv35F5+Djwy/QCn5drokAieiR:x0v6vCij+3yB31x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664219904, "uuid": "43ae31b9-dd91-492f-be06-fe7fab8f5ac8", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664219904, "uuid": "36460e11-ebf6-4ac8-9dd5-1f9481f08635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219904, "uuid": "c5c932dc-dabd-4c39-8bfc-b65128b85cde", "value": "avers.db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673b0728-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664213209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213209, "uuid": "e83ac330-d46c-443b-8df7-b0e9539522d9", "comment": "Malware payload (AgentTesla)", "value": "885623d7ebb885c6d33a2e00a4fea75c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213209, "uuid": "84663617-573d-4979-9065-4b3c5dc99588", "comment": "Malware payload (AgentTesla)", "value": "3a05a9fb995af785634caaec69039c2f9c1034b0166ca6d81efc4b171c1c1ad8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213209, "uuid": "2db48111-d31f-43e9-833f-71fe448f2840", "comment": "Malware payload (AgentTesla)", "value": "a4056a70d3414b60e194c29b90f8648801b2adf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213209, "uuid": "e5e998b7-8ae9-4e6f-ad0e-597c4819f70c", "comment": "Malware payload (AgentTesla)", "value": "f55142bbd3414068291231016731e0949fef2b6b7a4b45903bb57137dafe48f05bba586451715d20265aa42604b42ea9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213209, "uuid": "bff7a30d-b592-440c-a8a2-2cc4765e75f3", "value": "T11915292025EB561CF47B9BB95FD4B8F649AAF721262DE1BA24B013464733E81CCD1C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213209, "uuid": "0ced93db-e3c9-4f55-acee-44d6d81673ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213209, "uuid": "000aec37-4160-454d-a5a0-a1bd7b4814ee", "value": "12288:Fs100KVFTxkoADqjJ5nYcS1KxUGzq4GHeN14Y3j69bv89xojK:G1KVFDjrYc5xbqS7FjMg9xQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213209, "uuid": "b992e2c2-7710-47d7-9a87-1e3f0e2174f3", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213209, "uuid": "d2172889-21d4-4fb9-baa9-159624aef17b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213209, "uuid": "9a4cb707-f34e-4b39-98f1-986cbb18961f", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e283d987-3d93-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664194088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194088, "uuid": "42b03178-a663-4c38-ba0a-4dfd60df3bad", "comment": "Malware payload (GCleaner)", "value": "7f2cd6e787d7e674519ffe357315632e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194088, "uuid": "917da4ba-000d-4be2-92d1-89b7124db412", "comment": "Malware payload (GCleaner)", "value": "3a4fb6f4073a313e83a40408184af877ad92a083896eb56701339d3a08f48d00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194088, "uuid": "0f939926-f8fb-4007-bc2b-aa7a01134cdf", "comment": "Malware payload (GCleaner)", "value": "a9a49df5e743f34b2f9fa0071d03acb0a2c1f059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194088, "uuid": "2092526d-c47a-4106-8922-c6c6a9aa63ee", "comment": "Malware payload (GCleaner)", "value": "4e0846b2feae4f656fd57763f383e54c8d23881d6ab65fae5ca686ec052b2f7ca22d3e5bc02a148698f81ede143abfa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194088, "uuid": "e249874d-a7c6-48eb-90cb-06e29db983c8", "value": "T1EB3402107E54D832D839B1319432F59369BEA88405291642FBB43E6EAF327D26F753C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194088, "uuid": "a1e6e72d-eced-4a78-93fb-3c75031eec89", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194088, "uuid": "34e5d97b-91cf-432e-9c6b-7776609771e3", "value": "3072:jBVSzz5zfN0oq8q04SUn6SjthYTOfnSh8I8xKjHr3ag4+kTMO0WV2dQqxk4B5Kk/:cFYDhhYQnSKrxmHr37zrdQ0ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664194088, "uuid": "f48ee474-51b2-4d58-81f3-7ceb8c8abd3b", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664194088, "uuid": "27767587-bf65-44b5-9cf6-dd98a81f8151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194088, "uuid": "b8b3f8a2-530e-4884-88f0-b4d64eff4d3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc660f4-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664174676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174676, "uuid": "01355b97-cdcd-47db-826f-0d75023ff1a6", "comment": "Malware payload (Formbook)", "value": "72dbae8afa17163eaaf9f0cb38310f4f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174676, "uuid": "ccc59d01-2387-4388-82b3-4519c29f1dfe", "comment": "Malware payload (Formbook)", "value": "3a6ec85f2557225d0d83b8d01f11a632bdb45e87f2d24ca80a481e1dccf622d4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174676, "uuid": "340556a7-94b4-4065-ad57-37063affd382", "comment": "Malware payload (Formbook)", "value": "3812b167c78dca31089090e5ef078fcaebaec9a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174676, "uuid": "fc39b702-a2fa-4719-b442-dbd35a686a9f", "comment": "Malware payload (Formbook)", "value": "5b8fa4b5a5ea5bef29af2f4dad626beff39d52d1ac960969eaefbf9b55e88783b3357bc9b2d33249fe3fee12b784623a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174676, "uuid": "afe09051-ac0f-49b4-bfd2-66c84e2b7855", "value": "T17CF42326E8934AD7E2B7106B0A467F26BA8C1D44369B54CC77F071088D3B72E8D5E63D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174676, "uuid": "893ab637-3b45-4c7e-88de-d4b4c8b36e29", "value": "12288:365LOz7iVNPTIWuLM4Ubc7YfQS8atcgXXzzjrFp2AAtq+MR18meldD1:K5CsI2w7Y4S8atpTzjrF4AWOqmkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174676, "uuid": "7f676c41-5de8-43d1-91b7-10770370464c", "value": 733413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174676, "uuid": "55b76e7c-7c17-4765-b07e-6217999f029c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174676, "uuid": "f406ffa1-8ce4-4855-a6d2-945fa45ee837", "value": "Details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354b99df-3db7-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664209260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209260, "uuid": "80db04c5-6030-4221-8ff4-8cc7accf8bb2", "comment": "Malware payload (RedLineStealer)", "value": "fd763983aaf0e15a666b143123ae3e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209260, "uuid": "5ef435bf-c6ab-4f7d-9934-5814fefd6b2b", "comment": "Malware payload (RedLineStealer)", "value": "3a7814a744bff6a580e2ca6ddecb8513bd567f5df09e7b6d223ecd8f45eb875a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209260, "uuid": "c89e4e9a-d6aa-4e45-8a25-e3dde10ff8f2", "comment": "Malware payload (RedLineStealer)", "value": "d93a2a1f2727e193557551005307c82f992194f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209260, "uuid": "6bb43612-5846-40e0-a472-fa4d9f823d6e", "comment": "Malware payload (RedLineStealer)", "value": "b540703fe99855695fe843b429fe64cdda13a8c2a9466d46f0062d1fcd08ecdafa73d4a5f7b70f5fb2bd42be387ff4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209260, "uuid": "f33d0775-30bc-45a1-b25a-c47127da79da", "value": "T185A4AFC6E5240431D94AFEF56F74A936A4EE4CA61F076E44F202E34C6E1A2D7CF492C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209260, "uuid": "30d13bfd-4b6b-427b-8190-390ffedc0c85", "value": "889d6e9adaf602123d02717fe501fa0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209260, "uuid": "f71e2131-c1dc-41d4-9d6f-81c361c10033", "value": "6144:1nBjz1gnVkjbO4k9vCqkG85j59FxfD+O3kG+UYeDA1vEZP+G:fCV67kZCqkG88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209260, "uuid": "764ffcd7-ab91-4967-b0dc-20bfb3a35c0c", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209260, "uuid": "d60ba7f7-b6cc-4e5b-8b95-2d4d42299b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209260, "uuid": "7252beee-eaea-4936-8682-e336d29c6101", "value": "SecuriteInfo.com.Win32.PWSX-gen.7298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18b936a-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664173793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173793, "uuid": "06429375-84ae-43e9-8833-932da4b366f1", "comment": "Malware payload (ArkeiStealer)", "value": "3bbc61bdd627fd85f241009fa08037ae", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173793, "uuid": "990b5ccf-fd91-4c64-a80a-8eba10109dd8", "comment": "Malware payload (ArkeiStealer)", "value": "3ab45381840c68a7d6f6bdc10874b403c2d0a82c334ab6e6c600f03fefe72680", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173793, "uuid": "ed2aee7e-ad60-487e-8705-3d6ee34ff4f3", "comment": "Malware payload (ArkeiStealer)", "value": "50b92f72cc6121397b3dfac3330843ed0ca31679", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173793, "uuid": "cac8368b-8e62-4125-b183-7e24831fe047", "comment": "Malware payload (ArkeiStealer)", "value": "b4a2c9b4b3700dfe22c81c20bbbb1acf7a8f6e713a4c0dfa947c1edcd0759d8ea6456a32066a54ee8c245d672eefe256", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173793, "uuid": "1d343360-d711-420c-a982-746a31ec1398", "value": "T1F6B423251F4C5662C28FA935FB8C0651E6A37065BD60E1A4CDC01D152C3AECAF39DE7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173793, "uuid": "a49d73c5-3089-48c6-ae82-1337ad6fea19", "value": "12288:fKKp3qffmOYilTNtCpKrqAkv8pfolQ3PFsuzLXMZTRp5gFzIa6uwsxxxq2IgBYsQ:yKp8fm3ilTNkpK+AHtPeuzrkcDHMSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173793, "uuid": "564bdc2f-ff08-4492-950f-3acdeca90c44", "value": 505413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173793, "uuid": "489c2e7b-47ac-411a-828a-50f78c0712de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173793, "uuid": "a986f644-a1b8-4d7e-a97f-7b9f6a400d69", "value": "aidatafile.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de797a38-3d87-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664188928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188928, "uuid": "f9ec9406-f5fa-4687-a0ee-838ce99b0792", "comment": "Malware payload (GCleaner)", "value": "50129d4e6203d7b36b92927c3b4cc00b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188928, "uuid": "8d1d5167-04a7-42dd-81e6-9b5d759b2bfd", "comment": "Malware payload (GCleaner)", "value": "3ae500de57102d10a7c19212f21ead361d6759507d97d8442ef2b6f25215d1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188928, "uuid": "c2bc1d81-3db3-4772-b247-2983f2ff64ec", "comment": "Malware payload (GCleaner)", "value": "61a81100d686d7ab050a8f4704264b0f502dc4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188928, "uuid": "694e6a8a-bd81-40b3-8042-30336c321867", "comment": "Malware payload (GCleaner)", "value": "8c769fdca7bbc2e9538563c7d1ba44f89eb9ad1ee90d494b2cdd9a8d195db70176bf09618e4e08fa457d01bfddb4ae28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188928, "uuid": "a2fa5cfe-2592-4df9-8429-4015a5e010e8", "value": "T1703402017E809C32D86D72709D33D95169B76C9602269E437BB4BE2EED336C129783DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188928, "uuid": "0844f8e5-b5a4-4cb0-bfe7-9113484e11f6", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188928, "uuid": "79b3d25a-58a6-42eb-9115-d2f6445e055c", "value": "3072:Z5iLz5fQubI7m9nW00fTxmbq4f6burVC+pmHDOnjrDXxuItwsAY733PoElBL+5B:J4aEbqkSyVC3jOnXrRwqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188928, "uuid": "1dea841d-6f9d-435a-819a-57befcf90fd9", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188928, "uuid": "8b122251-0ce8-4263-998a-1319a33854b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188928, "uuid": "cf57f01e-2091-46b2-bb4d-94db90284be5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab3232f-3d76-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664181673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181673, "uuid": "9f7b0382-6dd1-4a33-8add-28ce51164ec0", "comment": "Malware payload (Stop)", "value": "921ef8144fc31793131a9146ba63e83c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181673, "uuid": "6b6b56b3-3997-4fe7-a4d2-f68b96ac9e42", "comment": "Malware payload (Stop)", "value": "3be332f6205f496e2fc72ec78d8092f8d23899d0d918d0bb149cadcd1f55ca95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181673, "uuid": "c30d92e5-4d7e-4b6c-9d86-45236e492658", "comment": "Malware payload (Stop)", "value": "3942996d8a0153e09ffdc8d2a7b3abd142dc074c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181673, "uuid": "c1e6b0e4-e3fd-42db-acc0-a03b6fd578e7", "comment": "Malware payload (Stop)", "value": "10c1427d49163dc66ab60e8315b63ff04899788b5fc4f293fc0ea06632399ae7b2c39e0be1b146886350039593795278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181673, "uuid": "23f418f8-4cee-4649-95eb-55f98de5c445", "value": "T189E423206E21E072D520A1746D1682E66D79FF238867395B675C2E0FFF3018277BD3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181673, "uuid": "19226218-8151-4774-8bbb-ec4891f71e48", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181673, "uuid": "f54adf9a-0c45-41fb-b6c0-90cfff744383", "value": "12288:iKJH9/FEw1Geg/VTzSG0k6o9I6HmMik87Qg7BHL52XgFwHyC5:iKz/FjohNTeGco9I6vip0AhEQmSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181673, "uuid": "8ee7ab41-0019-4fdc-a72d-f382044a2589", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181673, "uuid": "61cee44d-81aa-40d4-ac8c-a16dbe1edfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181673, "uuid": "71eaec82-b170-4201-a927-f74c248ce3fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2773053-3d9d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664198276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198276, "uuid": "3930ef1c-dd1a-4063-b722-9a1d0ceb83e6", "comment": "Malware payload (AgentTesla)", "value": "de587acbb6425e2673ce079d467a2095", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198276, "uuid": "4f8ac3f8-cd27-442b-9e55-353c3a733acb", "comment": "Malware payload (AgentTesla)", "value": "3bef000ff9cfdfb8d43fc340132f208f4c14adda11940221e83b2064643aa4e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198276, "uuid": "788092ca-a916-4c3e-a6eb-216eac9e7caf", "comment": "Malware payload (AgentTesla)", "value": "64f7ffa24ea602acbc7cbfbcba837d51ac57063e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198276, "uuid": "4af52c82-bb83-45ce-ae92-e1943a4d86cc", "comment": "Malware payload (AgentTesla)", "value": "585e4a1acd7276b70d8bb5bbf075cded25b3886fea789715df24a8619f9f7503f99f5a974c246e7202d7d047c3fd0a1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198276, "uuid": "bf4e8021-d319-4b7d-8255-64e454383e2f", "value": "T1DB25E0271BAA4B0BD164B7F88090C6F193B99C55A027C3876FC67C9FB077B209B61752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198276, "uuid": "0a1b38cd-608c-45f8-bb19-f19e6ad15ad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198276, "uuid": "1c176a32-20ca-4b8f-9f16-6bb33435919d", "value": "24576:0hLuyyfzOKbrNLwzinzbhx71LXudmCBVGOIIz:gLuyyfzOKGin5thXuUYVG9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198276, "uuid": "8deeadd1-3357-443b-b4a1-dac0314c1fb6", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198276, "uuid": "67996577-9d89-4b01-a7e7-40c2959c0445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198276, "uuid": "95e618cf-d82f-4887-8345-fd7a3d6bb85a", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729505fb-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196048, "uuid": "921f84f0-927c-466e-b812-6eddefdbc5ac", "comment": "Malware payload (Quakbot)", "value": "ad0431c9508e405c056ac73392abffe6", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196048, "uuid": "3a4e0771-f068-4855-819c-e0406152af5c", "comment": "Malware payload (Quakbot)", "value": "3c1d714d910f4d14eaf4698b7cec9a15a7ed92c657fb9945125bbdf3f8c767d5", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196048, "uuid": "75d06505-5441-4801-b563-baf767e15f1e", "comment": "Malware payload (Quakbot)", "value": "9afdfce150c89b7a3c6e54bf7391109991cc50d2", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196048, "uuid": "0d97ae3a-ec1a-49f2-b142-fa218102bfd6", "comment": "Malware payload (Quakbot)", "value": "b0e677faad9ea0a322ae3cf2cee33bc0e793aaf17da3f590df60fe99c2ee165772ca667f6ed34fd5a938f4e767289ede", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196048, "uuid": "e4dcb9be-1718-4e40-9ede-1bd1daf78d14", "value": "T17F216519ABEA1B10F7F34B317975A2A1953B3C22FE92A35D420045451136004A27DF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196048, "uuid": "fbc3cb4b-55fb-41a1-9663-0792c3c20c68", "value": "6:4xt/pvyl//8LupdlRjcE6/JEuERMpn6VPpE8oJa0RQGVPpE8oJ43+SkEMl47J6j2:8/m/8C1MWA6UwIU5IMm9lDm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196048, "uuid": "7f3715ae-fb8f-48b1-bad1-59aa3dcf2e42", "value": 1293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196048, "uuid": "e617a0dd-b4c9-447b-9fd3-fffaf9db7771", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196048, "uuid": "c6de24ab-7231-449c-be14-9850b574c7ae", "value": "Art.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c73e30-3dcd-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664218716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218716, "uuid": "bfbede5f-c7f9-4f3c-b87f-0f0e1ba3082f", "comment": "Malware payload (GCleaner)", "value": "854b4e3e0fed636b145f2932db89b361", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218716, "uuid": "14006c03-6d8c-4cf9-bc78-fa89488de06c", "comment": "Malware payload (GCleaner)", "value": "3c612a5c91a5d81f68bb8c3f0e7c68a05a10ed22d853d2a1cb6da77da9c9166b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218716, "uuid": "bba687d5-60a3-4fd5-ba92-a5fcf200e619", "comment": "Malware payload (GCleaner)", "value": "1d81d32042e286dad70f258eca7d6bb23a24a520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218716, "uuid": "d1ce7992-a0cf-4070-9c10-7c03a1699ca9", "comment": "Malware payload (GCleaner)", "value": "1fb19e9fa7d9ea98597f95c9191ba0d03d12bea45f5dca639e3088e03daf0b3c8c574ee658b671be5ad78f54b56323cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218716, "uuid": "3650542f-cf42-4db4-b2c1-42b0758c740d", "value": "T1F024F2613C914472D52E7574DE70E9D129BBB8502A36891273B0779B9EB2BC0AF343CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218716, "uuid": "16d52845-c1f4-44d8-83ca-eb21918bc006", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218716, "uuid": "de9a277b-0bd7-4022-85ce-cc2c033a0846", "value": "6144:0F3+7qizwJrHjjZI5rv290pnCxS0YKqsMp:0F3+7qhjjZI5rv290pCxS0YK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664218716, "uuid": "7edeeb17-1a38-411a-bfbd-7f60c55c0da2", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664218716, "uuid": "ca900fee-7ccc-4ddb-aecd-ebba29a3e0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218716, "uuid": "2f00ba1c-9579-4023-921b-949e4e7a6113", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34264400-3d30-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664151276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151276, "uuid": "d3b31d75-9316-40cc-a39a-48c4340e4382", "comment": "Malware payload (Smoke Loader)", "value": "2c51cccda2bb07c8eba9929ceefa87f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151276, "uuid": "856f055e-bffa-466b-89a3-98c0395145e1", "comment": "Malware payload (Smoke Loader)", "value": "3c6cae26cadcb9e6dea3c40d0eab6b9960f657bfe60a9289baa65c557c61808c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151276, "uuid": "e8ed6f3b-3af9-422a-b882-9074b42dd7fe", "comment": "Malware payload (Smoke Loader)", "value": "1142c609b3b24956b54b8d7848732e790ee99c4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151276, "uuid": "051e40e2-2009-44bb-ace5-26664764f07e", "comment": "Malware payload (Smoke Loader)", "value": "1fd2211cb7c3f9c355adda692c8a8d1a945f50a74f80f9d43d8d899d1af4901dbff377f5b152f03319bd5410a358aab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151276, "uuid": "5a079a06-8aed-4178-b2e9-60c8bce0b3a5", "value": "T1E304D0113A80E432C46469351874DBA01FBBBCA2946A56C33B9C3F6FBF312C25679797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151276, "uuid": "afc8effe-aae1-4237-8bb5-3bfa5c78beab", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151276, "uuid": "d0878bad-a250-49e2-978b-1449daed88e5", "value": "3072:VkYt7Txzrem9Q8z5oyTZMWoyf3joWvpP/Bbko+5x:1z9vkqp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664151276, "uuid": "1ea5332b-bd6c-4cd5-a39b-5e0bcd7b36b9", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664151276, "uuid": "4f7078a9-c7a0-49b1-ad59-bf11964ec996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151276, "uuid": "399e34ca-b61b-4d51-a63e-5bd7369ae8de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b72ba98-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664215793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215793, "uuid": "7ed03750-8933-4e9e-9b5d-579a54816637", "comment": "Malware payload", "value": "84e193917e27c2dd6141cdfe4263d6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215793, "uuid": "d2f1f685-2553-4875-b487-ca52e75076a2", "comment": "Malware payload", "value": "3c906111681d088c676015606aad56cf06565fa9d21c374e3c100010db9b1db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215793, "uuid": "55c497a5-5350-409a-ba1b-0ef5b79de0a3", "comment": "Malware payload", "value": "c7bb851de8d9cb6e9df6216143f25930abedd342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215793, "uuid": "b2d549f9-df83-44a8-b2ba-4451650c9254", "comment": "Malware payload", "value": "6c39395477d5d4c0f11d67c0f3e38f3ad26a0fe8ec883c00de67808695555b51609e6bf265c97b67ad4175050c1e7653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215793, "uuid": "b859b9b0-03c9-4628-a2b0-8e10d99ef649", "value": "T1332401B17C046436EDAF3A358B33DA02567FA8562A614802B7F437995FA13C06B393C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215793, "uuid": "2efd05f7-9291-4848-b237-fa98009a2cd2", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215793, "uuid": "1b51cb82-4e14-4972-b17d-6b2c96de815b", "value": "3072:rxdlqTc574E8p9L/2uSP6dC+Qu8NmKjrraYaAlUW/z2pSnMOEkJy3FHvS5GsN9iX:ZY/bOrkf8djaysSngvNsNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215793, "uuid": "b00067fe-04d4-411a-8430-eea72a67293c", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215793, "uuid": "a4d86ef0-0cd1-44c0-90e8-b560c22d6377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215793, "uuid": "5309b441-7b71-4b8f-961f-ea188f3f67ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36735df7-3d78-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1664182203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182203, "uuid": "96b55bf1-ac89-46f5-bddb-22f9055d017a", "comment": "Malware payload (NetWire)", "value": "3fbd38a88a5302483a14d8fa2510faf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182203, "uuid": "0cd0c620-d4e9-49a3-8f4e-d6d49192b430", "comment": "Malware payload (NetWire)", "value": "3d10c53032ea46fb31e8b921c09466bf4a93347f5809c181a0d41ac8e423a153", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182203, "uuid": "2d0293a5-b48d-4ce2-b7be-61ef0da1eb80", "comment": "Malware payload (NetWire)", "value": "776a02c79a42da5ec021aa1cbd7ac19367d6cb07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182203, "uuid": "f383467a-1959-4079-b2d7-b719cd69afa3", "comment": "Malware payload (NetWire)", "value": "7d831e6693338885d160b87b1e7d7e457f117c00f28389eafe04c78e9c3099771fe8f06585c1406a5b844149f9ec8f98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182203, "uuid": "a7721e3a-4146-4e20-b935-be5f5c0bef75", "value": "T16B351282B7D18472D1B31E345A35E724693C3C205F69962FB3E44CADEA756822235FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182203, "uuid": "0ac5b0a1-864a-467e-98db-c8f475c20f16", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182203, "uuid": "4893dd8c-65bd-4e1e-9d72-141bdbe296d9", "value": "24576:UAOcZXcxP6qNenHO4jTZpFY1q8LPHYOoW6Viduv:CH9CHO4HZXYIwQOolIduv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664182203, "uuid": "e5cea8d6-780c-4f1c-b5f4-0ce844d09e8f", "value": 1162876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664182203, "uuid": "001c52f8-1ab2-4f05-a669-1c4e885a5765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182203, "uuid": "642eae4e-c619-4e9b-ad07-d5930998d3e2", "value": "3fbd38a88a5302483a14d8fa2510faf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c58662-3d9b-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664197389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197389, "uuid": "20a898bf-8631-4fd5-b7f7-ac41ff9a56cf", "comment": "Malware payload (SnakeKeylogger)", "value": "e0e68f22d9f4fae2dde67ed97dfdc9a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197389, "uuid": "36e826f4-b774-4115-bcf9-a0d2fb929cdd", "comment": "Malware payload (SnakeKeylogger)", "value": "3dd3078924cd154c4543f6e47ede6d36fd676a500dc76b1a44c3484417ae9cbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197389, "uuid": "47dc4803-d4d2-4c47-b59c-b3ae29c1276b", "comment": "Malware payload (SnakeKeylogger)", "value": "7f364542a07db216bfa45328e5921e8827df6d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197389, "uuid": "a8f29de5-443b-48ea-9078-938897529088", "comment": "Malware payload (SnakeKeylogger)", "value": "5ad8c61a13ea7f4042ad411eccfd02ce4306298bd354fd58cce72b58217621a8db83819763e862644751cb4eb9d7f88f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197389, "uuid": "cee1b716-054f-4aa2-93f7-e36635e0fb97", "value": "T1A1C27292FF0C40E6ECE10AB65C2658C411336D3DECA0BE4D76AD792A56B33833252D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197389, "uuid": "f43da943-051a-4675-b826-1d982c4b7b2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197389, "uuid": "57421ec0-422a-4f3d-9594-8c6f7856249f", "value": "384:KLgrWEvbl5IZwU1PoH6lzt31UQdRbHqTPA+nuUwHsomximxpBa:KLTQBKGsAH6HvWjeUs6iOp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664197389, "uuid": "35f61ee2-ecf6-4518-b86b-5414fce55709", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664197389, "uuid": "7eab7d54-896d-403e-8bd4-c03987d97d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197389, "uuid": "4868cbec-75de-46a1-b487-8bf137443c5e", "value": "SecuriteInfo.com.Win32.PWSX-gen.4351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b86303-3d3b-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664156139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156139, "uuid": "3e032bae-bc87-491b-9f2a-f5f46ec3da79", "comment": "Malware payload (Smoke Loader)", "value": "179a3c3ccb6acba4ad05c8e40b27744b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156139, "uuid": "6e726c93-84f7-4f3c-a7b3-07000e7f1423", "comment": "Malware payload (Smoke Loader)", "value": "3e8ec7a02a8e27b24d661eea7811f10e3119341791e364795366d62d335bc179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156139, "uuid": "259ee71f-820f-4c12-aab6-7b252c0bac5f", "comment": "Malware payload (Smoke Loader)", "value": "89c20d470f8f4a6e4e592963243b4d3ac1f1c9bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156139, "uuid": "75fadc7b-c78c-4ac0-aaf4-595c7d206719", "comment": "Malware payload (Smoke Loader)", "value": "e02a8c6a49fe7b37ac587843ea1b82d2b2d554a5fc0eddbc5192f7ad1ae9936ba216607b47dbf91bdc05bde533223b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156139, "uuid": "e81437ea-bda6-4fb5-9cb4-86bb093e7264", "value": "T1A704E1037784D432C49295740875DBB02BBEB865402A16873B9C3FBF6F723D25BB6296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156139, "uuid": "729e8ffc-40c3-464c-a5a7-9aa87db4a7b2", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156139, "uuid": "572f1adb-c355-4929-95fc-be07bb4b9296", "value": "3072:pdT5sTcUc8SA35SqmM6bF19mUph3vUZ5B/TL5x:Pl8VmM6VXph3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664156139, "uuid": "9f10c3ea-ea36-4aab-8c2f-f8e7aafd66c5", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664156139, "uuid": "edd39a92-56e1-429b-91a7-6a428034102b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156139, "uuid": "931734ed-46a9-4198-a2d4-4e3dcf5e2a44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95328efb-3d7e-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664184939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184939, "uuid": "03b4b0bb-91a6-44df-a2dd-099d7ec18eb4", "comment": "Malware payload (Smoke Loader)", "value": "45b34f9489589be4440dd9dba5ffca68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184939, "uuid": "b5ce72ed-e0dc-4afb-9ede-127a8ae0efa8", "comment": "Malware payload (Smoke Loader)", "value": "3ead0af6b98d9131e597783728854b451276a29885a526f75ae06a34b19e1ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184939, "uuid": "56e1f378-47ab-41fe-9ef9-c9f73ba0d805", "comment": "Malware payload (Smoke Loader)", "value": "ffa58b5a57b67d3512cf47a5d53ae77e58b7a3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184939, "uuid": "6ddb3d68-646c-4a93-8398-e7c65b979fa2", "comment": "Malware payload (Smoke Loader)", "value": "381ae29e5fd2ea9b38a6934c65b26496eb833b5891bb419c645b1df9ca0796e6123579bfa29593d29b5d56cebf2c9576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184939, "uuid": "5e2db46f-a6b3-4faf-902a-34ece0eec9c8", "value": "T17DE3E1003790F937C06505705C39D2A4BE7EB8225163AE433B986E6FAE723D16BB7356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184939, "uuid": "04aadc52-9acd-4379-8124-b91e017672ed", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184939, "uuid": "f0f2ac46-0985-4568-a6c3-d5065a4cb099", "value": "3072:m+4hMG51j7XRoBHLzmznDXLr4UNL0IaaaaaaaNB26Vh5x:WnWLzmzDb3qIaaaaaaa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184939, "uuid": "0d1680b4-0b26-40b5-86d9-e8f755173530", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184939, "uuid": "05231e9e-9894-4f12-901c-735f3be65705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184939, "uuid": "ca1f08f7-31c8-4f54-a3d7-7217b7b66f72", "value": "45b34f9489589be4440dd9dba5ffca68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a088bfa-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180545, "uuid": "2ef6b34a-42cb-411a-bec2-df7d90e3b8e1", "comment": "Malware payload (GuLoader)", "value": "845dd8fea9edaaeaedc299cbfe2015ad", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180545, "uuid": "4a2e7cdc-8f2f-42fa-8099-1acf20c1a666", "comment": "Malware payload (GuLoader)", "value": "3ee1023e2e4495de1698ed178da31b7169dce2e83178c46603fb2f8eac798af7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180545, "uuid": "2e526503-c7f2-4166-b028-f9370b888c28", "comment": "Malware payload (GuLoader)", "value": "4a4855750295ab9a9a2f1d0ad7c97833d8dba030", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180545, "uuid": "78b62a4b-83b7-43f0-998f-78eb32c2103d", "comment": "Malware payload (GuLoader)", "value": "5e46355abb4c09587d3532a53b49ae8541519446f68ae5d19ae81f985f89378844d73864e451ce67d6461775f51bd178", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180545, "uuid": "bb7c833a-0318-40e2-9ffc-fd6bc511bf86", "value": "T14E04713E455CDCED771D3028C9608A69D0B8BE8F5661053AFCCC34A1EAE3B449B255EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180545, "uuid": "bf26bd7f-8907-45bb-98cc-90500d77750b", "value": "3072:FJjigcxAmGTnq8qcdLqmHfA4BsubFCV3YwevM8K4Ec5Cmq6wi:FJjYAmCnqkLHDKubFCV3Be3Ecw6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180545, "uuid": "8029c399-85c9-4fea-ad73-a885250f9ada", "value": 182652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180545, "uuid": "b56e4de0-594a-4e20-8cfa-9d1b18f28a7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180545, "uuid": "e3b8d84b-f41b-4348-b914-19160b7616de", "value": "Justif. prof 08-2022.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64e2d5e-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664180270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180270, "uuid": "8a43d9fb-8935-466e-b291-8bfd978d594f", "comment": "Malware payload (RedLineStealer)", "value": "78c9229c2592248ff67a4da23c6b87c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180270, "uuid": "440ca3a8-6787-46fd-ac38-a49cf44d2cae", "comment": "Malware payload (RedLineStealer)", "value": "3f3a8afe1462b065ea7ff3a60f64108b109f17664b8628077eba1bf2856122cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180270, "uuid": "fd605d0f-9cec-4371-a5dc-ae5eddb7c187", "comment": "Malware payload (RedLineStealer)", "value": "4a6dbe4bbb35e2bd0783326beb82cf8d0284d65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180270, "uuid": "8811f65f-a2dd-4221-9262-cff4f50a8bd2", "comment": "Malware payload (RedLineStealer)", "value": "06f20d8288af9e41bab728761f96e8ec8133a3211ef2a3da2470b13c6b05258a7409de2fcfe7b785e0ffcffadb94c560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180270, "uuid": "63a76f94-d910-430b-a733-c630d5064855", "value": "T145C6090674E0204F6788E6B3AB08D9B577838BCD555163D91AEFCBBB613D7123B112AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180270, "uuid": "9ec86eb5-0e2e-4012-a3f7-f3fccf3118cf", "value": "3eb5d209f4deee0471ab0b8f8e9a1a3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180270, "uuid": "0c2f880e-eb85-41bf-b148-10903115f395", "value": "98304:S/V6U3RXIMI+FIPBccmdlUexq4DausgBmagY4uJ1CsSXTVHTUoj5Vq328fITiByY:XZBglU+AZzAuiImLNR5VwzIIrvqgNwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180270, "uuid": "43d75260-3994-4131-b09f-82f06aa9df27", "value": 11708416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180270, "uuid": "cfa8abb9-d011-4a45-bf9b-70f3c32d7fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180270, "uuid": "1bd0030b-ec24-4725-8c16-49d3c601a854", "value": "78c9229c2592248ff67a4da23c6b87c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a668fa00-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200859, "uuid": "09eaae4a-7bb2-4ff8-86bf-0bdc8ba51ab9", "comment": "Malware payload", "value": "24be0c5b7cc1a9e6d94c0ccb433340bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200859, "uuid": "37e8c408-1611-45b6-8c4c-8339aa66f4e5", "comment": "Malware payload", "value": "3f590916c2ac37f08a938f8073950600d6b7722af87a644c1f30a9236f986ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200859, "uuid": "fe403e02-b9c5-47a3-b76c-d1c3aabc2d1a", "comment": "Malware payload", "value": "2e7ceba64d35cd20143def967c81b10e4ae79c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200859, "uuid": "8b16cc48-9009-436d-8c11-5791b8194aea", "comment": "Malware payload", "value": "6cb078f4e4c36377d16d035b1696cbe7b85cd753546ddc49b4e017912fde2ef0a1b3d9bd2746fcc37b178a6d4fdd5da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200859, "uuid": "f847f8f4-7da6-49f8-834c-441360e98ce5", "value": "T1E97633227AF0AB78E7879131944C1FE9E0D7E2A31DB1646763D50E8FAC3A1C0D4619BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200859, "uuid": "1cff698e-914c-482f-840a-2bb3e2de7f3b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200859, "uuid": "62d4e201-f20c-4f08-a9f2-69ca52fbd513", "value": "196608:91OdKPph8Se3cFxPji1Aqq4cpXdsBUdkFwsbhDkLJlnmcwr1:3OkxhBe3eiaqq4isB+sbh4LJlnmcwr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200859, "uuid": "7ff91294-6483-42a5-b458-5a19d3b46c90", "value": 7593323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200859, "uuid": "f995737e-4c78-4337-b0fc-152fffb2c859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200859, "uuid": "c96d0ea3-5323-49b6-b49f-41f338037e49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c5d9f1-3d9b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664197256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197256, "uuid": "043ce93b-a3df-46f4-9fc7-c5938d0e520b", "comment": "Malware payload", "value": "aa5e8e8ef501f165c360d7318eb54c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197256, "uuid": "3f279397-1fd5-4dd6-937a-82358377be1a", "comment": "Malware payload", "value": "4019ca15d23fc982b1b6530fe8b828210a9b04e163758f16a1105ac511f4bad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197256, "uuid": "5258d4e8-1bfd-48e3-93e0-7da33ceb96f9", "comment": "Malware payload", "value": "9b24b0c36bdfd150862d6278febdc1bde6bc756b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197256, "uuid": "20d8dc08-233e-48f0-a03c-4cd990120e45", "comment": "Malware payload", "value": "0b3973a4affd6231f0c5d69ef799d0bbe21de3a304c19ecaea2b3ed772ba24fc361f96968140ab004670dbf1d66d8f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197256, "uuid": "9df1f12f-50b3-43bd-9784-0c7cda7b0225", "value": "T1BE7633213AF5C9BFC7D502341778ACC5E4A3A4004E306DFB6B914A6EDC7E672C5AA11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197256, "uuid": "8076e875-653c-4e56-bde1-e0f779e709f4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197256, "uuid": "977f85e2-3e60-4fef-b1b1-565112c8e560", "value": "196608:91OiZPu7MHCoi0o3h/AGk+gOsDa3cw/qWL/7KoyCZ2B:3OSu7joiRh4Gk+gA3carLTKoyCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664197256, "uuid": "e5ddb725-b107-4fb2-bff6-36ee118eb149", "value": 7620659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664197256, "uuid": "2cf1c0a3-f37c-4928-9779-1e2451a972a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197256, "uuid": "b06ed4d4-6017-4bc0-b195-94f644221947", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02b017c-3daf-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664206003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206003, "uuid": "977451ee-1a61-4547-b148-ab63ff826a3f", "comment": "Malware payload (AgentTesla)", "value": "b92f1e453834755986777a5bd5dc1d5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206003, "uuid": "8299391d-eca0-4b45-848a-37e1cd048a7b", "comment": "Malware payload (AgentTesla)", "value": "4084110bd1fa032556c1f16a3850f492716a343616f2eb27015d1f654ff1b9c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206003, "uuid": "61b049f1-313f-4387-8a11-bd47f9263d80", "comment": "Malware payload (AgentTesla)", "value": "5751c9c918bc41c0e455dc81d8563687d3d981fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206003, "uuid": "bcef3377-9e37-441d-b365-84e81aad97b3", "comment": "Malware payload (AgentTesla)", "value": "72d1a127cfaecb07b9ec4fb9d9c0b98aa30238893fcf4e29b4e12da4d79fe757e4096e160cf45e6f4827c5d7ec351a09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206003, "uuid": "a83bd8f4-4275-46f0-a2a7-6128edba6100", "value": "T14F25F76831E6329DF46BC6B58FD87CF59A56F272531F5177607302898B2ED82CE80872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206003, "uuid": "01c22cb7-fd38-45a1-a25b-4fbfb518c61a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206003, "uuid": "13e837e2-385b-4740-899f-ab08141ec312", "value": "12288:PIo2Bn24peLKtzfWYCPsqScxtngS3xBADqjJ5npZxHgTW0P35Y5I/3f5eQFR3PAP:PIfB2VLKNWYCPLN9rjrzxIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206003, "uuid": "55113bdf-93f8-4717-a8c7-c4a1baea658e", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206003, "uuid": "5c36175d-fb67-4ba5-b060-78255f7a8a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206003, "uuid": "bee3b2aa-7078-4364-9975-62d208f7d0c7", "value": "order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649d39b1-3d6c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664177127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177127, "uuid": "cc8e7976-065b-4c78-9150-b3ada9d86d70", "comment": "Malware payload (RedLineStealer)", "value": "738e78dfc9ea354d53ea3793ab28827f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177127, "uuid": "bde8520d-4150-4a0e-8d1e-ec1d4f6bb0b7", "comment": "Malware payload (RedLineStealer)", "value": "419a857b8492c4ea817791c9ceccc19039a13f9344d8dc762ca29d433643a392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177127, "uuid": "62a3ad8d-ea72-46a1-ae84-0feb011666da", "comment": "Malware payload (RedLineStealer)", "value": "dcd61c49d4ffd4d707f176551dbffe3693f23c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177127, "uuid": "52691585-03ba-4cf4-bc65-62c9f707c2c8", "comment": "Malware payload (RedLineStealer)", "value": "7494aa9588a56c7026140a111d4d0b9330a946b20f18a0955aa1b33ecc512d8496f84e77340b37a3b6f5e305dc19d29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177127, "uuid": "8cf01531-2c1f-49ce-a830-c5c64e509844", "value": "T12E255A0372AE8F0EE16957B194F1D47097B4AE179126C28B3EC59CDF71127DA8A813E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177127, "uuid": "1e9f3369-85ac-410a-ba38-110f53917bf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177127, "uuid": "9e4b36f4-fba6-4568-94f2-5df30a4204f9", "value": "12288:tJXAvaZ87AAAVT7mOJG0TyLTlUnsispzbFCz71cPMJGYroYU:PzFVH40CTl2CAf2kZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664177127, "uuid": "ffa96ecc-69a8-4d1e-b8a7-396d31b92eb8", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664177127, "uuid": "2cef43d6-876d-4606-a81a-b4a46f1c7ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177127, "uuid": "8aaf1005-778e-44a9-bb92-5ddd062708fa", "value": "738e78dfc9ea354d53ea3793ab28827f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401cbd7c-3db1-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664206701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206701, "uuid": "207b7742-dd8a-421b-b1b7-d51403db589c", "comment": "Malware payload (GuLoader)", "value": "8df558725d572bcb84d05a9499b0e5b3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206701, "uuid": "58275a31-ad64-4aa9-b1d5-5c4c66140c6e", "comment": "Malware payload (GuLoader)", "value": "427235e614298da9464b3308fdc81c1734b82f9f09bf6008881748e843d09ac8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206701, "uuid": "00c12f9d-03f2-4831-8bbc-70b9d302f739", "comment": "Malware payload (GuLoader)", "value": "d0876a690de87e6116e069fbd1cbafe2e8c1c83d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206701, "uuid": "45e2d6bf-5c57-4dc7-b32a-ec98c7dff7b9", "comment": "Malware payload (GuLoader)", "value": "d0ede7b2e9ce423a368ff8e22c17c4a12f59c633ce209b3c625c55ea2c78e222755b081203c10c5c39cafb0add3ce827", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206701, "uuid": "a3d5d181-a835-4ef6-b845-31cb04044328", "value": "T1D014F11836E1D127D6210F701D7A9A775E9BB2052871835F331CAE4A7F332829E0E3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206701, "uuid": "90ac916c-7dc6-4c72-adad-da1dec1cb16a", "value": "3072:YAe+3aJpgWXTButSbqmjynnOCzjqfE8oEGsw4IEt0FE:jB+pgUlqm02fnwKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206701, "uuid": "8d222470-1dec-4436-805d-a98506288ae1", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206701, "uuid": "e60229dd-d518-4989-b59d-02fff9b6f284", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206701, "uuid": "c4adfdc8-865e-47d1-b78e-0096ce9e9a73", "value": "Document No.UESSCM002 rev 1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1467dc4-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664191482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191482, "uuid": "577b4865-324b-4c02-994b-8f8aa0950959", "comment": "Malware payload (Loki)", "value": "5b6fb1d951e178411e64d4e8ba522855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191482, "uuid": "c4ca4e6d-dda3-4de6-8a07-6a7541d39571", "comment": "Malware payload (Loki)", "value": "42ebd59ded52d107102158eacbedc9a6cd61c36b1a1643cbd02e36a2f0edb8e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191482, "uuid": "1ab1aa31-da00-49ea-a107-670fdace8dec", "comment": "Malware payload (Loki)", "value": "819fc6ebc370fcdec7e34ff9a2244819c040207b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191482, "uuid": "394c16fa-7714-436d-99ef-0287ecd7f5a1", "comment": "Malware payload (Loki)", "value": "c64049e75185a11435000b0a0ec76f1d6a45ae6de7ebb5fa56b12978adf947aef3465da9395667ed46402d019f95ab30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191482, "uuid": "54be16a8-f6cb-419d-b5d9-f2b363ec441c", "value": "T11B04C041B7B88C4AC9675A3148C2855586B0FC276E12D35E74CBB32C4EA13FEEE1D987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191482, "uuid": "ed10a3f7-3b96-4124-a474-d8551097b66c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191482, "uuid": "6c39bb1a-adfa-43db-9bf9-d0c5ccab359f", "value": "3072:/SNOmnZV0XEXA9roLip3OuyADQ9k9qoStvZcb4bIBjwi0YySGq:0Tw9rQip+uHU7s4b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191482, "uuid": "7d9f4161-5453-4d50-ab45-5fcbceac6c9f", "value": 175600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191482, "uuid": "638a2ab4-a4f4-4aa7-8c58-e2c4b57acb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191482, "uuid": "a4f6fa21-3865-4188-b22b-80beb8d63f2f", "value": "Inquiry DK-989850598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd700e1-3d7c-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664184125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184125, "uuid": "626929ef-a51a-4ab6-9c16-0eb483588a4b", "comment": "Malware payload (Loki)", "value": "d49d1ec1abbfd72f724cff7b47ad9d14", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184125, "uuid": "cc532c9c-a645-4189-a09a-a4cc60991784", "comment": "Malware payload (Loki)", "value": "437b8aeed7846a1bcc5a9ad86d3cf15e7c07945060b69b5d9e34f1d80707c134", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184125, "uuid": "045aca35-8f33-402d-ab7f-38767fb9cb96", "comment": "Malware payload (Loki)", "value": "255b5be08a6c41fdd0cc36a3aa0d1e053cfda137", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184125, "uuid": "b2ce8272-5632-413b-b4a0-9f6df0215bfd", "comment": "Malware payload (Loki)", "value": "3778070e2a3ff7ac72f52c3bbc771202168a35e4ba34bb753eb9dd2028e39ccce2912b9846f2aa5f7eeb451ecb202451", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184125, "uuid": "bb2db3cf-b7e2-4642-863b-bdc36767a7e2", "value": "T161D412023AE94390F4F38F0B2E2374D27B7A3661AC68BC2881DD12D445FED66C975B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184125, "uuid": "89bcf616-1791-4026-87f0-82111ea43104", "value": "192:hmKZ++C+Hm+5+E+/+S+u+a+2+J+Ca+I+Y+I+L+V+v+74+B+r+Y+c+Zc+w+3e+qKp:gcgeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184125, "uuid": "0867541a-6da5-4307-8f8c-b0a053b401b8", "value": 631240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184125, "uuid": "99095c8e-a63a-4dcb-9ae4-67dfbdd5375f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184125, "uuid": "06389845-86b5-4fce-b989-b99ebaf8be4c", "value": "P084909424.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96970ce-3dcf-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1664219789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219789, "uuid": "be75ea2e-b977-49b0-acef-8fc7e874fcf6", "comment": "Malware payload (DCRat)", "value": "1120c33a123685beb9c5c8d495c872b9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219789, "uuid": "1ac91c87-1230-4ccf-956e-d538f71a42ac", "comment": "Malware payload (DCRat)", "value": "43b410b1dd74831932b8e3da4bbeeed9ad464019a890f4f21e3f892aa07b051d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219789, "uuid": "3b5b5bba-c59d-4e49-8fcd-587ded7689b1", "comment": "Malware payload (DCRat)", "value": "e22403da688560b52d066b3bec9342ae7f5efbeb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219789, "uuid": "3bd83e02-2555-4f72-b6c5-aa71e07066f7", "comment": "Malware payload (DCRat)", "value": "1db9b0e763cb613c7dad6f4a27d6379e92823c3ffc56c9ddb75e84a6f037bf22caeb804d96b49058a8131fa789708ed7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219789, "uuid": "12c7e710-a5ee-433c-a5f4-5f0529f8afe9", "value": "T15F26D091468A5CB98F8BAC9EC668BBD00E321F9FEA8552B7415044C7D3B34478CBDDC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219789, "uuid": "cc5931df-9eee-4a48-8c9b-30944d9c8b11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219789, "uuid": "db0c1111-973d-467c-b0de-cf4809928a93", "value": "12288:ra9Nr7nRubmExiyDomMIyn+lpyo0QhcS+i3ZM+snLsRUD/EIkb8w+0HhKO35FQcR:Ce3co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664219789, "uuid": "8c54030a-b482-4d7c-8553-107cbec94100", "value": 4832896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664219789, "uuid": "8bcaf0f1-d1d6-4aa6-b57a-eac617d13930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219789, "uuid": "02686722-3ed5-47aa-9d51-7c0447a6a874", "value": "43B410B1DD74831932B8E3DA4BBEEED9AD464019A890F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18a9ced-3dbd-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664212126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212126, "uuid": "5f342a96-03eb-43b6-985b-59207750ab97", "comment": "Malware payload (Smoke Loader)", "value": "960cd6e35ff135fd78c4db373a20138a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212126, "uuid": "04a666de-a109-44bf-a47b-87b3e522328d", "comment": "Malware payload (Smoke Loader)", "value": "441d07c173ac9893425a224edff31d105744e6a3deace091d719e5465a554c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212126, "uuid": "c8991e4f-5b12-4d4b-b072-ad8d0d31f6ba", "comment": "Malware payload (Smoke Loader)", "value": "1fb5b4ded8dfd6c69c4c228316b0c9bf2c67e9f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212126, "uuid": "c2b555f3-6d18-4ff0-a6ea-069f0813ba27", "comment": "Malware payload (Smoke Loader)", "value": "58239711788eb738d91b7601ac6d564529387d015e080628a735831123b66179ff69de32efc321146a3a7d841a8f9ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212126, "uuid": "50ea5505-8539-48e1-8833-b465b7308e98", "value": "T1D9D3D02079A48473D46794B02C31EA51997FB8201AB6558F3FD47ABE1FB13D2AB39307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212126, "uuid": "5ec93262-9b8f-497b-9ece-81570e0431f2", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212126, "uuid": "a23ceb47-ad67-4982-ae87-6a18627035c7", "value": "3072:XhFHTc5tWCFYqrZuUxgH2um04AbSY4s32bzu5B:m6qrZrgHK04lHs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212126, "uuid": "0c1c68a4-98d7-4889-b761-faa55efe9b75", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212126, "uuid": "ca8f8546-2b0a-4375-8f7e-3554fedffce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212126, "uuid": "302a6215-9809-4a44-9084-b40bd472a257", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52784093-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173231, "uuid": "baeb0fab-203a-4a70-90e1-d478577ff6df", "comment": "Malware payload (Mirai)", "value": "9b788983f9383e79a4777dbf28651293", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173231, "uuid": "65a63109-d79a-47b5-8ea1-e5a100be126c", "comment": "Malware payload (Mirai)", "value": "44a0f3f325e7cf2e4c2c24502d15c935f71fe61d27ae7840e97629aab94606ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173231, "uuid": "ae4c4847-da53-4220-a995-13bddbf31b70", "comment": "Malware payload (Mirai)", "value": "e82fe1c584da38262cce43410fe6da0753d432a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173231, "uuid": "48c480fe-8b34-44d2-a935-82bca01ef753", "comment": "Malware payload (Mirai)", "value": "e454466f3d2da333284e90083f234a30c45e68a529b1351da67e4708f080d738ed69c4d8ecb8835a8dde7e8ec98ada67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173231, "uuid": "5c8cda8b-b02b-46d6-8913-0d5030db4dc6", "value": "T14A33F211E31588674D30B8358EF8478296995EECD3BE747A0347AB541EE530A9FB039E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173231, "uuid": "bdd4f906-11a2-468c-a2a5-485e417c97c4", "value": "768:vOiBkHMWsSmoAWMKcsWL4S4eNqsS2G42ReP5VfYhVIuCqYS9q3UELLLy2hhgPaLF:vXaHSjWQj4nsS2GyT0TuLLL3gPax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173231, "uuid": "01c52ece-ece3-4cd9-82ab-1d8ef2a1d7b4", "value": 54712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173231, "uuid": "d7c74cf7-c34e-41c6-b99b-c34f689e2ba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173231, "uuid": "3a223296-3aaf-478a-b367-9718c5a47168", "value": "9b788983f9383e79a4777dbf28651293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205932ab-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174435, "uuid": "74999301-4242-4577-a52e-a74a7abd2c2a", "comment": "Malware payload (SnakeKeylogger)", "value": "8e7656854358e10105f20b9992c0f17f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174435, "uuid": "d91e2173-73ce-4deb-a4f6-ca9cea0e49cb", "comment": "Malware payload (SnakeKeylogger)", "value": "44e798b75739e6fdededf5b7ff28cae9f7affa32c47e2ee447e7a81ee6e7e266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174435, "uuid": "bab98e00-d305-4ca2-993c-06830ab8e921", "comment": "Malware payload (SnakeKeylogger)", "value": "4ab6fe4eb0cc7c5df786dba8b2b2464e4d2dcb57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174435, "uuid": "b2397c99-0f53-4bde-bb5b-5169a01f8a23", "comment": "Malware payload (SnakeKeylogger)", "value": "28763709e589257e7a49ed3d2ecc6374698b3962a2032f58792b376d02ec2ae2b59357eb5286f3ab21eaa3802838b884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174435, "uuid": "75349709-1db4-4fd9-af55-a9feb1a1255b", "value": "T14025E0262BEB8E07D124A57885C1D2B593B99C02E163C2872FDE6C9FF1877D18B90747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174435, "uuid": "34c9d5d2-5817-4b88-80be-9035ea053bd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174435, "uuid": "46036a0d-30d5-48bc-9cde-ed3bd202fea9", "value": "12288:nziy2sz74MebM//NIiqczJOO2hmnpvLX0uOrqn44X:n+xsbIiqqOgnpTEuOry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174435, "uuid": "b76adf81-0f68-4450-b93b-614eb7fd5a4b", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174435, "uuid": "51f0c0ea-646d-4e26-8560-307a2b419409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174435, "uuid": "cc1d7a1a-ed9b-407e-b0bb-7e921c532f1b", "value": "Shipment Parts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044f9191-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215620, "uuid": "25ebb289-1cd2-4fc7-9f57-8f2a4d4bcc32", "comment": "Malware payload (Mirai)", "value": "0181401f5e2a71b0dea48a303afc929b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215620, "uuid": "058ed563-4f2d-4891-b515-57eed74b8842", "comment": "Malware payload (Mirai)", "value": "45aa2f736fdce131ab54c5fc17170fe13894419bdc93e33331939b9493ac2b62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215620, "uuid": "be5d3dd7-e4d7-4846-8adf-9aa4224650ca", "comment": "Malware payload (Mirai)", "value": "175f18f64bfa5916c8c6b2af4d70c8338e77cc8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215620, "uuid": "86b626e7-76da-43ee-a5be-bd9f403e28cd", "comment": "Malware payload (Mirai)", "value": "edfb5064d34a0c2ab3217e8cb0a73770cbf0dbd4efd5b1999ed62174561bcb792e51efc53182e5d7263bc6b7e0706aca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215620, "uuid": "89451a68-9658-4edb-b297-71c1c49c256e", "value": "T1C8633991FC815A03CBC202B6FA5E028E372557DCD2DEB307AD216F213ADA81B0D77A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215620, "uuid": "52751115-4ef6-40f5-a344-61c78b67d705", "value": "1536:l7A/R00KB5LFgV3R+xBS0fqkRXB9vSzvwr:l7tqHeS0fqkpuwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215620, "uuid": "63b0aa99-e5b2-4b50-8af2-dfd407fb90fd", "value": 72440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215620, "uuid": "82a04639-e228-4bc8-b800-d3e2f6cb8085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215620, "uuid": "cbab454d-67f2-4de8-b897-48a808607684", "value": "skidv2.arm-20220926-1806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f535e09a-3d79-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664182953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182953, "uuid": "92c84e4f-9269-48ba-94f2-cc036672dca6", "comment": "Malware payload", "value": "01093d931a36c434e7878f0cfa07b48e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182953, "uuid": "e1d932b1-f3d9-4db7-8edd-2902def451fb", "comment": "Malware payload", "value": "45c1a47a3fea1a7d88ed494bedd6b4c0310e6a737e05b0269c40b7414219dfc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182953, "uuid": "14b40172-fb0f-4f91-8b65-be5cf4e133e5", "comment": "Malware payload", "value": "9442c56ed4485549645b670da0b501dead8a66b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182953, "uuid": "bcf92906-293d-438d-875b-9abce7cb4d90", "comment": "Malware payload", "value": "d3e74c1a20ae134ee1aea19a65aa01a5fee191e84b2a109802640737e5be161ee51b2c02c28c6a02bdf0bd2489481a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182953, "uuid": "49852d6e-9722-4ae6-a63a-cb803ae7fb50", "value": "T10D7633203AF24AFBE5438437D78C3F8297A9536D1E71B8B33346581E4E7EA8AC511752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182953, "uuid": "0031185a-2d82-49d3-b84c-ee3be3e438ed", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182953, "uuid": "ea9aba34-5b53-4835-8468-aa7280194d0a", "value": "98304:91OXWrSAU9W8z4tHRA7tIvdSy+3z7L7Q6InP88edCzKy5P/Q6AQhj4LYsiynKarW:91OmQz4txApcPWWeANwvFnKgve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664182953, "uuid": "47b69f0c-c5d2-4875-918f-49b6dec35bf6", "value": 7629173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664182953, "uuid": "f41974dd-beb1-4a41-b47a-d521c71c63ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182953, "uuid": "f25cfe0e-1cbc-4b5d-aef4-6465e37c6667", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f180b7-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214490, "uuid": "09067281-b697-4d76-b17a-1b9205508b66", "comment": "Malware payload (IcedID)", "value": "29a569df42e2346c600f1d0bd404ee8d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214490, "uuid": "9cfc60ec-5400-4a8c-9a91-a1e3c6d10026", "comment": "Malware payload (IcedID)", "value": "461e1057fcb66e15536d92acf0da35546ecc6d9c0db677b0dfb0bc23fc2bbe88", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214490, "uuid": "ce759816-b365-4db4-92c9-03b055d1e9db", "comment": "Malware payload (IcedID)", "value": "0c11fa15db83d6bc195a4e688dac30f40af6c18d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214490, "uuid": "b6464699-5976-4faf-b31f-b8a6fba40aef", "comment": "Malware payload (IcedID)", "value": "02204528b17f0657e14b51aa4183faef7adb69fd288eb5ca9d84becaf68b349a488865ca3401d2f0650c7b19068094a1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214490, "uuid": "0f49e8e2-589a-4ea7-9686-9b0cd26c96b6", "value": "T10115F105DF40606BF00B683E371765D7A8661C27308BDE0E6B96212E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214490, "uuid": "a9756108-f62d-4dce-af77-de2ceef94fbb", "value": "12288:b4VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DETFesyul93PE:0V2jUeQRI5wPN/AkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214490, "uuid": "55bd427a-36ec-4554-86af-eab448b71453", "value": 888038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214490, "uuid": "59b27f71-fc31-40da-b6e7-8f11a781eb09", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214490, "uuid": "3cef8fa7-44f0-468b-846e-8056fbf21b9a", "value": "localnet,document,09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34e461e-3d7b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664183701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183701, "uuid": "be94cdfb-a639-4e70-a60e-d02c76820ec3", "comment": "Malware payload", "value": "f4b19e0a35bd719bb0fee8cbb4cac030", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183701, "uuid": "fab119cf-0427-4e23-b3bf-c608ae22a21a", "comment": "Malware payload", "value": "46a7d30dc4720e359bf935142d2e0fbc022a770c77140e4736c81cea16c0939f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183701, "uuid": "e97c39f8-85ec-44e2-b2e0-bef4d5f3b3da", "comment": "Malware payload", "value": "f07e37b13b393c8c670a3f1e51346e26ce9ba11c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183701, "uuid": "8c59ee91-e504-482c-a2d4-58e754f8d1cb", "comment": "Malware payload", "value": "0ebe8f99b64caf3398b0605d107cc562a5351ea4364b36ed98d480fe2f983c8d3968df74f6163d72b10c9e678e0257ab", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183701, "uuid": "eafc5e8f-68d5-42da-890d-3a6f209cfb86", "value": "T1FC273363580A9CDFC03164355A7F6384A875CE6A3EE36B610058EE73C5F25A1CEDDAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183701, "uuid": "2a5b50ae-086b-4131-b94c-1fe825cb84b2", "value": "393216:ubd2ZsJA35z7A79L+/Gd1mbgafiubc5ZfbjT9i/zVN2I+TXx1UKpPbNiRSKcsHJh:ubdJA35z7c5PrmbBffcvfJi/zVN2IkBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664183701, "uuid": "28d221ee-050e-4dea-ace6-158a7a2f532a", "value": 21619955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664183701, "uuid": "2d2d86f0-c271-4164-9d31-c5e2cfd70be9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183701, "uuid": "c525c5ab-7116-4dfc-ba10-02970ab7954c", "value": "46a7d30dc4720e359bf935142d2e0fbc022a770c77140e4736c81cea16c0939f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7088c9-3d5a-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664169493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169493, "uuid": "cddd6845-4ddf-4e09-b5e9-e8a65cd641ab", "comment": "Malware payload (Stop)", "value": "8ddfd2a786411cc381a6b9cd9bcbeffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169493, "uuid": "6f753483-c44c-49a5-b888-600f6c8845d9", "comment": "Malware payload (Stop)", "value": "46b4617fd1f128a1b8bc1f9f62eec22f2df80af0f78b72fdd9843650a916cfdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169493, "uuid": "bcc37cf5-14c4-4bb7-8913-5f8818c9b32e", "comment": "Malware payload (Stop)", "value": "f9f90f03657aee4a07d0f3cb8759a3f4b732e3d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169493, "uuid": "958ba0e3-ca4c-4aa3-988c-36a8a66a7c3e", "comment": "Malware payload (Stop)", "value": "7bf6b7f7ecbb672450b3ba621678b7dc76060de6afa071f876217d295df8af63135f891c1156923010c3a24587173551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169493, "uuid": "fd7b708b-b82d-4fc3-a1e1-246e9e4c708e", "value": "T1E1E423607644F8B6D01E98B4B8ACC538AB35AD124F025B863B68EF7F3D312D4B636355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169493, "uuid": "6bc7e771-7208-46a3-a6af-a5b2bc63feed", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169493, "uuid": "a9052aca-7d17-4d98-b4b7-f12f7de2b2b4", "value": "12288:8FzI63hC29kmJ++wBt6X6cR1W1a6xw01U7Sz387IAXF1susk:8ptxl1JZwBIuFESz3EXHsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664169493, "uuid": "4b61dce4-3000-49c2-ae0d-c3a58057b52b", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664169493, "uuid": "d6524f3a-74d2-4cda-b061-888aba524cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169493, "uuid": "c0d79386-5de2-4e90-92f8-37d9a2001ba5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86a0d1e-3d9e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664198850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198850, "uuid": "fac9e0ac-901c-4cd4-a3fd-83d8fe52c830", "comment": "Malware payload", "value": "a2f6b3f1ecf049aa61ff686213c7af7e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198850, "uuid": "b4bf70c1-ad72-4187-826c-55e4a7bce064", "comment": "Malware payload", "value": "46c85f8e26c042078bb1a38e521a4be458df3d3a174b3424d07887f9bca7e03f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198850, "uuid": "3644a555-8ef9-41ac-80db-b635115d0350", "comment": "Malware payload", "value": "bbb895b4c027f0a1c36487082bd901e60ec70d98", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198850, "uuid": "71904668-96ae-44d9-b1a3-cc97fa105f3e", "comment": "Malware payload", "value": "f7c4446a5cff1e2f41bd7b4ab0606a1e61fe1e406bbd45d118202bfbe45cab130c68ca512c5ab263f24af23c12eb1786", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198850, "uuid": "38052f5f-8aa3-46d8-8690-77d23adc8ba7", "value": "T16691E82E674C1883C916D9F7D1C5BF565A16F61EC9CB0780337DFAF00B6B8112A689C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198850, "uuid": "83ef5a9a-0696-46dd-af3e-b5d0b63e9148", "value": "96:y2EvHlh3lRqYuBsEats83ISXuTCELl58FFSibaRHFh6:XI3lR8TmIAu5lmFgieg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198850, "uuid": "afb4feb5-4445-4ea5-9b0b-c6e487fb9761", "value": 4581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198850, "uuid": "c7a00fe8-2f66-439c-9722-98e0030bee5d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198850, "uuid": "b452e184-f7d6-4f63-8bc3-1168ca9d2b51", "value": "RFQ SJK2469-METCO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923b478b-3d80-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664185793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185793, "uuid": "fd797d19-7cc8-43dc-ab68-a164710aa474", "comment": "Malware payload", "value": "f944e7bfbbb522db6c478a6e27087af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185793, "uuid": "09f4a79e-b435-4231-b8e4-09b6776fc009", "comment": "Malware payload", "value": "46e5facbe39ddba59e7a0131c19f3f76e5908ab2b20e66180944d85f75afbf0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185793, "uuid": "e6d077c6-7d13-4e6e-99fd-1ab4ac3f9dba", "comment": "Malware payload", "value": "c9d6a71e6edc3cf8b7a71b6c22ccc37271983216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185793, "uuid": "357b0b8e-590d-42da-ac89-e16389f2b27a", "comment": "Malware payload", "value": "414630986a3884363ea24bade99fe33de71e3bf4a412f56591de3cb86d67d488e283db55a89a954fb9e558429817d1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185793, "uuid": "4c5d54a4-f80e-449e-a6f6-a27d83150459", "value": "T115055A1AB2D7143BC03706BD492792645C3B7D202A96585A5EFCBF4C0F392A33D36E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185793, "uuid": "6a4b7d04-7925-4baa-b5bf-1d5e5565045f", "value": "c00b6ba7dbbc6abee9ace3a65a49ba24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185793, "uuid": "91a44195-c407-43d6-a75f-9328f0ff8544", "value": "12288:OwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEj888888888888W8888888J:eNzCtUpQ9WWPBSSRMTEpMN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664185793, "uuid": "1fbcf284-57e8-486c-ae92-f35a754f2aeb", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664185793, "uuid": "e84ff4ac-1fea-4a81-b9b2-b9eb24604d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185793, "uuid": "6b6e23b2-6db9-46e7-81a8-48819ef41e63", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6634d219-3dad-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1664205047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205047, "uuid": "6ce68f2e-6024-4714-b749-683b47ed9690", "comment": "Malware payload (AsyncRAT)", "value": "26454b46bef46b885e8477922d3d08d4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205047, "uuid": "5abdd0bf-cb81-477e-8c2f-96ca115f1382", "comment": "Malware payload (AsyncRAT)", "value": "47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205047, "uuid": "849a1a48-128f-4aa2-89fb-89846268840a", "comment": "Malware payload (AsyncRAT)", "value": "add2c041f12ce35e621dd3e162a61a7196eee48c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205047, "uuid": "9ce4e157-64e7-4953-9062-c792a3aa8217", "comment": "Malware payload (AsyncRAT)", "value": "ffa60139f6425f333b2254e5c43ea215ee1eadfe747b61db75e594e2752789b95d3e70add4af222163cfb6d3ee197600", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205047, "uuid": "25fbe34e-1c75-432b-9f11-e4df8c173ab4", "value": "T1D4751230DD036073DA7706F1E526C3C9D51BB5736D988528F91233E32EA0AEA5F99362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205047, "uuid": "2825cf96-80b6-400c-af89-4973172db9f9", "value": "af58d77e2de72a34dfec8ea762118eda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205047, "uuid": "1f2b28df-745c-45af-a2ac-e5a929d4005f", "value": "49152:Ag6cnCiIkofSoKkVOUUi12RK27PB6yy0E6MenVeUQu:4VdSF3i12XDB62thUUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205047, "uuid": "6b310021-b459-4d2b-abbb-d94c555a6820", "value": 1599888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205047, "uuid": "251e61e2-47b9-4403-b5dd-ca42d2885e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205047, "uuid": "67b00710-f23a-43c5-84fd-bc9985b31833", "value": "Alfa INS Invoice Print - #29738.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d47985-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664173797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173797, "uuid": "bcecaaf6-a815-49ed-bb25-196a5adc6eca", "comment": "Malware payload", "value": "7fd0a6b79aedcf651ec5a12e3a9e5a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173797, "uuid": "d110bc69-e9b5-4903-8f7f-0415722a61cd", "comment": "Malware payload", "value": "47a515c2f07a30df526d6c422c944f65c98be3dd33c36238a3614415444163a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173797, "uuid": "df671d8f-a58a-4779-8366-02d61b82f4c1", "comment": "Malware payload", "value": "1338fc24e26d601eec8a9a3b9e9155c4938d279e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173797, "uuid": "eff2407c-0a93-4875-82b3-01abc48546b3", "comment": "Malware payload", "value": "cc3cfb61b20ac56362e6a0a1100ff449a461d9cedda14a936e245a3c1c9f7e98abf719382818725d1b057753ddcd7bf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173797, "uuid": "67109cec-d4b5-4674-a8c3-4709208e153a", "value": "T14AD5338456908BC9CC1E3835876E4BCCDF64C681EEA02299DC9F7392DC3B99F6E1D064", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173797, "uuid": "77c19b84-2189-4056-a580-7bec58c637e1", "value": "42b27a080e9ee0252f310f33fbc7cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173797, "uuid": "93652ca9-b12c-4a05-82fb-c2bf4b400ba3", "value": "49152:PArsaY7rjv3L7JaJe8/82EhwB9kjZnqGmGlAektdD29o2qr2d8mhQmb0dbn+ty:Yfajhaw8/8TOB9gnqpGeektdgir88wQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173797, "uuid": "6c4509a1-98e8-4d8c-bfc3-45ee6d53cd7e", "value": 3019264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173797, "uuid": "28927568-5fba-47cf-ae5f-73734c75b09e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173797, "uuid": "abcbfd9a-46c7-4e3d-8a2d-27acd549ef5e", "value": "DpEditor.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13da07b3-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174414, "uuid": "cb2ccf56-b875-41d5-9441-a00903ed42f8", "comment": "Malware payload (SnakeKeylogger)", "value": "3a28f4cabbfae4dc29340b3a1d30b625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174414, "uuid": "1ce0a183-6802-41ea-a7ae-dd10c39d5020", "comment": "Malware payload (SnakeKeylogger)", "value": "48ff3233c3694371ce56482b7d430918c75b4efe5f34b6f27877c878e43f4f38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174414, "uuid": "8890206f-ec67-4696-8a6d-b34a7e7f0bca", "comment": "Malware payload (SnakeKeylogger)", "value": "e82576843c529fe3a78f20fe54df6fb7744ba5de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174414, "uuid": "dfbab768-9e00-45a3-ac70-a55cdb0911c0", "comment": "Malware payload (SnakeKeylogger)", "value": "a3d084f5cbd252a3dc68f6de070e6e66667bd14c9d98e401f915d75201d3caacfec2b66320858e6c74c124267a461401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174414, "uuid": "da91271d-5330-43ad-b754-de6bdc431e70", "value": "T16F458E92A1908C9BE85B05F1AC6AE53025D7AE5C94B4810E56DEBF1F75F3302209FF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174414, "uuid": "f0dde0c8-608c-417b-bd0d-52712a6e5118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174414, "uuid": "60cadec7-87a1-40e1-9697-d1eca8504305", "value": "12288:iLICLAvgERCZX1ay+60qHJbgvdsSqMa9a6xYn5l+f26FbMbw713RuJGSpRF2XG:wz83Yp1aS5OsTbcLn5t6FgyhuJrRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174414, "uuid": "54bc1adc-5068-4225-9598-3478fe94e3a0", "value": 1275392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174414, "uuid": "2f42499a-fffb-463b-8f41-df563662afca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174414, "uuid": "59a1dea3-abd9-4b95-8317-be7b7211d6f0", "value": "Proforma_Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a1123d-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227375, "uuid": "0b817919-9c19-475b-9ab8-2a0b60d84eda", "comment": "Malware payload (Mirai)", "value": "98dc0ea2186c1aaf80d48d9753af59fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227375, "uuid": "ea9ac350-f52b-4810-bd54-5e72dc46a0e8", "comment": "Malware payload (Mirai)", "value": "493c8cb2422e241769a714325f806320cafb9665be3669a9f497a1edc1286de8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227375, "uuid": "72ce722c-cd18-4eed-8d54-e21ccb66f2ba", "comment": "Malware payload (Mirai)", "value": "0bec3a0fdbfbe73d4c85c4516d8c65a423fb2bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227375, "uuid": "42133bea-f73a-4d8c-9885-4e9286486c09", "comment": "Malware payload (Mirai)", "value": "8b349abd01c09159a1b4c13ab5de691d1e531f996a500c47510c76bb169ed23923eb6587449e11e583711db65129814b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227375, "uuid": "008c9fa5-b6d4-4e87-8a1b-f980ad673e47", "value": "T130F2F1F5D9633E698D912B797A204AB3235A399E97FA37211261CD8C20C04424FDE567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227375, "uuid": "41e6da95-6a2f-4ce5-a70b-cb5b6d8a4f33", "value": "768:JNh95PuNlmVcJZIPVKZJ5yYAkwxw6r3rHtfkMB9q3UEL+ep:JfrufmGii5Jmw69v0Ltp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227375, "uuid": "5584a57d-3814-4e15-9a9b-af4b8113b99a", "value": 37248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227375, "uuid": "e0fe10c2-5f09-4006-b10c-a14766970576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227375, "uuid": "f0d2de6a-fb5a-48ac-ac07-f25c94eaae2f", "value": "98dc0ea2186c1aaf80d48d9753af59fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0410f88d-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664213901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213901, "uuid": "a4a56098-bf73-4d78-b602-80b11965a668", "comment": "Malware payload (RecordBreaker)", "value": "d77a261c8434d6ab76eccac1398d845d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213901, "uuid": "21f93432-1dd4-4107-b7ea-8e58093a4fa5", "comment": "Malware payload (RecordBreaker)", "value": "497acacc3f41d00e6bf7c55b2f2eed21c07dbd5b1396081564ea2d887683c062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213901, "uuid": "84d82bcc-1b9f-4074-a829-6d08e1eee648", "comment": "Malware payload (RecordBreaker)", "value": "082993668d2232082efdf1f0a7edb321e0326a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213901, "uuid": "ebd18ace-cc90-4899-bf6e-507979017fbd", "comment": "Malware payload (RecordBreaker)", "value": "10d6bf94596e1feb516b8509b4a29fd9eceaa88b12cd52ef279b379400d1eab1f7b06bef27782c0c2b3cf3ff47e3eeeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213901, "uuid": "140ec9d1-5526-47cb-a4db-dd3dd22dec59", "value": "T167D3F11179A1D473C1238BB47C74D3827A3FB5610AAA498B3794269F6F317C2AB36317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213901, "uuid": "5d532f5b-5655-42c3-b77d-07ff07df7985", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213901, "uuid": "e7a2a861-35d9-4a38-82c3-96dc38a6539d", "value": "1536:pfSWSY7ET2qPYZTc5V/TRzRStJJW4hjpLe5ooVeh82KywaS8dZ7r/X58d7AEe4En:paWSCTc5hTte/NArnp8x8d72T5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213901, "uuid": "0726aa1b-1227-4324-ab01-5932d6100822", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213901, "uuid": "b848f16f-a616-4593-8edd-ce5933d300e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213901, "uuid": "b166b880-6c2f-40bc-8e78-62ae39a2b5ff", "value": "d77a261c8434d6ab76eccac1398d845d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8187e5e8-3d49-11ed-9266-42010a9c0072", "comment": "Malware payload (AZORult)", "timestamp": 1664162143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162143, "uuid": "cc0d3c88-f496-429d-bc16-c8ef66013f6e", "comment": "Malware payload (AZORult)", "value": "b88afd394118edcc103674f7b1520837", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162143, "uuid": "19babcce-0c6b-4e58-b7e4-994ec3a81a34", "comment": "Malware payload (AZORult)", "value": "49863fc152c9e84f36d28f4b11b8e011c68791beaa8974b50cccb7508f01e444", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162143, "uuid": "b6dce472-845b-45af-86eb-35efbbb1c5ac", "comment": "Malware payload (AZORult)", "value": "4d85547a7e5bea8be811d4ff11b233cfbfb44a21", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162143, "uuid": "c8746ee2-526c-4e01-8612-15cf3d299eb8", "comment": "Malware payload (AZORult)", "value": "f7d803fb3473b2a334a747041a9ff5a95b145f7d12129769488def096a3fa06ea7d0279385c3b9f7cbbf103d91a5b897", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162143, "uuid": "168d8b42-317a-4d14-b87d-1c79736ad1d5", "value": "T1DB15F1371BDB9B0BD11275B895D0D2F6A79ECD00E427C3D76BCAAC1FF09A4259A60360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162143, "uuid": "4bc89b8d-cf28-40ff-9366-ca69ad067317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162143, "uuid": "8e2cb9f5-aca3-4518-90d0-9f933b5b88e0", "value": "12288:yVdTaPkXK2VWdCv+opvJhiwTzvq3svMmrjTDoeg8Xf6JYnoRaYwJw45xcSf+zUKL:62cP0PWndTjq2TE8Xf8YnoRf8w8xc0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664162143, "uuid": "9fa00fe0-a944-492e-8bb0-e0080f7ddf00", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664162143, "uuid": "07c7a4a8-ddd0-420e-a2bf-4748bdc89300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162143, "uuid": "e77045a5-98d4-4bdc-b371-566e4b47d16a", "value": "Quote request,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb035ba7-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213457, "uuid": "f2b6e6ca-9884-4a9c-a6e1-6634e441fc13", "comment": "Malware payload (IcedID)", "value": "c35884ae9c17e0e8a3d92cbfaf1dd838", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213457, "uuid": "c3951fe9-2b34-48c9-89e6-c1c9669ffc2a", "comment": "Malware payload (IcedID)", "value": "4aed84df96bdbf16a4f5b4c2a195e9384b891b35328108aae8f3243a50e3dc25", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213457, "uuid": "205c1105-056d-43a4-abac-63d8d32cca21", "comment": "Malware payload (IcedID)", "value": "323b683e1647ac929fc8bd6f36711f469817f25f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213457, "uuid": "165cc6e6-41e1-4975-865f-8d3fe5c3f0c1", "comment": "Malware payload (IcedID)", "value": "394ce4b187731bc51026d33d9d74968735a3f2f44bd86a493566d86d501eedd597af307e11764fea54a2626d493e4e8e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213457, "uuid": "1d5bfd41-7dc8-4602-a1d2-452cd555dfb8", "value": "T1CB15F105CF44606BF00B687E371765D7A8A61C2B308BDE1E6B86116E2AC7FA0FD35C56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213457, "uuid": "502aa42c-c246-42f3-841f-313ff3fb5087", "value": "12288:UwVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEC0yuhh/S0cOxtUB:TV2jUeQRI5wPN/ah60Bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213457, "uuid": "3fa4d3c1-e092-49f7-99cf-e3a74a35e14a", "value": 886601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213457, "uuid": "68e4fa0c-938b-43f3-9e88-bab7574adc39", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213457, "uuid": "1908bedf-0fd4-41b5-8440-480ff929cd40", "value": "k-mpw document 09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13ea883-3daf-11ed-9266-42010a9c0072", "comment": "Malware payload (Meterpreter)", "timestamp": 1664206005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206005, "uuid": "912947cc-124e-4ab7-abf9-642523b06319", "comment": "Malware payload (Meterpreter)", "value": "cc0c3124205687f49ad82704167f09f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206005, "uuid": "03e389b5-2310-4c07-9c34-e6ef2a805438", "comment": "Malware payload (Meterpreter)", "value": "4b11c865b274c99a7820e4ffa30df20ac3b28a70cc72b2bbf5154da9938d8d7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206005, "uuid": "66304815-d037-415c-ac34-0ddb145e75dd", "comment": "Malware payload (Meterpreter)", "value": "094a2c0e6ed7da11d50f34befbf057023316c211", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206005, "uuid": "d8fecc30-8fd1-422a-a4ec-871fd7e2333f", "comment": "Malware payload (Meterpreter)", "value": "2557d11b26d0d1d80892144db945558f6ff2a7f61f80347acc2a4ed94db67a1f47ec53b418c328d74fc1a676c33cbdb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206005, "uuid": "d8145400-bc70-4a68-83c0-bb3609885c03", "value": "T1E954D0CAE7C59EA7DA5C067588EE83193334E6C02B83CF131A34953A1E673D4EF86546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206005, "uuid": "39f35aa4-40c3-4d5d-915d-ca117cf17ee4", "value": "2b85eda5e2ca4805e05003741ab3fe72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206005, "uuid": "272aa175-4ccd-454e-ace0-0159c02a1834", "value": "6144:OtyeCACAnycGhXH3dnZ1mccukwsrPH/I54IlyG+:nrAnyH3dzkfHAiM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206005, "uuid": "6854f97c-ba33-4a95-8d90-9e3c3d1a06f9", "value": 295950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206005, "uuid": "a3dcdd2b-9d95-4022-a706-82450e003242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206005, "uuid": "3f282197-e0bc-4351-afc4-5b8d57d92444", "value": "charlotte.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509ef189-3d5f-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664171510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171510, "uuid": "6bb6535a-e60d-4d15-854b-dbffd8c034ef", "comment": "Malware payload (GCleaner)", "value": "2152379b12bd6cdbd317dfc0f12f70bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171510, "uuid": "ed562aea-752d-492c-bab4-d59cd92a4781", "comment": "Malware payload (GCleaner)", "value": "4c09444d07293be86e5df1a978ae3b81e6f8baac2f09e1409f4653408b0864e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171510, "uuid": "57191c30-c9eb-4ccb-a87f-762a6638ba15", "comment": "Malware payload (GCleaner)", "value": "8360b7659ded6b0ad2d8941d812b2eee23ee89e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171510, "uuid": "41374e4a-959c-44d8-b795-ac947d40702b", "comment": "Malware payload (GCleaner)", "value": "a48a6bb8f42f8e99d3eff4cb1468ff28470a86016b82e04bbc4aa241b47ce86874f777c14ab8297f310b42e5f4801866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171510, "uuid": "c5ba3b7a-c64f-4ed8-a62e-f28de42f58f8", "value": "T16A3402127F90F831D82D71748432E6A219FEBC55113157473BA81E9FBE31BE2A635386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171510, "uuid": "0f329b05-0664-41eb-9ecc-294fdec90d69", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171510, "uuid": "8ca6587d-98f1-4601-a6f5-6bb0d8645632", "value": "6144:SI9k78SBZDC0Ir5pozkOaQELepwkO5xN:SIxhpWFNEOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171510, "uuid": "c85a9e37-972d-4516-852c-b840d9eedd35", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171510, "uuid": "63659050-d09d-47ab-b700-9a6093be7861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171510, "uuid": "c41c2eca-ca38-4fe9-a584-9593c5db1dd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce86547f-3d4f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664164849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164849, "uuid": "a52f37c1-91fc-45a5-89fc-6d763a9d04c8", "comment": "Malware payload (Smoke Loader)", "value": "8d6efe332c8dd7e98f5ac5679488a231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164849, "uuid": "4133000a-8a1d-4334-8906-ed06826bc210", "comment": "Malware payload (Smoke Loader)", "value": "4c1726137e76add925cc8d3b1f9e2e140b3c0d0fb6f77b2e27562d85e8e77a21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164849, "uuid": "0b8e6db1-c684-481a-802f-049a04246a29", "comment": "Malware payload (Smoke Loader)", "value": "73dc9e2a95fca06d8ee4d3d5d56321e9aa7ac886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164849, "uuid": "164ba72c-2c00-4c7b-a600-39d6f26a1759", "comment": "Malware payload (Smoke Loader)", "value": "95edc583d7258c0b4bb659a0b4992ac6589ab22ba057418634a7cb918f0e31988eff2c37898edb116d38c2a17babe892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164849, "uuid": "f428fac2-64b0-4e47-93d0-7bb367242aa9", "value": "T16804E1113680D872C19699B45874CBF11F7EB9120636468B3B682FBF6F303E25AF6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164849, "uuid": "1c7e5b71-0c20-4cf0-9da0-990bdad10362", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164849, "uuid": "5d3b5d17-872b-4f64-a491-1f190c169950", "value": "3072:UH+ZrT7UM8S35qMtlz6eGqZ5jJS2kXf9FcGDBGnogj5x:xcMzSgjuXfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664164849, "uuid": "5247f143-b2be-460d-8485-0ce404e9c957", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664164849, "uuid": "63f18080-ad2c-48b2-a0c6-621280aa1b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164849, "uuid": "60444fc4-f2b7-48bb-957f-d8ecbb7cc4c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239f4c61-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664180883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180883, "uuid": "3407bde8-f6b5-47f5-863e-3d143703a0b3", "comment": "Malware payload (Loki)", "value": "9e35fc11ec8d0184d599293d0856239d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180883, "uuid": "82e159a0-08be-4e49-affc-ba70b0ef6afa", "comment": "Malware payload (Loki)", "value": "4cf39d3691d9ab6f74a3e188059d7f6189e01bb8442be3502e267ff3132f9930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180883, "uuid": "14d78964-27c8-479f-b0b6-7387e9ab392d", "comment": "Malware payload (Loki)", "value": "30facfc924419b1d0b84f94ab77b80c5756e95a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180883, "uuid": "bd5bd870-feb2-4644-a4e8-1b1a1a34cb02", "comment": "Malware payload (Loki)", "value": "4e0d00c866a4e8322f989e59b7239079864054a5c7a8108e7883b6bc21c8e05102e177a5dc9263dc87e09e85658e7c52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180883, "uuid": "9c7095c2-ac4e-4f42-b8d5-57454812d8af", "value": "T19AE4DF370BEA8F0BD016B5B890D1C6F6E7A9DC11E477C6876BCA6C1FF08A4659B61310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180883, "uuid": "ed42d309-e1cd-4589-a6e9-0f99b76ba3cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180883, "uuid": "39ed0ffc-e3d8-4623-8db1-abcd2a9e7428", "value": "6144:bHvsajJ7tRyu7CmI9sP+fFC0Z2PCuHEVVg8Q5MyRcxam4J6rBDZ9VoUaewW3o7Kp:bPtRyu7BI9K+thB3NQT7md1DZ9V2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180883, "uuid": "733a34f2-763f-4973-b7d2-3cc1ff2cc8fe", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180883, "uuid": "5f85c948-0526-4180-af45-88f33292e1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180883, "uuid": "10804473-eb24-46e4-a8bf-1d18634e7981", "value": "TNT Receipt_#87993766478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e34e82-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215079, "uuid": "6bc84e69-ef21-447f-8df9-6c89f03200a4", "comment": "Malware payload (IcedID)", "value": "1421cff1d2bed5590ffe5c9073243cfe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215079, "uuid": "bb421e2f-314f-4550-985e-71e179a031d1", "comment": "Malware payload (IcedID)", "value": "4d992810e9a05e27afabf2194cd04612dca0a738dc076778a56459cf97c6b9f1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215079, "uuid": "ae6970f4-8e67-4fce-9e39-e37aa560030a", "comment": "Malware payload (IcedID)", "value": "e0bd5496050a0f2e597127163b93c94f9149184a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215079, "uuid": "26eec677-1281-473c-927a-c65f5d695a0f", "comment": "Malware payload (IcedID)", "value": "1a91c1df6dee68d942092b0362d0b8e9f5d1154ab4d427e6c4ca32cc8092a99bebef764fd589aab7e99c21293ff85d17", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215079, "uuid": "98a56a66-f08c-45b0-980c-55b7dabc8194", "value": "T17415F105CF10606BF00B693E371765C7F9621C2B308BDE1A6B96112E2AD7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215079, "uuid": "b86410ca-e88a-493c-b8a9-57390d44ab5c", "value": "12288:thL7VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEvtm9d/+CWSzv36htHTZ:7L7V2jUeQRI5wPN/+trWzit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215079, "uuid": "7b2e87af-738f-44a1-a867-c243409b4a6e", "value": 887152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215079, "uuid": "d92a6245-b2e9-4c15-b3e1-cf11c447681c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215079, "uuid": "9634792e-0718-4ab3-ba9e-b50436c252d6", "value": "mohr4document09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370f527c-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1664189935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189935, "uuid": "40f52b03-899d-44e2-a10c-dc3f92bc3e5c", "comment": "Malware payload (ModiLoader)", "value": "412b584304ab60b055c383012d8ff312", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189935, "uuid": "a12dee51-f634-41d9-9cbc-8e48d2a07036", "comment": "Malware payload (ModiLoader)", "value": "4da193c29dd8e9bcd00b122ca1717dc4a4ef46f31dcf2fa53361b2a2d6c80a4b", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189935, "uuid": "4ff05fc9-4568-4671-bd17-e2a576f1a312", "comment": "Malware payload (ModiLoader)", "value": "ef06af5cef5ea55fad76aa43a49f8346279444fa", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189935, "uuid": "727c8976-ecf4-419f-a91c-42757598733f", "comment": "Malware payload (ModiLoader)", "value": "37c47d97a1c4c7517947cb86a4a266affefc90ea7db5cdeadb6f530691d7c7829b402198340a236efb75579ca07ba356", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189935, "uuid": "eb41ad9d-aa63-4fb9-ae22-9da1fbf1dbed", "value": "T1FB64234A1C88B1D2694F36C8CCA5A471DFEE3F07D0A17612C8EEDFF0442B799286AC51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189935, "uuid": "659279f1-b62e-4760-aba6-cce0233a91eb", "value": "6144:StEVg3XnFYLrw+y/LpaH/op+nYAaUfmKz6hIdQoDZN47tW:cjV9+y/Lu/y3DFWRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189935, "uuid": "aa9a87e9-c01f-4188-833b-5e9157b1b280", "value": 329646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189935, "uuid": "adfbf114-c414-49a3-a802-6a42a9e71165", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189935, "uuid": "5fd20eab-7d17-4f49-923f-0c37a20ae96b", "value": "nova lista narudzbi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0a69d1-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213861, "uuid": "c14b46b0-0628-4cdf-a94b-600bcc97aba6", "comment": "Malware payload (IcedID)", "value": "88cc02f7d1dbe75e22c8c7eddb01f5dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213861, "uuid": "1600d034-7eaf-4f42-ae5e-7d2e9d9678f9", "comment": "Malware payload (IcedID)", "value": "4de986bc1d553823577929819c03ee508e911384119ebdb1f0d8cb190a7e381e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213861, "uuid": "98242a68-3b3a-4e76-b420-4ed72ea6aeba", "comment": "Malware payload (IcedID)", "value": "2dd7c4a231acf2b0a189038e3d3e4b86d28122fd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213861, "uuid": "b525bfef-f2ac-4f3b-98de-39bae4862d95", "comment": "Malware payload (IcedID)", "value": "9a8ce132debf9522e91f8c62ff776c4eda1e7d21da99809425cabdd73dec6b8c429ec9068e5f07d9119d82476ce44a04", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213861, "uuid": "ec1546e3-d635-49b1-ac83-be7edbb7da2d", "value": "T19115F105CF10616BF00B697F330765D7A8661C2B308BDE0AAB96112E29D7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213861, "uuid": "31d1365b-5648-4974-8978-907e8f1691cc", "value": "12288:OJVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEMsy69d/+CEz5w6hteci3:OJV2jUeQRI5wPN/tsyP15Xi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213861, "uuid": "e18c7faa-920c-4294-b4db-fb64254d8f63", "value": 886842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213861, "uuid": "466c5b85-b1f5-4c0c-bc40-3158fb6aff94", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213861, "uuid": "4840e8fa-fcbb-4204-b55f-4cdbff363adb", "value": "ncsforallinvoice09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccef274a-3da2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200495, "uuid": "6ad4e0d6-02d6-438a-b4d7-d29fd1435921", "comment": "Malware payload", "value": "00e908d58e89acb800775ed6a7f8fd38", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200495, "uuid": "cf0731b1-cdb5-4136-bf7c-3bca02c502a4", "comment": "Malware payload", "value": "4eea31a02d16984872531d86271f81992c62313fccad9e3b644f82e48e66ee43", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200495, "uuid": "63f17ca0-bc6b-4446-aa15-9298b225180f", "comment": "Malware payload", "value": "d1829cfb0f60947f266756efb44095a2e41aa7fd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200495, "uuid": "57610f7b-f270-4561-94d4-00105a7b30a2", "comment": "Malware payload", "value": "30b40265deea086702c4f1e9d3a60099e355ac3d8c5fc0f486d869f677bd914337ebed039967444a0c244ce5a5f4d61f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200495, "uuid": "1fe30af4-95b1-4470-a49c-006effc154a8", "value": "T17F92BF29CAAC4462D64563B9430D074BB77D765BD363A71A3C49E7C47982AFC0F22E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200495, "uuid": "16b1a8eb-7b63-4018-a5d8-765d9e22944c", "value": "384:E8aL0PtzckZhUctvafzcAUkxF1BPd+I+Muh36+DdEZFEw6n8cdWPGAx:paStzckIc901pxFvE8uw++FEr8c6Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200495, "uuid": "026de6f1-194b-4dde-85d7-0708dc747f00", "value": 20418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200495, "uuid": "fa1d4b0a-a4bc-4539-b833-bc6258749b74", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200495, "uuid": "728fa5a3-874a-4e84-aa1d-adbbf86e0976", "value": "Untitled attachment 00011.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5873b7e-3db1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664206925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206925, "uuid": "c91255c4-9950-4aa6-b284-90f8455fc4a1", "comment": "Malware payload", "value": "68059029ae1704a5badfe851ad9f6f42", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206925, "uuid": "a9a7138d-2261-482f-a6b9-2520430e060b", "comment": "Malware payload", "value": "4eed1222a7fcfae26595d3c3a1eed02acd2c8a78a101ff30ab410ece9dbc4b32", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206925, "uuid": "51be1845-a261-4c14-a728-f7bdd69bd8c8", "comment": "Malware payload", "value": "3986e74f0a6251acd3a9f32d632eaab8b6daeb6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206925, "uuid": "52a15a10-0d6f-4026-b2c0-52eba8428367", "comment": "Malware payload", "value": "7cd2ccda36acf2fe2386f00fb8a240a09b8def117e795b2ad21780d94c6244a5885b293f0e898dfd9d6e1addddc21bd3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206925, "uuid": "24f3b4a3-5f2c-43fb-ab2d-66d240cd1801", "value": "T16AB62252F729A43FC47790334AB906721176CD0A8A42E747796CB31C59B7ACC5F8ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206925, "uuid": "f0e02029-eacf-453f-81f6-e92550dde6f7", "value": "196608:PZi7PV/sbP9eUxijaWheF7I5PiVGpoY7e0g2OU30r1EoHDNol3XESNd0Td:Pct/sbP9evUxVsLV3lCTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206925, "uuid": "b64ee98c-7800-47c8-b795-bfee45f9f8c8", "value": 10929644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206925, "uuid": "d30cb2af-7a2e-40b1-9c6c-d8e7433c0b56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206925, "uuid": "41fc2002-b934-4936-864f-298574f0105e", "value": "cehennemapp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd14ffc1-3d99-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664196710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196710, "uuid": "94599b81-b5eb-4f32-bdba-a4383937b7d9", "comment": "Malware payload (Formbook)", "value": "59d24bcc44a883d21a48b2d368a1ff45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196710, "uuid": "5e3d46e9-70db-4b6e-9651-9b2b4e0fbf19", "comment": "Malware payload (Formbook)", "value": "5032a3dbc97f17dba5cf4a7dc67a6c9ae6293a344d9d9433d63e8cd180226927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196710, "uuid": "5f6a44b7-a1c9-4f35-87ea-35ea5ede8931", "comment": "Malware payload (Formbook)", "value": "d933aac89872b6a5f60901563b19c6715a0d007a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196710, "uuid": "c6193e9a-dd9c-4289-9ad0-a8a418ead136", "comment": "Malware payload (Formbook)", "value": "56af1bba0c17fe445facfbe2398e33475b943bf735fc3aaa71a615f7139dead7204f512b531c91b9f67f19eedc8a404c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196710, "uuid": "cfb1e105-e342-4824-a023-3660eca99287", "value": "T1A72501371BEA8B07D152767885D1C7FAE3A9DC11E467C6976BCA6C1FF08A0619B30321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196710, "uuid": "58dcb1c0-6697-4801-b57d-b1c525045000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196710, "uuid": "843672ac-7bf7-42e1-be19-f8c97e0713c4", "value": "12288:dHeyEXo6MY++34Ot1UzDMHvRJUHoPYFoBMmTA0+bB/jIyBXRsZZ4wiPWL1QORWl5:m/DkM1nHvRJ9PYqs0+5FXk+P41Q7BBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196710, "uuid": "c7a4b802-4da8-4a4f-aa9c-3eee3813cc86", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196710, "uuid": "93a894d8-7747-403f-aef4-ef05ce08c208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196710, "uuid": "bbed72f4-6eb5-473c-8b6e-41123aaf73c4", "value": "Quotation.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f53e22-3d86-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664188217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188217, "uuid": "43966ad6-883b-420a-bd61-6bb87c3f0fe2", "comment": "Malware payload (Gozi)", "value": "f145cd724520de906d99653c6887f7bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188217, "uuid": "88ce547f-62b4-499a-aced-6eee5242911b", "comment": "Malware payload (Gozi)", "value": "503ed60e3a300ae9ea5233fb2aeaea7bfcfc9799123a0f4b2262628cbada87a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188217, "uuid": "df64ba66-f8e7-49f2-9c48-47fd95e97cdd", "comment": "Malware payload (Gozi)", "value": "fb36ec37b7f76683b70409b2c9e6c91476cb6489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188217, "uuid": "bc6719f6-763c-4414-a55b-eb658943f712", "comment": "Malware payload (Gozi)", "value": "05965dfd441f07522067bcdd4b6e0ff0a7272c7dedc8820b561bd902bbfdc84b25aa366cb4064d261e35b64ebe25fdb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188217, "uuid": "81b99459-7b6b-437d-b9ba-ec31098684b5", "value": "T1A8348C2742E252A0F8ABC2B9CAD7E663DBF234193961D70F5734DA065B83732F559320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188217, "uuid": "b923d306-50e6-4ebe-b68f-90aa2c8a619e", "value": "1536:3XwJehihRFFZ78MzkaAhuLxXqFANIdmbVWGdsH6xQyOCybwNgh2gQ8+RbI7iurDO:35hinZgCo+NjJWSsm/OCyb/n8bI7iADO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188217, "uuid": "2a321aec-2d5c-4f68-9b1e-d2e1235d4f53", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188217, "uuid": "79942884-d9a8-4b1d-8f4e-a44d50bddd8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188217, "uuid": "2d83e044-f55e-4bde-aa47-e2688a984572", "value": "5860000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1063b04-3d46-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664160907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160907, "uuid": "8997f7dc-2464-4f91-a178-623ec22e8129", "comment": "Malware payload", "value": "5e149c121a1015cb90132645c44bf87a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160907, "uuid": "47add3d7-f117-4587-b779-c78c997bf171", "comment": "Malware payload", "value": "50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160907, "uuid": "0ac21969-3d52-4e99-a9c5-a6035e440537", "comment": "Malware payload", "value": "50203cbf82be50616d2992c2d8cad5a432a22d6a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160907, "uuid": "aa580fa2-34ca-4210-a729-f5a96a99078d", "comment": "Malware payload", "value": "bc466a0326efc70e142d44bf12fc8491aa19953338584958c8f02205b442dfb806fe3ba629ddac4d0453ee7a06561f1d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160907, "uuid": "7e122968-e5e8-4b9f-aff9-161d4b5b474a", "value": "T127E50215BCCF953BD0667ABD16630892C51C1183F1B55E9D82BFEAE11833B8C2B27726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160907, "uuid": "f643bc9b-86da-4b00-ab88-f755271c6f2d", "value": "49152:r+tLY+3WaIUrLYa3WaIUhAEuepLuxdL+MfuvZyStcwAVnBw4ar7gQzcK:r+tL13W6LB3WxZepixdL+MmvZyStbAVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664160907, "uuid": "f01ed860-9c08-4aaf-9f20-ab9c9a24692e", "value": 3075560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664160907, "uuid": "33f4d16e-bcb1-403c-a0ca-602f730190b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160907, "uuid": "7b2bf100-2968-4c38-95fc-9d7856d8899d", "value": "50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f07d38-3da9-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1664203301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203301, "uuid": "77c6bd24-6b7c-4fc9-a9e3-d7a229efc6ed", "comment": "Malware payload (Vjw0rm)", "value": "6719cf030d162f7c95d681b95b865822", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203301, "uuid": "4c9b0c84-f57e-4836-a805-fae612d2d628", "comment": "Malware payload (Vjw0rm)", "value": "505b40fdf87ce02b9d45a54e273e9c8b28ca359a45af873a29736082e95cdc91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203301, "uuid": "ac0db87b-cd48-4945-895e-013de77a64f8", "comment": "Malware payload (Vjw0rm)", "value": "9d7e31084ae987c0e6994b0b9ddd238af1084e8b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203301, "uuid": "033754cb-7acc-4c55-a2ec-09eb4944265f", "comment": "Malware payload (Vjw0rm)", "value": "724a19727e906e9776c73567d94b489a5185203742dc6efcc70b7359788eb0fa81fe840f817702fc531dc72912282053", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203301, "uuid": "b359fc26-90a5-4eb1-898e-dce27f902c7b", "value": "T16F138EB6CE7F1F50DB5117024AB8EF6C1F79B94E24E119DE2B56424882A512CF06E3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203301, "uuid": "3d63fe1c-d6a7-4983-a043-2ed01853da11", "value": "768:wNjCAHbvwFTWvRFEFMix1tdorH2OAH1XJLYlCH56v+1KnLmV80XD:6jdbaTWv7EFMkorWOAH1XJsCH56vwmLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203301, "uuid": "3b6fca33-0ede-41d3-b4b3-991da8449f4c", "value": 43712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203301, "uuid": "6525c5a0-78f9-4c03-b7e7-3a0a213f0136", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203301, "uuid": "fc4b6242-909f-41c9-bb2f-98fdd3085cf2", "value": "Paymenta 09262022.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a60cc0-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215087, "uuid": "55e9f696-ec26-4803-9d69-dae640282232", "comment": "Malware payload (IcedID)", "value": "a9cf396b1f278af3191829b6c9710574", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215087, "uuid": "06377dbc-81d8-4977-bd1e-f740621a1464", "comment": "Malware payload (IcedID)", "value": "50a281a000cf9f1fe9223ea81ccc08a6768208358846a2d32b1399325a6c64dd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215087, "uuid": "2a39a770-cc91-4fef-9a45-81560e8f5eeb", "comment": "Malware payload (IcedID)", "value": "5af91f7058d68056d52a023963a15b7513c5917e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215087, "uuid": "b9b3a815-e4ea-486b-be37-dcb719beb6fe", "comment": "Malware payload (IcedID)", "value": "0feb30eec9251257155ae2de2f87e1de2538ae9ad4930c4a718b24b85154a6812dd1d8bdc2b841185bf2469ad6ffdc5f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215087, "uuid": "a2f5bb2f-5cce-4817-b899-09bc47693b29", "value": "T1AC15F105CF50606BF00B693E371365D7F8661C2B308ADE1A6B86112E29D7FA0FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215087, "uuid": "95397011-3ded-4b0f-840f-97ecdc718f5b", "value": "12288:+1obDVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE/49umuVOkGnCy3PBtYE:XbDV2jUeQRI5wPN/M49umZDhiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215087, "uuid": "6500d63b-2072-4fe9-a0e3-6d4c905c1da2", "value": 888160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215087, "uuid": "84020087-3edd-4d08-8bd4-7efc4cb2273c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215087, "uuid": "77aa587f-6fde-4c22-94ec-27bdbc2d8e93", "value": "kinizamail file 09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d182a711-3d94-11ed-9266-42010a9c0072", "comment": "Malware payload (PrivateLoader)", "timestamp": 1664194489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194489, "uuid": "6e869c37-50f3-45a4-9baa-5b6667d61096", "comment": "Malware payload (PrivateLoader)", "value": "bb26114cfd5337fc70db9dbcec45689c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194489, "uuid": "85d94009-382c-4836-81f4-fbcccaf5f1f4", "comment": "Malware payload (PrivateLoader)", "value": "510895fcbb08b25cb9c8b25ecb950e76a58a84b75962f066a15175027757a515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194489, "uuid": "adf1bd1b-c2b3-4190-9ab3-3358ed337a8c", "comment": "Malware payload (PrivateLoader)", "value": "62f998ff3a822602864cec32ad25eac2de222ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194489, "uuid": "66aa5466-079a-4904-8401-72c9c084ed16", "comment": "Malware payload (PrivateLoader)", "value": "f1c9c443bc86a4742ee33c330b49c6519b71d37f40e4bfa7f6860bf9a39fd6c679d787cd66ede8be741b54e9cfc9fc7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194489, "uuid": "e820d3c4-7621-4a4f-81ef-62822e660ea7", "value": "T155744A38D701B01BF4E21471E45E57FAA4585730339448EBF7D99E6AA7B16C2E238B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194489, "uuid": "c3756868-d51d-4337-9730-2a85c451d275", "value": "6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqA:NrkIT/y8T5PVsSnXOc+HSQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664194489, "uuid": "6490b66b-6261-4ebf-880c-d8e99453bd6b", "value": 338524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664194489, "uuid": "c25ac017-9dce-46ce-9679-e418a1d423e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194489, "uuid": "6bac0a04-8150-4986-82b5-43ec52e9c2a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7465913c-3ddb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664224827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664224827, "uuid": "10e2e4fc-b700-4dc1-acc6-504dfa6686ee", "comment": "Malware payload", "value": "7886c9ea10b5c697aabdfc8ea697528f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664224827, "uuid": "d52bdf2f-598c-4dc1-8f6e-742858c87b0d", "comment": "Malware payload", "value": "517812d4fcfea7e2da217274b13d6c5f6500b35c5c4433cf5a27ff32905cf961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664224827, "uuid": "b2449e0b-d2c7-4ea0-8ed6-cbf1f4e2f6b5", "comment": "Malware payload", "value": "e1489971103f561497298aa9ac38cfb66e96b760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664224827, "uuid": "6d0b99b6-bdff-4ba7-9e2e-37aa44582dbf", "comment": "Malware payload", "value": "455f3aff816e5875814896d4f10510081b6f9ae6c200ee75c08c5eba0af329c67eb20d3bee3f4dc1bf2c10407304ffa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664224827, "uuid": "3069a628-cef9-4e45-b9f1-d751a1734d47", "value": "T128D3E15178A4C573C1228D746830C601AE7BFC215D7A99973F982EAEAF703D29B7434B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664224827, "uuid": "c960a316-b004-4932-84b6-d57f824647db", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664224827, "uuid": "42b2f913-48d6-42a4-8c6d-752497b2790d", "value": "3072:55GtT55uJwgpDu9XU7dTQf/bMrIiQM5B:iIDRsDMrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664224827, "uuid": "1b90e070-b109-418f-87f1-837786969256", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664224827, "uuid": "ec06fe2e-050d-4e4a-a781-93fc059cff37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664224827, "uuid": "cbdcc975-50d3-440f-b7f8-e6465f18c023", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad97db4e-3df5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664236090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236090, "uuid": "faa0066e-230f-4dfe-9a9d-202ee20cb9d7", "comment": "Malware payload", "value": "4ca202b9f0ab111160d8f76828b3c846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236090, "uuid": "e7607087-4dc7-4209-b206-bd0689d0e3f6", "comment": "Malware payload", "value": "51d731f0dd3f253a5bff6fe46b92fcdc576b3eb2e12fb2cd213f18db5fa3d850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236090, "uuid": "0027128d-59f5-47a2-817b-816283334ea3", "comment": "Malware payload", "value": "9de7f99dbbc1e5884c1c19b4dc4fc5c7547c14c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236090, "uuid": "39ac0cdb-ce83-48a9-810e-79561ea1a436", "comment": "Malware payload", "value": "98a8610718a141805f7d6aff02e2dbfff56840ee0d8d492482932fed3a79a125f116b635071a5f25f6c08d0d12b281d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236090, "uuid": "88f7dcb7-f39a-4a38-8f9f-debe80a1a1d6", "value": "T138D3E01075999533C8AB9A355834D6407E3BB4229AB59AC77BCC2A7F2F703C2477A313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236090, "uuid": "50dbb44e-0fae-4ad6-82d3-43806b98cae4", "value": "838f718910cdf3a4ebf0855233529379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236090, "uuid": "a4f7211e-b86b-46da-b948-b06975ec3c81", "value": "3072:BF2RgtTI5wZ8UvYFAujPq8mCHr5/gWP/nciex897LEu5B:BtZ8Z7LplpP/Bex8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664236090, "uuid": "d1439c98-a293-4947-84d4-d40db68ebda6", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664236090, "uuid": "1b50e5b8-fbfb-4f14-969e-192226903624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236090, "uuid": "1a6ca30b-b52b-4d1a-92ab-219b969a43f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbe65b7-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664184608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184608, "uuid": "e6cdf700-cd4d-4c12-a16d-1f8c0c91cdc4", "comment": "Malware payload", "value": "a5d9dfb481fd44b7008b5f0f3e21b7f5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184608, "uuid": "e4c08138-c1a7-4a1c-b88f-6d812ea0bb79", "comment": "Malware payload", "value": "51e2f00ce137428beca2d08b53c7fde259189df4e037380b1bdf6ceb141f3ee2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184608, "uuid": "e5c4aef0-1355-4471-83c1-ed22d3928158", "comment": "Malware payload", "value": "99c617efef8e71e9d5c8a80b1fc963beeccebec4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184608, "uuid": "aee0ad5f-8cca-46ad-a90d-ef35b7a01548", "comment": "Malware payload", "value": "21b97fa1efcfd7fab4bca01d516041139ca45660c604e852f3fa099495d25e871de79489d8f92a9eb53205d360f97eeb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184608, "uuid": "265da742-518b-4ff3-99e8-a7e880fa26ab", "value": "T115E63382F3D9BD2FCC7380324BB51A7661864C59CB13E2436965736C99F7AD08E85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184608, "uuid": "ad613f0f-421d-4d1d-b21d-d14384df6882", "value": "393216:imaBC9u9O4X9uGtUNCK54bOZkLx0hb2r2fZRpoi8:mBVc4X9uGtUXzset2r2ffpj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184608, "uuid": "e8d875af-8497-4beb-8bfb-772efbe4d7c5", "value": 14004085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184608, "uuid": "522a89f0-3471-46d3-a4f1-23fcfb4c4fe9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184608, "uuid": "16968a86-67ef-4eb3-9a1c-692d2d6629be", "value": "51e2f00ce137428beca2d08b53c7fde259189df4e037380b1bdf6ceb141f3ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2972f1b6-3d52-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664165861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165861, "uuid": "294721e5-aa1d-4033-a07c-d281a5205808", "comment": "Malware payload", "value": "8f272153abc5fd19a0a0bb641991d084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165861, "uuid": "4cb5082e-dce9-4acb-9cfa-2040ccecae01", "comment": "Malware payload", "value": "51eaf57ae9fde2cb71b84897ddfd8d5c69bb0604dad100de6ce57f026f3cbada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165861, "uuid": "ba34e463-a47a-436a-ae6b-3a3050b18a96", "comment": "Malware payload", "value": "7efe2281cca69cad505e805cf1298c0a19fb7f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165861, "uuid": "0ffc28fa-4612-4485-b114-caf3fa3eadb6", "comment": "Malware payload", "value": "0837492693a284136b608d617b37485f6b33033b2c0e56807c69db226e82d205759b59bf6f72d0e8c1fce1cb44b70b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165861, "uuid": "d9fa3ec4-55ae-41e5-84dc-88ff2684a753", "value": "T1DC424C0AEBF44535FDE643B51D2797C02730A7607C23C78AB8C891A66D26F588B91F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165861, "uuid": "6b2b9382-d824-4ef0-a4a1-7b412e04e053", "value": "192:xJZkqh9ELOEebCEBMNLKS9iDA1DQp+AA7g+4OW4/4Ic6nGirzshg:xXkMELOEe+EBMvYD8DC+k+IWhrzsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165861, "uuid": "107a0284-6614-419c-8f2f-b2de03dfd76a", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165861, "uuid": "7d016c38-137e-44f1-939b-0c42b34e0962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165861, "uuid": "7f522fa7-66c3-4cc2-832a-8541dd6f140f", "value": "SecuriteInfo.com.Win64.DropperX-gen.636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc3e097-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196043, "uuid": "a47af7ed-3d27-4ced-97be-19ba0a2b4b5c", "comment": "Malware payload (Quakbot)", "value": "82001bafafda8b2ed449a35ea73b1d97", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196043, "uuid": "14fa8d45-a6b9-4fa6-a881-ba1ca3dba36c", "comment": "Malware payload (Quakbot)", "value": "5219027ea0e6a6577448435ccfad403f28f16842169c21bd39c09bc01e56d125", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196043, "uuid": "311839d0-7b88-40ef-9b54-6e435e21a82a", "comment": "Malware payload (Quakbot)", "value": "a162bf1695e0ed69286f34ed3375cbb8c33fe326", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196043, "uuid": "b1727eb7-8187-4638-8cee-ce67977c19fe", "comment": "Malware payload (Quakbot)", "value": "1a9756fe16da614b420b62662e4917370c3e81d9fd50a499a427a8453c34df3e5a612f35907b6fe929fef4f8ef0a8998", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196043, "uuid": "d8eeb942-9c09-4d3f-9d99-01ec18b6e579", "value": "T1F1458D32F2914477C1732A39AD3BA7659D3ABE112E3868463FE81D4C4F396813D253A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196043, "uuid": "9999b4a7-e280-4173-940a-231916180bf3", "value": "24576:VDVeK7bHY/DS6wku4EmQKyMeRP7IYqsS/HdcoO9u+5w9M4a3cd:FZjMpn6oOBcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196043, "uuid": "5f65bfb9-4176-4086-b64c-64e2f55b3651", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196043, "uuid": "92255eb5-174e-47fc-bf22-8d92c15a6f21", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196043, "uuid": "325ca120-f40f-4928-87f0-c6c896f45d7c", "value": "Art#4376.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d783ff40-3d5a-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664169589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169589, "uuid": "3e1527a9-67bb-4445-9080-c83790b6bec1", "comment": "Malware payload (Smoke Loader)", "value": "1d632240ddf916a5b12984b2e6382f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169589, "uuid": "1391c24a-4b91-4d5f-a459-76d1b5eae783", "comment": "Malware payload (Smoke Loader)", "value": "526f7e5ae324eac0ec3ad53007f9e08ec1f8a160b1a868c0affabd5a14b9ee88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169589, "uuid": "ad01d311-0e20-49e3-85d3-e733c8b4cc4e", "comment": "Malware payload (Smoke Loader)", "value": "da8a1ea7d6eeb394525408ecd48fd121b0d164ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169589, "uuid": "36f54cd8-7251-421d-8e87-3118f13fe3e7", "comment": "Malware payload (Smoke Loader)", "value": "8338be22df3c173ea501a46e749bcd59d7f4d8ac0ad7f6ef1ff2080fe0bc3d507de315521e8bc39976cc5a6b74e03527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169589, "uuid": "eb9a9a6f-7cde-4701-84a8-5ba5e7e3b928", "value": "T15FE3E101B744E873C01296745439D6A16E3F7C62553A64833F883EAF7E723D25EB93A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169589, "uuid": "e78f4d6d-0b65-4362-9012-16369b04e73e", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169589, "uuid": "a04e8e3f-e3a9-45cd-8bec-bfb666125779", "value": "3072:rCijG5yOfv87UwFjm2x7kff6+OBgKyX5x:REvSUwdFxuC+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664169589, "uuid": "681079c1-643c-48a3-9ff8-830a6d3f5b91", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664169589, "uuid": "b5204eff-58e6-4684-9c3a-832971bc93ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169589, "uuid": "eb5225a3-3968-4f5c-aeb3-f38be628bb9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc18f376-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664227525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227525, "uuid": "0d034b9b-e43f-4ee5-9f59-73f090942a6d", "comment": "Malware payload", "value": "e1e9f7d190e9fb6765eb528dbaa1481d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227525, "uuid": "a0f478fc-98f2-4356-acf9-de32d6ba0b4c", "comment": "Malware payload", "value": "530b80231d0616ad2a6f91dd78cc51fe2d4e462a0ee2ba8176b09eeeb2a6d475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227525, "uuid": "35f81124-6fc9-4a25-83f5-21e88416da00", "comment": "Malware payload", "value": "6f673ec8eedd550b4730703a050517c91a9a9a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227525, "uuid": "f9ad5116-a607-4e2e-a6b9-5742f094e07a", "comment": "Malware payload", "value": "d0bb43ff500ba8f71aeaf19cf869c3d8e4646f4d6c2ed63094cf10035540c24b225a97757194213d8bdcb0ef7d329f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227525, "uuid": "83c315fb-0803-4031-9921-43089f907f11", "value": "T12624F1A17C404432D52E2679CC32D6465ABFB84436B55902F7F8661EDFB22C27E383DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227525, "uuid": "cbb8165b-c5e9-43ec-bf87-0e27b8c529b9", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227525, "uuid": "43045bde-7535-480b-9e0a-47cfd4f65c6a", "value": "6144:/k6ZiDJG4ArubSiwqRTProhyXmkvGSoDUJNK:Di1G4NminRbrokXmkv1JNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227525, "uuid": "e8272fa5-2776-4776-b51d-2e3232f89424", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227525, "uuid": "83cb9228-dd53-44fa-9dd9-fa287af4eb96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227525, "uuid": "17dd5744-488d-4619-8ddc-b0b9f6929845", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f970212-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664180903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180903, "uuid": "dd510116-295a-414f-8774-e48aa61ef276", "comment": "Malware payload (Formbook)", "value": "acd2efc1047230b3fbbcb3349b875e69", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180903, "uuid": "fb9da878-fd19-442a-ae74-3a06ddec2289", "comment": "Malware payload (Formbook)", "value": "5313012047344a16ce9ba4a01f43d0bb4330b86a5d80039e6830eb2b1f5323d1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180903, "uuid": "0466d7fb-0b96-4f0f-bd39-e9c0210cad81", "comment": "Malware payload (Formbook)", "value": "0b537f86fc9bac1ab7a8c15d0931f6ec4a27434c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180903, "uuid": "1fb1b051-0a42-4758-9b71-3f2ea338914f", "comment": "Malware payload (Formbook)", "value": "4c6e0f7fefc2a5804a78cea5acb6643bbaf42edbcc06a1214266ad0f4e49e1b4dd808e0a66e764887d09b0e3827eb69e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180903, "uuid": "e7e0a870-fe93-4735-91ed-9748effc5c26", "value": "T145540250F798584BCFB7CBBF288B449595B0F8D36A42D3636045AF2449813FA7A8CD93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180903, "uuid": "23bcb9ca-9426-4746-a558-ecb852f4c443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180903, "uuid": "ee57e1dc-b15e-43ea-950e-62c656f7dc7f", "value": "6144:L5zvytmDRQDh674uJtGKor0eTFlZt6Ej:Fz6ARsh239or/FlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180903, "uuid": "2ac19a15-8593-444e-b8f8-9788d3f6b96f", "value": 303088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180903, "uuid": "9cead625-7c44-4845-820e-e8380197869d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180903, "uuid": "a7eeb5c7-c648-4883-8893-3a06f039a106", "value": "DHL24789010 receipt document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc9d54f-3d51-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664165435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165435, "uuid": "39cf4678-11dc-427e-b907-3a7b34ed5d12", "comment": "Malware payload (ArkeiStealer)", "value": "40178549fa7c3f5d179f0a1fd3e5aae1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165435, "uuid": "04d7ecb2-0b0b-4b09-81bb-9dec91f33a0f", "comment": "Malware payload (ArkeiStealer)", "value": "536a39f5ff898717ba9b02b146e0cc11bab0ae6d2cb7e7c6926a92171daadb98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165435, "uuid": "a678ecc7-33a0-4d11-b4f6-67449f15beab", "comment": "Malware payload (ArkeiStealer)", "value": "68bdfc13657aa855ed981382eb6e920b86ab7326", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165435, "uuid": "2e88e995-09a5-4537-abaf-2df2dfe6e828", "comment": "Malware payload (ArkeiStealer)", "value": "d7bd788b9d66d17adc5daf0b156210079452aafcc5d3c0cdce1cb821ea31f5c5bc4070d435635b5a59ea82c64fb83d39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165435, "uuid": "8cfd152e-b4c6-4a5e-ac45-526920049089", "value": "T17DC6090674E0204F6788E6B3AB08D9B573838BCD555163D91AEFCBBB653D7027B112AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165435, "uuid": "0f0dd759-891e-4628-a6f1-2007939295a0", "value": "3eb5d209f4deee0471ab0b8f8e9a1a3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165435, "uuid": "9585c5dc-a957-4f89-980f-7c667226e5dc", "value": "98304:AL1Z7CmwBC2B3DbVg6sRj5KOKl3OO71WtzMTjt5/fPqrVdbUrjxi1H2TjiulSU89:xx0Z/KvSCt5nu0rZZsQdWg7tGGzG6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165435, "uuid": "dce020a6-e8ed-4ac9-ab23-1136fd531e70", "value": 11901440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165435, "uuid": "f9014d60-4f49-41d2-9a52-7c8d2bc3acee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165435, "uuid": "897fa8f0-8c91-48d5-8386-c6b200fbb9b2", "value": "40178549fa7c3f5d179f0a1fd3e5aae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56a2e3e-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1664171222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171222, "uuid": "570b833b-b045-4549-b96a-7e175493868b", "comment": "Malware payload (NetWire)", "value": "380c39c11c790386e3b2babd5baf81ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171222, "uuid": "38e8d124-ef8b-4f39-8148-de8f4bd74837", "comment": "Malware payload (NetWire)", "value": "53944a881741bee915b91916abf91bb7916f89756ee49dc2bc8e8ba768213c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171222, "uuid": "d8cbba6e-0397-42d3-85c2-7e2e07a8bac4", "comment": "Malware payload (NetWire)", "value": "6d52d56fe2623bdbb52b80426f70d090ccb2550c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171222, "uuid": "49fb02d5-e064-42bc-b2e4-c0927774b2d0", "comment": "Malware payload (NetWire)", "value": "4f094d3943353f40053a8a9d42c6c4e25aa2b35887d1b039e9794fdd9ffb11203b7f7502d3a1b38fd69d1ae2fcdd451e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171222, "uuid": "9bd5597a-821c-4922-9c83-d322eaec837b", "value": "T19505F0271BEE8B0BD11575B885E1C7F6A799CC11E577C2C7ABCAAC1FF09A0658B21310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171222, "uuid": "21ef7f8d-131e-4757-a2a8-dec93dc9004a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171222, "uuid": "f5e550d1-5530-4b40-9682-6e66eb7bb894", "value": "12288:FDHgwwaiA/XwycRRSBDjIgZ7ChF9Dr+xTBIkoRmL1OpiBcdwO:CwAA/Xwy867wn2xTBIkoRE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171222, "uuid": "1b63c25b-3e87-4628-93ae-24326f3a695a", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171222, "uuid": "260fac51-f945-48a9-b3b1-29ada115580b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171222, "uuid": "509f3144-4cb6-4d74-a7de-328d1df8d117", "value": "SecuriteInfo.com.Win32.RATX-gen.16112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f012641-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174433, "uuid": "8fc6eb19-b61a-4986-b029-5b3e3bd05652", "comment": "Malware payload (SnakeKeylogger)", "value": "fe640080409e16221716866bb65a463c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174433, "uuid": "c9c25924-3a5b-4384-b1d9-1eb1fcc7b6a5", "comment": "Malware payload (SnakeKeylogger)", "value": "53c8a7b825f04fd38afdcdef29b21c18fa2407597277de780252a18b733af1d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174433, "uuid": "1cd2231c-220c-4cde-829d-4c57cc56ec5e", "comment": "Malware payload (SnakeKeylogger)", "value": "1a4141f72426b226312be73311a5c22b5f75f55e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174433, "uuid": "6597ae6c-3510-4bee-9910-b7cb8ea5e176", "comment": "Malware payload (SnakeKeylogger)", "value": "0535764be27099f63f0747541e3d4f974c801e2d706a046e555848a2c8114b487f9e0f0dc96075b649f68a973b9f5755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174433, "uuid": "9ff689e7-445b-4d44-a390-60e7790d246f", "value": "T12005292035EB561CF47B8BB95FD8B8F649AAF721262DA1BA24B013454733E85CCD1C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174433, "uuid": "00591b14-ab2a-4fc1-b6d3-4d81a7bafd77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174433, "uuid": "14211cf3-744d-4c44-a6d7-cfab191a63a8", "value": "12288:67R8VFAxQRADqjJ5n6fd5hJWs8C8E1Hj3NseFQ3d:6uVFXjr6fdcs8E1Hj3NseFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174433, "uuid": "315200f0-5e0c-402d-8fa5-4d39eb34c462", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174433, "uuid": "7ddf7c25-73c2-42c3-ae8b-1cc7fe3d5d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174433, "uuid": "fd1591d4-b356-41c0-bf4f-c47e855a2cc0", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f6bf7a-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664180919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180919, "uuid": "31791f0d-1160-4c17-a5d1-143d74a81d94", "comment": "Malware payload (Formbook)", "value": "0ceac0981328007380508694cfe6a447", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180919, "uuid": "6c80c1b6-9e87-4c9d-a5a2-78b536cf0fda", "comment": "Malware payload (Formbook)", "value": "53cc734dfa4d7b0bfa0cd0e14af42363792980b96bf42ef0581a8cbc05f5bb82", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180919, "uuid": "361c880d-01a5-473e-b5d1-a39bebdd8f4b", "comment": "Malware payload (Formbook)", "value": "2b2996210c5c10dbdad9711b6469c0d66fc9d0cd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180919, "uuid": "5bc9ff84-2f70-464a-8406-8a8f1b2a0816", "comment": "Malware payload (Formbook)", "value": "8126c3fcad74fc0d2272b11a263888d0a722c168c92c92739d9c00624bf11f51d536864311c3676696e5df5a98ee4507", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180919, "uuid": "802f162f-5a69-461a-afc7-631236c42812", "value": "T19F25F1260BEB9B07D115B57894D0D2F6ABEADC02E46BC2D76BC66C0FF08A465CB71314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180919, "uuid": "8d6b10e3-18d8-4107-8934-f54b9b9ada19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180919, "uuid": "c0d62182-811a-4281-93ab-f6ff0dea2b5d", "value": "24576:MXEjfCjYK3yGSFB2zpVycT051y1ffpR/:0afyf3mFkVdTggf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180919, "uuid": "6351c0e9-d9eb-4634-b8b3-8eb4b8bdb25d", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180919, "uuid": "4edf5586-9a34-45d8-add5-da9de235f81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180919, "uuid": "0628371c-ced3-4960-a7bb-adf851931f91", "value": "DHL Shipment WaybillDoc_TransportLabel_3950350973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363440d2-3d77-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664181773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181773, "uuid": "f57c8593-4f16-489f-ac2d-feb2ed36d78c", "comment": "Malware payload (AgentTesla)", "value": "b5a58317b560584e6448d5d8eaaf0ca2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181773, "uuid": "90c5f7e0-bd45-4faf-b2de-d61afe9ac111", "comment": "Malware payload (AgentTesla)", "value": "54578745b3e3b93a7c18b34dcfe1f214ef401754ffd41bbcef2b4d500c36a630", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181773, "uuid": "37d69d8e-7465-4fc4-a461-916bafe0d734", "comment": "Malware payload (AgentTesla)", "value": "e4020ac9ae071b6b751e07cd60d079e8c7bdfe1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181773, "uuid": "75fd8e06-351f-4d78-a239-1099dfe9cb7c", "comment": "Malware payload (AgentTesla)", "value": "c6d0f5cf72931bafc193808a97f43eaccf28f8345246824e82dee73409645e68b18cb811e31cf20a3d55279f96e7129e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181773, "uuid": "cac634a0-b12e-4cf8-ba07-83c7c647ab6a", "value": "T158242A7E5384BD41C6EE417C8136818421B1A903872AB35F6EE258FE1F526CDF93B6E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181773, "uuid": "fe658abf-e91a-4a8c-8258-7b454f57de26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181773, "uuid": "3669a181-c77a-48c2-bca0-f2f37bf8baf3", "value": "6144:k8rcVd06EdxsLLr+CjUkBTEJAp4lkhap6g+ZIUdnSNe:k8rw06Edxk6CFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181773, "uuid": "feef2095-b310-4c38-b57b-b78797d9cac3", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181773, "uuid": "c0bc85d7-ed7d-4537-9ea1-b432e5fccad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181773, "uuid": "7fccdcf9-2b2f-4d0c-a60b-a3134e925492", "value": "windows_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb67b0a-3dae-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664205653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205653, "uuid": "82020a15-32d7-4a89-9056-d5adfe1113df", "comment": "Malware payload (GCleaner)", "value": "aab6f30c5e1f1fa7d9f00791be595ff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205653, "uuid": "b72c458c-f59a-4f2b-967a-78caf9b26d4d", "comment": "Malware payload (GCleaner)", "value": "54b4b9676f32769592af99356bea2021539e20ec735bab287a45a3e901df8639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205653, "uuid": "5b798367-6885-4c31-8573-3ceaa90794c2", "comment": "Malware payload (GCleaner)", "value": "98699fe76b27380f10c8ca83d47f634afbb48e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205653, "uuid": "736dee12-4d94-487b-aba1-8b22fca28e53", "comment": "Malware payload (GCleaner)", "value": "ab9207d6e06fc645d2b80d60024e524c4714555c1e4dbffbc2bc328c6b845ece275adac48f6ddee68f20bea7ed825aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205653, "uuid": "49ae475d-2db7-42d2-b689-54c337c7c75c", "value": "T187340291BE949433E8187171C931C791A63FB86211255E8173B87B6BAE733D12B323DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205653, "uuid": "4d7318d3-756a-4848-b5a1-ec01864fde15", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205653, "uuid": "af76d706-96f9-48ec-a525-44dabc06346e", "value": "3072:in/HoTF5yTvB9tvbKKwVwuIqwRS6EiIewP2hHAZvZ9RF6kSY2BB5B:SHdPtvWjIqwPQPKAZx9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205653, "uuid": "5e891974-9324-40aa-aa0c-a5841da84bed", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205653, "uuid": "3b4fdf22-8641-46eb-a923-af35995c8f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205653, "uuid": "30353b88-2ca5-432a-9a51-e66ac7646b2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00252e6d-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227209, "uuid": "942621b8-51c0-4878-a03c-1c5cdf427d1b", "comment": "Malware payload (Mirai)", "value": "fe355a215c195a9c8fea25c8cae76786", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227209, "uuid": "14f711fc-6a17-4a9a-89b7-b798e9b3dcc6", "comment": "Malware payload (Mirai)", "value": "54b871237fc4a0a39078bc4d4d330953f3550de3714dc49ee94fd0d1454ca85d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227209, "uuid": "ce98d6b6-f3e8-489a-a127-e6b7d872c949", "comment": "Malware payload (Mirai)", "value": "1d3802db77758daf84891afc4d052f0a3a838193", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227209, "uuid": "70cf39fe-5c0f-4a86-8ddd-4c03ccca5eb3", "comment": "Malware payload (Mirai)", "value": "2a77d7794a3ca8085b285f016d14424a0077fb1184a47d914fdfe803be7731b1f7c61341d9c78836e2b73b1654434ade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227209, "uuid": "5133c5c3-2667-45fd-85bf-890259a9cfc7", "value": "T1EF03E1EEDDD86A5DD61F5C3F81DE025C9CC9B29221D77F5857024048BD3AA0FB663091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227209, "uuid": "0d760cf8-7d94-42f1-b958-c80d7f5ed662", "value": "768:+KVT2899tdlMmXBZe8s4Cc0xg9RCreJElGnDM5TWb8:zVa69qmX/2kefreJEUDo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227209, "uuid": "18e15eb7-0b5d-4956-8b5f-546ef0baa640", "value": 38552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227209, "uuid": "1b815b9a-8a91-4021-9bf9-d3f71d53905f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227209, "uuid": "21277d07-4a1f-433f-824b-5c418b85e94e", "value": "bk.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bcfb91-3d80-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664185903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185903, "uuid": "c69507e8-d736-413e-a7c6-ebf068eb6f18", "comment": "Malware payload (RecordBreaker)", "value": "0fee9766f003ca31d83a13dc22af6fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185903, "uuid": "486c39a5-845d-4d51-8c16-dc22fb4483fc", "comment": "Malware payload (RecordBreaker)", "value": "55bc9a964407296141d81284e1ebb306d0a9adc0606bcd60d393b7497542421f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185903, "uuid": "915648f6-48fe-4ca7-a5de-8b79c486708a", "comment": "Malware payload (RecordBreaker)", "value": "5cbf6c2aa6c7ef488148ac1b777ccf48769ac26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185903, "uuid": "8f9a53c6-20f6-4238-a1b0-86698c2801ef", "comment": "Malware payload (RecordBreaker)", "value": "ff69ec136e46ec33a31cda1369d13e0aab1964d9ae84af3621f78391e2e9b156ea6c0dc83cb94fee13731962f1bbaeaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185903, "uuid": "989acab4-178f-40c4-a23a-d869db079bf7", "value": "T1CBE3E101BBD0D8B3C90189B41831ABA1AE7A3C52557555873B887F6F3F713C3667A3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185903, "uuid": "69d60d3f-8d82-4733-aee2-f08586427cfb", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185903, "uuid": "8506a9d6-d34b-4116-b022-81d3661217b3", "value": "3072:sBoSDz5Im4R6wCKUth3yzEkXBj+8YcR9yU5B:SPwCKUtOh+8TR9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664185903, "uuid": "81a4aa7b-2c9e-4ac2-92ee-5b7a42a0b6f9", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664185903, "uuid": "72bf6035-ab7c-44c5-adde-47aaef595f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185903, "uuid": "bced637e-4a30-4b66-88b1-de0d15337e23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f272e2cc-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664179512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179512, "uuid": "11df24a6-ded6-4687-8029-7e7892c0cbce", "comment": "Malware payload (GCleaner)", "value": "a60a48c47af206b6e3642db79c8c6a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179512, "uuid": "c1ecf85a-98d6-4ee0-8e63-12011227f653", "comment": "Malware payload (GCleaner)", "value": "55f09732fb854abbced6f6c9c587f9dd31cd2278ccfaba2a125b5132b75356b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179512, "uuid": "c9610e28-eeaa-4c29-afde-798f30f99cec", "comment": "Malware payload (GCleaner)", "value": "fe77bcde5224b8a0475ede9d7dc09e884f64452c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179512, "uuid": "e51f2087-181f-4973-9610-54f6dede373f", "comment": "Malware payload (GCleaner)", "value": "bb49ec57477b366c3a3c9a82b2a8bf67c979e9e5b77cf30ec507ef43c9964638d20ed9bd1784d03bb09c7b00eef86c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179512, "uuid": "6a9223d6-11b1-4cf6-acf3-06a74fcf821b", "value": "T1493402027DC0ED72C43572B58931D9D05ABEA86145226A027EFCBB2B7E317C26E353D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179512, "uuid": "261973f0-df91-4bb8-bb12-80c08f903363", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179512, "uuid": "968a6b28-5165-4ac5-a795-040c019fb394", "value": "3072:ftwYqG5PaCreJJWLjZG4bMfnn2aOKuwsHlLjX+lE1FiJB+1F5x:a8/rerwG44fnyKXsHJy6Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179512, "uuid": "9649ea35-feed-4c9f-becb-e060ae0a7cd8", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179512, "uuid": "b4f275cb-1988-43c1-ac4a-2c8b02519671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179512, "uuid": "fd2a733e-4313-4bce-98e4-3f92a8d56658", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a8671e-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664189931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189931, "uuid": "bff2da43-b2fb-46ce-8275-b3e7f8147a25", "comment": "Malware payload", "value": "f824f7f02ed8475d1b38197a087fc7fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189931, "uuid": "0aaa7447-44e7-4b9d-9101-ba3eeb507ea8", "comment": "Malware payload", "value": "562c1a4446d0c27002dc02a0fe034002d10175c157fddee3d2a55cace17dcb16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189931, "uuid": "78669fde-ea4b-41c5-bc5e-f1990b4f2055", "comment": "Malware payload", "value": "5ca8ab67bfef4fbeffead55bd38821f8cbb80893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189931, "uuid": "3ec313b2-c4bd-41d0-bb75-a5dc015a5819", "comment": "Malware payload", "value": "ffbfb870460ce4e3c8edd422e777e9a42c0ebbe5038e6d28a81f39abded98e3a6ea791d6ed77179a03376ee73880186c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189931, "uuid": "80e38d57-8f7f-4ebf-b3e6-689de8b4f81b", "value": "T17115BE1433E5AA2FF7FF47BAE971104883B7F542B297872D440CA98A2D657048F5227B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189931, "uuid": "5b7471c4-f2f1-41e7-9da9-1cf184190e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189931, "uuid": "54d54413-d69b-4a86-8f77-730975b7eb5e", "value": "12288:WXPvA16nkVf8JBD/ijOsJQf3icUrvn9Z1mqmw5okD0CRtaf8N+nHJRpTeiql:ERJuG3fQ9ZgqmwmkD0gtaf8N+HJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189931, "uuid": "22f165cb-902d-43c1-95ec-7da606d11b04", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189931, "uuid": "abbed8df-a98a-40a8-aa47-f5039fce40dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189931, "uuid": "3869c836-4534-496f-a332-d64ce00638b6", "value": "521275002022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee24870-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664181036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181036, "uuid": "390703c9-d5ef-4889-a80d-ea4a7a2f8471", "comment": "Malware payload (AgentTesla)", "value": "eb9dc68449091be1796b1b5b5a306128", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181036, "uuid": "74f17230-698e-403d-8be6-9c3ad942a6bd", "comment": "Malware payload (AgentTesla)", "value": "56305e7e933dc6e954ceac94cc1a5b8e1441a64324c293224322581024c9fc55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181036, "uuid": "b7613d04-5e6f-409c-8a5a-81134e7f5adc", "comment": "Malware payload (AgentTesla)", "value": "bcf5204285df62d10deea95cc0882753a5fe42f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181036, "uuid": "0570ff92-94a8-4b4f-99a7-19d1a8ac872e", "comment": "Malware payload (AgentTesla)", "value": "6fa89bd876d80aaa04074520ac12c82d2142353828bb41f1ddd3eb28f5547f388d1c06dd45e8ffd172b7d83cbe0fe797", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181036, "uuid": "67e07c0b-e17d-42f4-b001-80b38f6a9260", "value": "T1D935E02627EB9E07D025767484D0C2B693B89D01E163C78B2FCA9C9FF5867E18B90747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181036, "uuid": "ddde6ac2-6784-4317-87d8-18f691178782", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181036, "uuid": "2489bbd8-a0fc-449e-9431-858915208cec", "value": "12288:NqXZiy2sz74M4uJlPXU4QrjmzIIFTLTJslJXo34xfJHRYxtlzJOt2iq:qIxsfU4UGhTJV41JuxtlkVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181036, "uuid": "1887fd66-b576-4b05-b755-4ab3f0d1a7b3", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181036, "uuid": "942ddbfc-be56-4828-85b4-06e417eb32a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181036, "uuid": "037186b7-819d-479d-aeed-b6f7ba3d1eb0", "value": "eb9dc68449091be1796b1b5b5a306128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f291b9-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213881, "uuid": "0e5ae86f-05e7-4af4-be90-9c9cc3b02020", "comment": "Malware payload (IcedID)", "value": "55ec488475bc3d6674d855bd343df59f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213881, "uuid": "ee151f4b-f201-44c2-8049-4419c700f233", "comment": "Malware payload (IcedID)", "value": "563eba169c321af25eeefb52a0adaac9fc7006d1e8712ca2e4de6937ecef2e07", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213881, "uuid": "5f1a185d-797a-4361-9b3b-1a30c90a363c", "comment": "Malware payload (IcedID)", "value": "78e16786106461c4883d6017223ebb144ceb095e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213881, "uuid": "37eaa6c0-1131-4741-a0ec-9edb41591943", "comment": "Malware payload (IcedID)", "value": "d079f71dcfa8b3bdaed1ebc51f5c9da8babec1385b553fe54ad6c46f9d2a65833fe757c8cf396d756ffd43bff8e9abcc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213881, "uuid": "07f598a6-5dfa-41f0-a378-9b3d35cd0ba8", "value": "T10215F101DF50206BF00B693E331765D7A8A61C2B348BDE1E6B96112E29C7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213881, "uuid": "5762a258-d4f7-43f1-b665-63f1df882e9b", "value": "12288:pVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEHHHNxZp/G7ob39AMm2:pV2jUeQRI5wPN/2HrGsT9AMm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213881, "uuid": "0d4dc1a3-a575-4350-a8ba-ede1433c5138", "value": 887163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213881, "uuid": "8bd111ed-234f-4803-9041-7e5eec32010d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213881, "uuid": "bdc39435-6c2a-4ca6-88eb-2d6a188654f2", "value": "nmengle file 09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d29e89-3d7c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664183898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183898, "uuid": "913e6f0a-ad87-449d-9609-5287d7cd48f4", "comment": "Malware payload", "value": "f25a4a4687067bf57861b3980f6482cf", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183898, "uuid": "c9868c4e-6197-4c04-963c-1f18bc07d38d", "comment": "Malware payload", "value": "56747142a692e71cb14575e7cf6206f225d9ca189e7d37b5b805591f5119f106", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183898, "uuid": "4154388b-8c4d-48a1-b23e-455179701383", "comment": "Malware payload", "value": "2e694704e6c433d9168837aa8081443c0db0f127", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183898, "uuid": "5721b1d6-f39b-4057-9b0c-4dfab095eebb", "comment": "Malware payload", "value": "357b78027e4b6d079ed782063be7ba888b0e54bdb3111ca8eaa209a368befc3e9d7a8efba56f2a2344c9a7ea1327bee2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183898, "uuid": "1d8eb474-d420-46b6-90fc-3df5de0b1bdb", "value": "T19192C94FCC139D365100E5D86A98E63EC5D5A422C22F64E8B3EFF53C236698085AF95B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183898, "uuid": "020e8b34-aec7-436d-8d6d-8ae5a7b7e99b", "value": "384:+LRDJDIDdDIDHDrDT4DNDGDODUDhDsDHDWDHDQDjDxDrDrDWDjDgD7DLDqVyPsbc:+lt8BE7/IpSqYdYDS7sHVH/a3kvHuFbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664183898, "uuid": "ad19c220-db08-4202-bc21-34d1b332cb1a", "value": 19677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664183898, "uuid": "9b47a460-974f-46c3-b285-edc82bc1000d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183898, "uuid": "752997c2-a496-4fc1-a585-acde99e5dbcf", "value": "56747142a692e71cb14575e7cf6206f225d9ca189e7d37b5b805591f5119f106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842c9364-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664173314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173314, "uuid": "3fe9da7d-9f51-4961-a55a-ac3e5065c27e", "comment": "Malware payload (Loki)", "value": "809b9513cecea98e925419a39a6244a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173314, "uuid": "23ede12d-fa0c-438b-b45f-b87631b486ed", "comment": "Malware payload (Loki)", "value": "5685ca25aa397dbe143b527532479e9df78750f068990785075c13622ade021e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173314, "uuid": "98cdbf31-b02b-44c3-86ae-952329efae68", "comment": "Malware payload (Loki)", "value": "91ce1a46ba918e898021e7ab07323d155acb58e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173314, "uuid": "5dcb7120-9a78-4a3b-a14f-29e7d97dc848", "comment": "Malware payload (Loki)", "value": "ee94c43f69c0dd3d2cf7175e10eab5e9c3facb4f8c380db0a16d3e8e8cca8cc468179d92ade93940206dd55f81ec5dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173314, "uuid": "866571c9-2120-42a7-bc5e-51692df283cc", "value": "T1F285336AC4341EF6FED78675B805E2E1D4A6EF13D6804B887561C12689B0B0E0F658FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173314, "uuid": "5362d726-a365-42a0-be56-6d3f42bc898a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173314, "uuid": "1f3e8fcb-09f5-41c9-ab6c-6a04f5e3ccb8", "value": "49152:q3n7xKVvTj90emnEvpjPHDWPts+SEY8JeH79wLJ6zdrji1:q3n7xUTjyeYEvpjStsbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173314, "uuid": "41b8bc47-6273-400f-be58-31663fc79656", "value": 1860552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173314, "uuid": "8e06d6cd-ea86-4ae1-a87d-30b53643b25b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173314, "uuid": "2827e403-1c24-4d59-8799-b9994dbc5af3", "value": "809b9513cecea98e925419a39a6244a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd385c7-3dd5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664222424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222424, "uuid": "c1912c07-f80f-43c2-a560-13dea2e19953", "comment": "Malware payload", "value": "9f70ed833e42290d53c72d4de7ed86ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222424, "uuid": "85e211a1-b00f-4e7b-9382-2c2ab6f2d600", "comment": "Malware payload", "value": "569539b63f35ae4328f6efb1527f8be6dcc63732a46b8c78d72a6b0a9e254afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222424, "uuid": "0a88d4dd-78a5-496c-9b64-7e402afc77f0", "comment": "Malware payload", "value": "192fdeb71eb99f796cab1fef76462a441ef3f376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222424, "uuid": "1029e2df-c7b1-48a7-9b14-3225c0e1b57c", "comment": "Malware payload", "value": "cd4faa3c8e83d232e299fc6dc33eaa89dcfa0d651456904ac9ee190df41e621c266dc74b09ad36a1957cce52bb057c92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222424, "uuid": "26ed8d08-7a9b-40c6-af68-1c661a8a19d9", "value": "T1172402907CE9A532EC69F0B06832D5116EBFA80529760F4AFBF4261B5F306C16E353D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222424, "uuid": "c8460c44-6e28-4742-b41d-1ac001a1db37", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222424, "uuid": "12a6863e-a7d1-4019-999b-11d6214e6fe1", "value": "3072:WTw3ET559FqQ+cBH6ccTDrXnBuj+OG25FeFVJKLmFcHdeCGJY5g8Y08UY6s04Lq/:R25F6hXB2H5cFnncHdeCMYWimd0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664222424, "uuid": "8a08eaae-4603-46eb-85d6-394011f7e042", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664222424, "uuid": "f16afa7c-d19e-4dcc-b9d8-df26261368e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222424, "uuid": "99021a01-682f-4b60-8e04-7a614f5345ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c858df-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Neshta)", "timestamp": 1664180857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180857, "uuid": "d640e804-eb58-473e-a6f6-928b2158d013", "comment": "Malware payload (Neshta)", "value": "98ec95d07881fe20943c648fc17a4884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180857, "uuid": "565251fe-f6d2-41a6-aca8-db8f06c5f32c", "comment": "Malware payload (Neshta)", "value": "56fd163108e6e2a9e2f7cfd15898f61d5b8d435ed839d1e29b70c040998eedcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180857, "uuid": "aa97ebe4-0e47-433c-860d-8f11bc68d3c0", "comment": "Malware payload (Neshta)", "value": "4caeeacf2e4dcac911f64a20b00388f96e9adc7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180857, "uuid": "6990f70c-6f75-4b40-b890-cb9e9b553fcf", "comment": "Malware payload (Neshta)", "value": "4ffb83b3620c6d9226404256ca1be9db272c595b59173b41b85500d61ca36a88d733af2410921a4a2c0dad94d01f53a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180857, "uuid": "58da2cdd-6754-4340-b8ed-17a21440163e", "value": "T1BF3266C1B786C59BD5608C79AC6283D00B2D7D16FD627D7FB9C9B72F58115C808B26E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180857, "uuid": "60afd99f-e3a1-4892-9a05-cfa673de88b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180857, "uuid": "a2851c49-aceb-416a-b8bc-04d0031b4eaa", "value": "192:yMZ3k3osS0Otg03xoVjn9GprrrrrrrrrrrrrrrrrrrreKp:yMZ04s7OSaxoVwprrrrrrrrrrrrrrrrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180857, "uuid": "4b767206-316c-4ed8-92b2-39fb7917aecd", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180857, "uuid": "484681e4-ed60-4fc9-8c83-a175acf5c906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180857, "uuid": "fcd9e242-b4cb-4fac-b739-fbabd20015d9", "value": "Dekont_20220926155607 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44e9c76-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215083, "uuid": "f8967e2a-3b20-4124-8c96-af442115002f", "comment": "Malware payload (IcedID)", "value": "e9d1cfdbc9395de2b84a4ed5094a1797", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215083, "uuid": "34648260-bed0-46fb-8ea8-4943c34f6eed", "comment": "Malware payload (IcedID)", "value": "578a35e36d8e6a9328cec388852679bac9c7fc9d1cb60a6350ebd9f6a65cc563", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215083, "uuid": "d2146e63-60c1-4b74-8aac-a3cbeb75434e", "comment": "Malware payload (IcedID)", "value": "8bafd22f6140314c62f5e75b5d8360c59fa889b7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215083, "uuid": "1ad55abb-51dd-4c96-8c56-5ce482d41caa", "comment": "Malware payload (IcedID)", "value": "256e76aa4dd0de476d16afe9e07a1ed32e77f82537bd5977f08a0f5a0efe5f65fabb0199a9536c361866b8813e829bf6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215083, "uuid": "55860bac-5f2c-41fb-af78-85e6b657fb69", "value": "T17E15F105CF54616BF00B693E371725C7F8661C2B308BDE0A6B92116E2AD7FA0EC35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215083, "uuid": "4103aeb2-a1cb-4921-800d-b963de9e05c4", "value": "12288:MDLVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEsIRlvHfzP6:MvV2jUeQRI5wPN/1IXHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215083, "uuid": "a12a5cca-9b14-4d60-be8c-f322127edae6", "value": 887985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215083, "uuid": "105f0ed7-0b70-4783-abff-04400a62b670", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215083, "uuid": "f3db3840-f42f-42b0-b1fb-d98cf10bb87c", "value": "manifestadventure invoice 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68df23c4-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214500, "uuid": "32271a82-d9ce-4be2-8434-52565b1a5cc4", "comment": "Malware payload (IcedID)", "value": "f99a3ddefc11592f8e3a8afccd71cb3d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214500, "uuid": "eadbc154-5a42-4b05-86c5-36cebe41fa3a", "comment": "Malware payload (IcedID)", "value": "57d2ab6857597731cba0c9d624b35ae36eb5043b142ba3bd0867847daae6540b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214500, "uuid": "bcfe7936-42cc-49ac-be8b-b4588e715e7c", "comment": "Malware payload (IcedID)", "value": "3033ca71a210cacd484deccef3dab32d054fe4a3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214500, "uuid": "1f73ac71-ca71-4d49-8800-a44bdfa46834", "comment": "Malware payload (IcedID)", "value": "7e2dded58a8a5592ff00be9ee2341537b076ab4216bac6546601dcd6bbacdf273baa144909e8b96310ec77dca938de13", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214500, "uuid": "0eaaf5e7-fe7b-43a6-8525-fb387b0f30e0", "value": "T11515F105CF54606BF00B683E371365D7E8A61C27708BDE0A6B92512E2AD7FA0FC35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214500, "uuid": "b4c45eba-e069-4343-91dd-4d133df520db", "value": "12288:ddVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEA6mu5GYdrljHHfzPY1T:ddV2jUeQRI5wPN/2mu5JrljHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214500, "uuid": "6de03a17-84d2-4666-8db7-b014312511aa", "value": 887695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214500, "uuid": "1cb17dad-00f1-4fbb-bc69-dc2f16f12edc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214500, "uuid": "3d234038-9f07-4668-a634-502f2b9b8ba1", "value": "kinizamail.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ed477f-3df6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664236346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236346, "uuid": "2e44c36d-2fc5-41db-9920-032f2f018ab5", "comment": "Malware payload (Mirai)", "value": "9765fda9a3c5c5b4eff151f564df39d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236346, "uuid": "01119410-2022-4b04-a181-9f9b33bfebf3", "comment": "Malware payload (Mirai)", "value": "584d1a239a82239a0dd2a9cd7bad209626e5232d0735776c82515fc56870b518", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236346, "uuid": "9b15be4e-7f7c-4635-9490-6a579ff5be8a", "comment": "Malware payload (Mirai)", "value": "7d3fc1a24c442e4354b37f41df4a703dcbf77d85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236346, "uuid": "5b10df64-8587-472f-91b3-07f52c7f1c40", "comment": "Malware payload (Mirai)", "value": "d4fd132f59db2fd08c2a350877f6e8d3749615e189d64d6627b27345501b7244587179ac07c6abc859985cf6190814ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236346, "uuid": "a171e8e3-361d-46ea-a843-100191e646f3", "value": "T1B3239D67D87A6DD0D1588274A9248EBC1B23F405C6A73EFA5E45C26A4007EBCF62D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236346, "uuid": "a3dcc2b0-a564-4c2d-8290-da89cdff80cf", "value": "768:taPwtkWork+eqUyIP7fvslCJGrOGynzklICto96TrclCu4:taPwtk5bxg7fv1GWklIZ9kclCu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664236346, "uuid": "23b88006-aef4-4eef-a225-ab7960b71dcd", "value": 47724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664236346, "uuid": "61227946-5fff-4a0a-a995-df8bc4e2bfa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236346, "uuid": "4fb7a5dd-95d2-4993-91a7-a1a081437b49", "value": "9765fda9a3c5c5b4eff151f564df39d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba2d426-3dc8-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664216867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216867, "uuid": "45e0ae57-d63e-4168-8ea1-a364e5af0ac1", "comment": "Malware payload (IcedID)", "value": "4665978b0c385746634e837308b07830", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216867, "uuid": "67baedb6-abac-4ddd-920b-27940e507e9d", "comment": "Malware payload (IcedID)", "value": "58ce514c8b740fdfe115bc19d65ed5e2f8d0df045cdd4e5611ec213382a56e3b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216867, "uuid": "12ad320f-596d-4656-a8b9-23fb22426ffa", "comment": "Malware payload (IcedID)", "value": "bb9457fa419c8970eafb857482f3ce6db12381bb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216867, "uuid": "9dd86803-16cb-47e1-adba-67d21d261b2f", "comment": "Malware payload (IcedID)", "value": "0762ac00a7b67945029d8ae39488451c535278660dc4186339d0fc141d82306f5d447dd5ba2ed56ceba837df6b79e127", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216867, "uuid": "75ee5394-e855-4086-b27e-92aec0a9d4ed", "value": "T17115F105CF50616BF40B693E371365C7B8661C2B708BDE0A6B86112E2AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216867, "uuid": "4d44b49e-e3cc-4bf1-9c61-795b92f2f7b3", "value": "12288:70VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DErLpcZJWWDuBhFg:gV2jUeQRI5wPN/w9cZzq/Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216867, "uuid": "5000abcf-5366-4150-8946-b829e42fc5c8", "value": 886981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216867, "uuid": "d5b2e5d2-c9ce-4338-aa86-397d2cab7561", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216867, "uuid": "2b6b8a31-b68e-4496-9d95-d78466ee8588", "value": "mpbronko.file.09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b9c8dc-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213856, "uuid": "97226e4f-65fb-4759-b57d-664363e9e416", "comment": "Malware payload (IcedID)", "value": "7f5e39b707edc013955af76c50bf34cf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213856, "uuid": "cca57797-cbf4-4b36-808f-6de169805a5e", "comment": "Malware payload (IcedID)", "value": "58f9be151a7edb6fab36fb7ca9dfdfcd9ebd257d4d30bac1d1042c0bdd1ef38c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213856, "uuid": "b4ea37b6-2e22-41f7-8c82-634477238aad", "comment": "Malware payload (IcedID)", "value": "bfb0187b6fe8066779c6ded18dc199241235d7c7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213856, "uuid": "3dc49717-ffb8-4fb7-bdea-270e63d9a165", "comment": "Malware payload (IcedID)", "value": "7818847f20d9502b0572c1b2f241076681fc12655c96a0b480d12677e34f62b8bb78b0ab986ba8fef7946698a3b29026", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213856, "uuid": "e8653eb2-789f-4c19-9ea3-84f33f71292b", "value": "T1D215F105DF40206BF00B653E371365D6F8A61C27708BDE1A6B86112E2AD7FA0FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213856, "uuid": "1faf9e77-e12c-46ed-ac6c-b92c816dc713", "value": "12288:w4VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEuM/rrljXXAKunP5GL:w4V2jUeQRI5wPN/grrlbwKua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213856, "uuid": "ec28edfa-6676-4bcc-a2b3-93fe9697153f", "value": 888128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213856, "uuid": "82260301-bd2e-4bc0-a776-c4ef74e5bcf0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213856, "uuid": "3510621e-0aa1-4bfc-aece-4648795fc1a5", "value": "lindenpartners file 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfe785d-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664180979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180979, "uuid": "475288b6-34ef-4716-895e-e048198ec367", "comment": "Malware payload (ArkeiStealer)", "value": "2bc296129698df69531a64b0911e2b6c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180979, "uuid": "4f540568-b865-43cd-847b-7f2d419b5ffc", "comment": "Malware payload (ArkeiStealer)", "value": "595de5a664edf353ccca6e9e50899774eedf4733f1931b0e6e370d866de3e55a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180979, "uuid": "78cd1016-312f-4ae7-a34c-1bb400f35e7c", "comment": "Malware payload (ArkeiStealer)", "value": "c9c5cff6a7e700139d471b0116e12ea0bb17e98e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180979, "uuid": "fc6517c7-efd5-4607-bf52-0d6922e07f37", "comment": "Malware payload (ArkeiStealer)", "value": "93324495afbee6e86736ec0d8e5044d4bd4dc5ef061fb301b94b9fcf8322d8232d9a1c7503023528ba5b9f40dad40255", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180979, "uuid": "7aed22df-cff8-4fd8-9a36-985e0d7400be", "value": "T1D8549D257780C032D66784B69D05E7268FBEB8D33921A457A3D4477DBE20A82CF5E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180979, "uuid": "aac9025a-3efd-4ce9-9475-a19a05e7bd33", "value": "8253e8efea69f2acc297953b24cd5ada", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180979, "uuid": "18963bd3-bbe2-481f-b033-3a0dd9ea5064", "value": "6144:3NyBcukd1tiFqgFGI4pT2GI7DUiySpxQRqViGe:dyrmDiF3FuqDUiySGqVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180979, "uuid": "4a02e788-eea1-4b55-bcbe-c5e4cb458283", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180979, "uuid": "a2131c00-8838-4133-b2e9-200766bd1876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180979, "uuid": "a0583589-4557-48d5-bc33-3828131f73c6", "value": "2231160e71faf8674b8efc0cedf3384db3acc5d66f0276c76b18c7cb5f842ce0_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527f807e-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664200719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200719, "uuid": "8afa46a8-49ea-4b39-8c24-2438543d74ee", "comment": "Malware payload (Smoke Loader)", "value": "340f3f8de8d32609003719f3649d03ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200719, "uuid": "8c23c258-9816-4b93-9ae0-8afb780962e8", "comment": "Malware payload (Smoke Loader)", "value": "5a50c29b2562f9f22649a74a8db18ed8c98cc89f920e402ee3ebb455b975d3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200719, "uuid": "16719fff-fdd8-4102-abe4-6455784e856d", "comment": "Malware payload (Smoke Loader)", "value": "d606c87684d9cb99611cb9ed5eca65e725bf3a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200719, "uuid": "08492e78-79fa-49d1-8118-dba9ebfc7216", "comment": "Malware payload (Smoke Loader)", "value": "86ba8c6e0d21ea026831c7d68c954d731733613cae09c9bdd13efe1c8355ea459b8bf4bfd66bcd89393631c62922af43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200719, "uuid": "6b1fcee2-a30e-48f9-99e1-a0e5853597eb", "value": "T1C9E3F1007F80E8B3D42650746C25D3E1AE7EBC2116725E473788AE6F6F723C26B66316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200719, "uuid": "edd2fa8b-533a-4b1a-a19c-82690256accd", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200719, "uuid": "67232703-602e-4f86-a811-1ad63407ffcf", "value": "3072:J187jTTF5hFJB78gv/m4+SRd68PhDLrB1AXOD5B:47NzB4gXm4+wrPhDLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200719, "uuid": "6a31cf1a-dc6b-467f-9027-478949aa66b0", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200719, "uuid": "37d04167-856e-4b73-aecd-01452ee9d05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200719, "uuid": "d022a195-8d5a-4ee4-a051-8613f1120a7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4a8f25-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213887, "uuid": "7f7fdaef-b1a9-4fa1-8c02-5a9397573e8c", "comment": "Malware payload (IcedID)", "value": "366304ec7a8ead86c52e0f5328269a2a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213887, "uuid": "ebd038a9-540e-459e-b1d4-7f0d14430bda", "comment": "Malware payload (IcedID)", "value": "5b067b3377033144b982410f226ce45007b3615446b3b72c5dc1468bb6864447", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213887, "uuid": "ad245799-e248-46eb-b052-235e4e581329", "comment": "Malware payload (IcedID)", "value": "bedbf8b099dab8c9e4dfb839a40a4aae0158eb60", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213887, "uuid": "011f7122-ab7a-4c7d-b08e-be56982bade2", "comment": "Malware payload (IcedID)", "value": "c9f37a46003abc9bf5f1afd56aa74788ee62cd0733f12fd0eabb6369456c97957440b34ada9d9fd7c855a9e501692d17", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213887, "uuid": "42381ee6-245d-4bdb-bfed-975757ec7238", "value": "T18415F105CF50216BF00B643E361765C7B8A61C27708BDE0E6B96112E2AC7FA1FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213887, "uuid": "f3fb64d3-d93e-4ad5-a220-1a9b6fa4146c", "value": "12288:z4hVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEx0y8x7trjxzFZjFgGC:shV2jUeQRI5wPN/ntrdZH9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213887, "uuid": "efbf277c-8fb5-46ab-b92a-dae69f052061", "value": 886911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213887, "uuid": "3f449006-b907-4c52-89b6-b03fd21bd693", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213887, "uuid": "520c5209-47cb-4270-b457-7d8b221dcc65", "value": "ismanews.doc.09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8acf990-3d86-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664188462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188462, "uuid": "6d14de32-2edb-4bc4-b83e-1b2ff9fb8da6", "comment": "Malware payload", "value": "34758838887dfc4ddb406cbe617ebfae", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188462, "uuid": "63ad107a-c26a-4aad-aca7-a0ea1652f83d", "comment": "Malware payload", "value": "5b2ea57a1e98320b7086532352463296412a11413ea84d08372d67a73820ecf6", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188462, "uuid": "2d93d7d3-4c54-4a0a-ab61-71d00706d525", "comment": "Malware payload", "value": "b5c971fa79f4a01aea03c16c0163e4e3573efd09", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188462, "uuid": "e111614d-d7f9-440f-9cd5-5ace8b7c8971", "comment": "Malware payload", "value": "5d3fb44ef09b84a6479a83469a1d6d4b8b6cc385324d00e08b6139d4c6e40a6f1f6d8baae2f9996e264d8196ce77a898", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "FancyBear", "colour": "#2A0E82", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188462, "uuid": "5c76f03c-5c00-49fe-9c08-3bd2a29db243", "value": "T1C5E4E059F2C16EDBD233983BE1F612862124BD615B45D60F60DCF20F36B26421F67EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188462, "uuid": "a096b729-f0ac-443f-8b8b-4a8a1f5c06ca", "value": "12288:xi6upwuCH09A3doNT15kQEnxeYnWzglNT15kQGxY9y:xi66wrttLnx5kg43xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188462, "uuid": "9a1642ba-ca70-495e-83bd-ec70e585ba52", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188462, "uuid": "ed7dc1e2-b33b-4cfb-bfda-897b8d6ebfce", "value": "application/vnd.ms-powerpoint", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188462, "uuid": "29833d16-cf51-4d46-b0e7-1820c604db30", "value": "5b2ea57a1e98320b7086532352463296412a11413ea84d08372d67a73820ecf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ed697d-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215091, "uuid": "66480d70-7ae1-4cca-84fa-0f87e6d10eaa", "comment": "Malware payload (IcedID)", "value": "ee89b0b3d4269bfdcceb595c733a7243", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215091, "uuid": "8a5e1ff1-bdf8-4762-8e53-c25e63e610ff", "comment": "Malware payload (IcedID)", "value": "5bed7aa2d24f217abcbcef9ba69ea7eac2b58d2bf3921e845934c65efb7fd251", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215091, "uuid": "eacf3139-59ad-42f9-9b00-833f4ba1e796", "comment": "Malware payload (IcedID)", "value": "9771c886ebe2f1d2b5b0100b3fb43cff334ba9ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215091, "uuid": "8dedb771-576a-4d0a-aecb-85eac6457325", "comment": "Malware payload (IcedID)", "value": "0c42a13fed836aff58e3d6f67e34118751af4b57d8bf92aef2497cf73acf2bfc9cfa82737f0b068996ad3ca5191dc50e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215091, "uuid": "89dc888a-1980-4ca7-ba12-2c2cd870f7f2", "value": "T1CC15F101CF54606BF00B693E371365C3B8661C27748BEE1A6B96112E2AC7F60FD35D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215091, "uuid": "79328112-6b71-4bea-9c09-68bce2218e40", "value": "12288:2eSGVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DES7AI/xKToQM3XD4:2eSGV2jUeQRI5wPN/zAI94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215091, "uuid": "43658fe0-1f5b-4234-a492-37d50746043e", "value": 886641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215091, "uuid": "284f1b70-50c3-4782-80f8-e5872c3bd569", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215091, "uuid": "aef0b1bc-7e39-4a19-b355-11eb14824343", "value": "ironivyinc document 09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc34d3c-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213864, "uuid": "3e1714ee-597a-42bf-9ef5-8cd38893ea19", "comment": "Malware payload (IcedID)", "value": "54099e7be024c3faff908fcffb6ca6cb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213864, "uuid": "25fa4749-f01b-4937-87d8-2616caad427d", "comment": "Malware payload (IcedID)", "value": "5cc55537a511195f7156af0e5ba37f4b02c124e2e2576561a50efbb23c7e1ed6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213864, "uuid": "b7647763-1500-41f3-b0cb-8b10092da176", "comment": "Malware payload (IcedID)", "value": "de5e212c5345b57fb61f0981767f222587c71483", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213864, "uuid": "f19aeb7b-284f-41bb-8058-3ef728ca1a8a", "comment": "Malware payload (IcedID)", "value": "c00d939239f6f07dae5ef4fdc0f953d131005f7e62e519b8cea8f215e9e9c927ee05dbefbdc63df53249b1dfb210b792", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213864, "uuid": "49853811-daad-4009-82f6-77ceeed0ff96", "value": "T15015F105CF40216BF00B687E371365D3A9A61C27348BDE1E6B96112E2AC7F60FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213864, "uuid": "8330bf47-809c-432f-8259-c6e8229d6d89", "value": "12288:AVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEHhI+FG9RFt6eGc2rh3XDRe:AV2jUeQRI5wPN/2I+Fint6RdRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213864, "uuid": "d1ae45a5-56a0-4b52-86c1-1efe48db1c71", "value": 886290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213864, "uuid": "de018224-1bb5-4552-bda6-10e870945c96", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213864, "uuid": "11333c51-a7eb-4044-a59e-b4a268a83196", "value": "iowatelecom,document,09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4eb18db-3d33-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664152807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152807, "uuid": "f54cebe9-c6d1-4a3f-8468-e5f7dc33416a", "comment": "Malware payload (Stop)", "value": "e831153104b9aa7aa5e13aef5d11f994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152807, "uuid": "b7f4e16c-d9da-4191-9d5e-48a05264096f", "comment": "Malware payload (Stop)", "value": "5cdc088f1165660b2683984313a7f2cb4c6e7323b31e8ab37d3a219e015b8381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152807, "uuid": "3bf85fb0-dbb7-475e-bfc9-6b5847891c26", "comment": "Malware payload (Stop)", "value": "94a05b466f5ccaadcfa88808aede786c209b549b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152807, "uuid": "f3647015-a9a4-471b-85db-ad7be5180e24", "comment": "Malware payload (Stop)", "value": "16128187b2ce40a135ec48206de2c4b05d8cf17aa488f257cf8849992e79fac0518031bed64290879453a57f23aa26ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152807, "uuid": "bd2a37d7-f245-48af-82cd-d32aabe5ca0b", "value": "T1ACE42311BA81E075C903D774D479E2D0A67AECA300166E0353641EAFEF377E166F934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152807, "uuid": "5255d6eb-662a-4f8c-904b-45b0ac2e9d79", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152807, "uuid": "b6875732-391d-43c8-aab7-96b24db8a16e", "value": "12288:yrKeCAEQuzjDQJrKYdNKQX/QkSoFPalGotiicVaZM7kpMCKyR0R:yrK96KjDQJrvNX/QkSoTi200", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664152807, "uuid": "76c3cff0-80b7-4d98-9053-19e81a8a0c10", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664152807, "uuid": "feb440e4-6533-4672-ad3b-fe6586cb61e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152807, "uuid": "f0326c71-be63-4f98-a5d8-6b281bb212bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35056234-3d9f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664198951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198951, "uuid": "dd0bcd32-b54f-4c94-9131-d02a5396d182", "comment": "Malware payload", "value": "0b065754c3e2b80295aa291372f27790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198951, "uuid": "28840714-f48d-470d-b54f-0000ad56d202", "comment": "Malware payload", "value": "5daed8310c996086da222be010d4305e7d2c1e852fea9af0bd9b63572ce5a79e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198951, "uuid": "be86f0bb-d8ac-4261-8284-732183bc42b3", "comment": "Malware payload", "value": "185ffbff6fa0fc0a4dfbaf5bf9ece3fa4c9cf2f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198951, "uuid": "6d429794-4d7e-4607-8502-665bbcb28f00", "comment": "Malware payload", "value": "5daf11f7021a671bc909b942ccbd0922ef7108b15f02d3886a06106277c8b066bc9006e3db264754ae26d5c128005323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198951, "uuid": "bd55de8c-16a2-482e-899a-2663f8c588f2", "value": "T113039513BA68903BF35586B21C76926958137E710A80DE4B7B897F5D1C32683B9F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198951, "uuid": "e741eb16-1361-4529-aca5-8075b8d0c8d5", "value": "6f2cb2ae275ff3fdc260dfdcf4fd7f6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198951, "uuid": "383da0b1-40e2-4cc3-b7eb-8355b849ac68", "value": "768:pU0wK1KZ+Mvgdlb1PzshVOeDWGGiGgLEvv7+:pUNvgdlBovOeD2ijYvj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198951, "uuid": "244686df-8a84-48e9-a3ca-6d8632265fd3", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198951, "uuid": "31f38370-8ace-4ef0-9c98-a7bad444d28e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198951, "uuid": "bc79aa2a-af8c-411a-b616-3c47279c3c70", "value": "0b065754c3e2b80295aa291372f27790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127671b1-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664201470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201470, "uuid": "00d7a78b-6979-4642-a741-42ee4d2addda", "comment": "Malware payload (Formbook)", "value": "027e492f7ceb4cf8023d311602434de3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201470, "uuid": "c79e7ef2-d767-42bb-926b-d93be50eaa58", "comment": "Malware payload (Formbook)", "value": "5ddfcee976daf1f71a8b1f41a4dd170e80683b2e79d48e312d6010f941de148f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201470, "uuid": "5ac5414c-e20e-433a-9fad-9b6149961e03", "comment": "Malware payload (Formbook)", "value": "5b5a739f5688ce1154a2a4af2de1e9db8854294d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201470, "uuid": "27823c6b-ccf9-4e9d-a521-e3ae1d624266", "comment": "Malware payload (Formbook)", "value": "f8c25c38c31832b2f32ac2c022fd690756b32d2ae19e8cc18d787486581ccdd3adb1931024d61f74a73c6460920fc069", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201470, "uuid": "d035d205-04cb-4dd2-a14c-c3059a1ed93a", "value": "T181152021B1777DC3532202B1828F9E46A3297B47B35A1E94F01EEEB82DE45756381F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201470, "uuid": "759fbcc0-0d5d-413e-a9eb-468549754023", "value": "1536:kpGEch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fV:gho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201470, "uuid": "99fbd0ca-0035-4533-8ff3-685c16022ab9", "value": 885324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201470, "uuid": "c732ef64-be1c-4420-87c7-5647ce2a20b8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201470, "uuid": "e7777768-97e1-49db-bd59-ab40f63d59de", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.9690.14807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ce41ae-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664171218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171218, "uuid": "38411e69-9625-48d6-af3f-fcaf2b9b7d50", "comment": "Malware payload (Formbook)", "value": "66a32d5dfea6ace68af647933a2883bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171218, "uuid": "269260f0-25a1-4a53-8f2f-4717274e9946", "comment": "Malware payload (Formbook)", "value": "5e5780629616b0bc11c3f9476fa99b6ef84d77ab7b1fc76afd336806a6fbb78c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171218, "uuid": "11bfaff7-3a74-4142-9980-77d45e259699", "comment": "Malware payload (Formbook)", "value": "6048dbd595e7207a43c057476031ba45ad756183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171218, "uuid": "f776f4fb-34a9-4604-b1e6-8232c4c086bc", "comment": "Malware payload (Formbook)", "value": "88370bb6ad223c62139ec1511b72bca446de541bc6e09125ad4d59f822d616fbca655efeae85a79ba6006dd16571d4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171218, "uuid": "4e78fe3f-aad9-4bea-a336-7aaa316c2c0d", "value": "T1F4943B2C3A024AA3FC1D933889430A94FFE70B8372C5E99257CF95CAC75F4656D658B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171218, "uuid": "606c469d-c611-4e4b-a78b-b9abf07365be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171218, "uuid": "b2078d8f-7ece-4e98-91a9-fb3d25898ed2", "value": "6144:NgHMFI1ZPffn6XyJfDm8U2c/UHBfwRKcXsD8+Q6EeqdXJ:N+M21Zf6XyBDmD2c/UrcXC/E5XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171218, "uuid": "ecff8b31-3868-4a66-ba88-3266c39934bd", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171218, "uuid": "2e26b0de-aec5-4e79-ac8e-314508b4f94d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171218, "uuid": "7d14038e-ca73-4c3f-bf49-b620a1de0f75", "value": "SecuriteInfo.com.Win32.InjectorX-gen.20583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67230d4a-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214497, "uuid": "8d4d9d95-0143-4379-8ea2-9e14dafebbe3", "comment": "Malware payload (IcedID)", "value": "2fa7701f81b043b482ae8972d6a8be74", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214497, "uuid": "52228e94-dfc8-4ed3-b999-2f4b999641b0", "comment": "Malware payload (IcedID)", "value": "5e65ccccf0031bd22a341a0cc2006598af2086b70a9667779001c380891d00f0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214497, "uuid": "067b1656-3c86-4612-b75f-f26a97cb0513", "comment": "Malware payload (IcedID)", "value": "17bcff2f5b3c5fae7ad4f45d0b09ff47c0db83b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214497, "uuid": "84654afb-13eb-467e-b826-7e45436855ea", "comment": "Malware payload (IcedID)", "value": "8f83b820837f651bc24ee678ecaf199d0f2b0e8327981da5b8d0f79ef4f17285d8ef1a6ed60f1bfbd2d4809ca0b02217", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214497, "uuid": "9cf32411-f342-404d-b8c4-c743f1239795", "value": "T1ED15F105DF00646FF00B683E371765C7E9621C2B308AEE1A6B96116D2EC7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214497, "uuid": "218b1d12-379f-408b-88b2-91d2ed2d4b9e", "value": "12288:tv+VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEFsDRMSzvo/PXSYqoJKfg:sV2jUeQRI5wPN/dDNzyPXSYqP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214497, "uuid": "994af2bb-19ac-45a1-bef9-b4968f1802c1", "value": 886863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214497, "uuid": "294842e4-6843-474e-9479-dbfb7abaea97", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214497, "uuid": "f7bda9e6-8e4c-486f-9a6e-9c0b36a31146", "value": "nh-vtclassifiedsdocument09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb24ff94-3df2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664234851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234851, "uuid": "47378bf1-63ac-4b71-8edc-8962960dc7d6", "comment": "Malware payload", "value": "f2eb3d59e305ca533413386ef0d6a72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234851, "uuid": "17303cc5-d20a-4d05-9b8a-931a26c65373", "comment": "Malware payload", "value": "5ed574918a37e972755100ed63a153269a3b110ae9c1606e45886b0f1d767966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234851, "uuid": "9b2e8629-604a-43bd-b296-ef0b024c9f98", "comment": "Malware payload", "value": "9ec81f60fa38b6abc47441a85f65f123d783d1b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234851, "uuid": "e371a066-3072-48f6-88bc-66aaa5751037", "comment": "Malware payload", "value": "9449c7e2ec1f8845b70037a91d083c65ce55f293493bc880ffaeb88c359532856efaa8e310e6c13974c6b881b18cac26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234851, "uuid": "d38d4ae1-4ab8-411c-a61b-2d1dde9a1875", "value": "T15F2402713C849433DD23B27198B2CE2425BB75422375558AB6B895AE9E32BC11F383DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234851, "uuid": "2ca7a018-ebec-43a1-9646-b8658c4f93f5", "value": "838f718910cdf3a4ebf0855233529379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234851, "uuid": "067dbd0c-ba00-464a-9f2c-b7b8e3772a64", "value": "3072:EOy0TI5ie2hQ24CYhA0xvZ+1VwfAjbaVweErn4FzBoL/7/dqtT75B:EQhQ24CYhAKvZ+AIXarcn4U77/dqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664234851, "uuid": "b537ca1b-74cb-4ea0-84ed-d87208ad01f0", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664234851, "uuid": "406473d7-0a1b-4141-a39f-d9a3e148cc4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234851, "uuid": "54bcf0ff-2512-4b8b-93b2-c9b27e4684ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00eeefb-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664180743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180743, "uuid": "baeab7f4-5a4d-4f14-91df-7fadc8fbb1f5", "comment": "Malware payload", "value": "2945c117350c3403f73f6e6a32a30a77", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180743, "uuid": "ec284e1a-d21c-4306-99ec-e1b56304aadc", "comment": "Malware payload", "value": "5fd291193f2735fb5f3dcece48f542f897d56532b153b174455db19d183ea6a4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180743, "uuid": "cd7cb76e-5aab-444b-95aa-1f32aa41a043", "comment": "Malware payload", "value": "cbd5c7d85d7d2204000e79ba8b144e40ffcaf6b7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180743, "uuid": "8eeea1a4-a317-40eb-bfe9-1074260a49bd", "comment": "Malware payload", "value": "882cbad147fa111f3bbdb308041cc5be334b0495aaa7c328001d708fc5cb1f55edd94ed9d3ea7475c81ef5f68475bc24", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180743, "uuid": "10779aa9-eb82-4962-bdb8-b816037c6848", "value": "T17B1159FF171BF8840F81B34544A9DD1D4A29691D5512A4CCA36A915C7B2E02DF939CCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180743, "uuid": "e83d4e55-eb0f-4339-82a0-0bd6cdd5a705", "value": "24:4rqxW4kCNqOMDAH5ALwSCMwP4AaPwMwP3C2GrP3nPNRZPs3MwPm22AaPmm:zIY5+TAnC2EVR6O22APm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180743, "uuid": "e9c4c46b-b8ca-4933-9b49-8d361f5fcb0a", "value": 1015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180743, "uuid": "1f93b5ee-5963-462f-94c1-a5450228b6ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180743, "uuid": "37b7633d-8ae6-487a-b4f0-c4fc2ac93cd7", "value": "Run.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc131e9-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1664174669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174669, "uuid": "a9884f19-09c6-4eaa-8331-c43f22486aa9", "comment": "Malware payload (NetSupport)", "value": "9a98f1485f7640f7873011b3a5aa21fe", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174669, "uuid": "3aae82d6-a2ef-48f9-94a9-a4593fc194b8", "comment": "Malware payload (NetSupport)", "value": "5fd2c01d98281f6b7603b772f4e204565735ffb1caf289ecf7ef51c28b7eec44", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174669, "uuid": "af03eb78-69cb-43ff-a3f3-8682ebbecc2e", "comment": "Malware payload (NetSupport)", "value": "2b0d0369aae2ad71c432d909598695e0c48dc023", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174669, "uuid": "843dec8f-4122-4d37-8763-f55e219f9f57", "comment": "Malware payload (NetSupport)", "value": "1fcbc6af3afe24e76a9d0f870af615033b8e7d4abea5528ec4ba954b7a5727704487c1184e2ea53f422328489f943bef", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174669, "uuid": "a05b4ad9-d0e7-4267-90bb-98f9e7ed8c22", "value": "T1801104169A0EBC5C196BF2D6377411D01FD74004A44D3A1167585D0F9F32E7D46EF8D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174669, "uuid": "61a41761-d84f-4be6-a428-2b4462a7cc6e", "value": "24:xpOhzZmPTxapz1l1yXtIDPCPBmu5uM/HMLv:xAtZKxi1y9IuPBm2T0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174669, "uuid": "f8d54e88-f837-4d13-849c-687925ac91b7", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174669, "uuid": "9f4e8ce0-55f1-4f32-af3a-113aa9159b02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174669, "uuid": "879369e9-549d-44ae-90c7-acda9a800bcd", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7642a6cf-3d30-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664151387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151387, "uuid": "194734f5-04be-413f-8b3e-88821d962576", "comment": "Malware payload (GCleaner)", "value": "65780306670781bf9dc45792af5b52f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151387, "uuid": "f9f31f1d-339f-45eb-b99f-4e7e117d90fc", "comment": "Malware payload (GCleaner)", "value": "5fd5199e4bf164c43f217c1fa5002daf90432ea3fc5f8a69cc0fda4880361e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151387, "uuid": "84880974-d59c-4d1f-95f3-629af5512674", "comment": "Malware payload (GCleaner)", "value": "fccf533169c8199be346ec94174df08b957d7ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151387, "uuid": "ae358261-dc74-4fb5-8214-64099145038b", "comment": "Malware payload (GCleaner)", "value": "3247e7e181c457e51fff51a00a9f86ad4dfefd7f25dabb98e4b4fe44f67e7446be18adddd65676da0375d869b8f1da84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151387, "uuid": "967101a3-e172-4df0-8920-70b8f8bbbbec", "value": "T1C844F1117980D831DD5CB5368832DAA929BEFC92505146877BB83D6EEE313C01B78BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151387, "uuid": "882ba82b-0bea-49d0-987a-77bde8015fb7", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151387, "uuid": "f3f958aa-e0ea-46a2-993c-68b8d17636ee", "value": "3072:V5s4BHz2WPbPhp8z5oOwk7OkzS4ERlxfLiFwLLTsLYL08L/qYcB15gpjzl/rPBo5:QePhbkO4ERl5+aIanqYcBYpfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664151387, "uuid": "52565922-3e4d-427a-ad4f-071f21669b81", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664151387, "uuid": "ffb3b313-2c7d-4c74-b019-5e66e83836b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151387, "uuid": "f074d902-d6e5-4a3a-9d4d-f0163d304215", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf30d6e-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664191499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191499, "uuid": "e9e883a3-d6ce-40c2-86da-b34f39fd4625", "comment": "Malware payload (Loki)", "value": "ae04516848829de7ccbbde70b644c88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191499, "uuid": "b62860a5-6ff4-4c5e-a761-9657ea80333a", "comment": "Malware payload (Loki)", "value": "60958be94040ba1e4d9781c12ec25b74d3d8891477b30a3997847273796bfdf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191499, "uuid": "91563595-e560-4f55-af4c-7076c8237cc4", "comment": "Malware payload (Loki)", "value": "39f64fb2718f624c0bcf5be459b01a17619e5e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191499, "uuid": "e418a0fc-effa-4c99-ac08-b3b4ae5fd7ca", "comment": "Malware payload (Loki)", "value": "5fcd127c842baef8686e35406d62777a8657e82938d9ef1c16cd4fda8394007af8247152cd3399094016efeee114fd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191499, "uuid": "ac3bfed3-447d-464b-8e64-5fd76b04735a", "value": "T18034CF41BB60C137C8A5073199A64B267B72ED163A22270F33547F9F3E73AD168392D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191499, "uuid": "e0424e4d-aef9-4431-beeb-3196f901df97", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191499, "uuid": "2ba80ce1-dac8-4970-8c13-80dde584da13", "value": "3072:wkhohwq34yuQzQWqrJKZKbvkELBvJeR6nuTPmknxP4g93dX5stPReZCgTnMAuI07:pIw3I83NvJeRq2mknx4g352ReZpTMzF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191499, "uuid": "e194043e-c805-4adc-af63-b9b4c36c42b4", "value": 240632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191499, "uuid": "1ceef84b-ac61-4412-8efc-f7bfa11de7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191499, "uuid": "24aa9096-64dd-4c69-9613-b6c5dc250e7e", "value": "Sosialisasi Bidding Tender 26 September 2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bb0fbf-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215617, "uuid": "d4fe98d3-5c0f-433c-9ab1-90e9dce69004", "comment": "Malware payload (Mirai)", "value": "2870cc98b800b9286f62f3501e208cb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215617, "uuid": "e4fa8414-a64b-421a-935f-82b3d173b923", "comment": "Malware payload (Mirai)", "value": "60c2b558fc9b0161ba18d78079b1117be633923b3cb91fed362bc39ee4f6a285", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215617, "uuid": "f960404d-7dd9-45e4-894f-b8c0e99b6837", "comment": "Malware payload (Mirai)", "value": "85c9cb1593a696c1f1be18a0c1f571792b77e414", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215617, "uuid": "2ae20dbe-8f26-4ec4-8042-6eb9091811b8", "comment": "Malware payload (Mirai)", "value": "6411e046c007d56bec0576be15466567bfd9b6264f51549652dc01252f46951251e17927b18d50be5bfc8bea0285c6f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215617, "uuid": "4a4d7614-3340-40d7-a07a-cd5cb599902a", "value": "T1A193A509BF611FB7D86FCC37059A1B0125CC655722A83B6AB574D828F61E64F1AE3CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215617, "uuid": "60675b47-a81c-4c07-879b-113ef6546b38", "value": "1536:vR/0BYpy6yQc4QCxrEh5kRU0bZs/yLOZSYsQ9o48Wp:vR/0Bp6bcjh8ZXLO+BWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215617, "uuid": "6b992f5d-aa64-4f4f-a01d-f3d8837393c1", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215617, "uuid": "75c31734-831e-4695-93c6-bdd0e757203e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215617, "uuid": "f314afed-dee9-454b-8ef0-b03ffd1432c5", "value": "skidv2.mpsl-20220926-1806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e4006d-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215616, "uuid": "d149e9c1-60ef-47cf-adbf-f4d1da86e384", "comment": "Malware payload (Mirai)", "value": "2cdff991676447081dc90c8e7c02b678", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215616, "uuid": "9d5bfe81-bdde-4bcf-b572-ed61e1a3e80e", "comment": "Malware payload (Mirai)", "value": "617895fb740fb4557b6a62324c915c51a582ca636e4d9b46b3ab32c0ed4c2e33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215616, "uuid": "e64ddd11-8f4f-4bd9-a309-9c212a208ce8", "comment": "Malware payload (Mirai)", "value": "3b92f05636378580669b50c5daf8770c4c518dc5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215616, "uuid": "8a8aa370-50aa-4e3b-8fd8-540e8f719947", "comment": "Malware payload (Mirai)", "value": "26fb25f7fd36472974e9570ffc3ba6416fd28fd1d61898dd522423bd95a93e38bdf065f91dcf978e1fbaa07aadf16bf8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215616, "uuid": "325399af-e42c-4677-aeff-e9d5030d4087", "value": "T172831856BC815F12C5C60279FE1E128E331357BCE2DEB3139E20AB24778A96B0E37955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215616, "uuid": "3679cf1f-d881-46c1-94bd-adf2e8234aac", "value": "1536:jFnxF59GmygdirMvBIdFeDE9xlkr5MdGL8J3KHp65Qnug1WbsZC70hivo9YoqI2T:d5gm2iIdFeDE9xlkr5MdGL8J3KHp65QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215616, "uuid": "48c5a1c3-3b6c-461b-8714-b4173af5da92", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215616, "uuid": "c1d16f12-3a74-4597-892f-93843e95f72e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215616, "uuid": "6a1d4baf-37b0-442c-a901-ddf97e2a0315", "value": "skidv2.arm6-20220926-1806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45203c4-3d4f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664164886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164886, "uuid": "7bbfc2b1-b8ea-4bdf-adc0-45fb24a5dbb1", "comment": "Malware payload", "value": "651c363402a2eaaaf57a366c2cc0dd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164886, "uuid": "d35ae001-2ad9-45f9-976e-30615bd6a469", "comment": "Malware payload", "value": "61856678687b6ad3c7385a23d5a9a44e8399b962cff3dd55118afe4d3ea057b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164886, "uuid": "0a23d34c-a18e-4158-b889-d53084172582", "comment": "Malware payload", "value": "1d08c1ed93157162da5e71765f011bdbeb5f1627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164886, "uuid": "3de42b3b-b95a-46b8-a4e1-8e83fd0e62ce", "comment": "Malware payload", "value": "c3672eaa3ed18c8d4f4616b1063347ab6dc553c924bc323585c442c8ed672bf94e497cd85c8e48cc8c8bdcd25bc5df7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164886, "uuid": "0471ed2b-bb23-43be-9971-65c3ad7f916c", "value": "T1A6763311BED58877CA10B1B58E256ED86033AAB09F348473076D0E9D3D3D9A1B9B41FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164886, "uuid": "eed93b78-b194-4967-874c-01cd126084e8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164886, "uuid": "e1a96128-b1c4-4ed2-afb7-5c0ce187e09c", "value": "196608:91O2sNVjJpdMt7ukS2cQ/Og06W6veDUuJRvS04n:3OPJpdMt6kJc2Ogq68nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664164886, "uuid": "f07f5267-8beb-43d9-bbee-f1132165719c", "value": 7633500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664164886, "uuid": "0efd2f45-27ca-46b4-afce-9af7fc934148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164886, "uuid": "39fe4d86-3c33-42ed-ab24-c244e3d8a504", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3686e6-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173301, "uuid": "e6a29b03-901c-4852-86b8-efaebdf487dd", "comment": "Malware payload (Mirai)", "value": "0194457ee317a2287b3730d2060058e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173301, "uuid": "d0f1f2fc-5c1b-497c-a520-4fd8cecd1a43", "comment": "Malware payload (Mirai)", "value": "61888475d09ec079d7e1a46e479e11acb2ab3cbc2b1d5ed1770a31a1e9d5fda2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173301, "uuid": "e638a217-370b-4510-9aa3-4078de572c2c", "comment": "Malware payload (Mirai)", "value": "160ed85ba976ef3a1f94f5254b0ce957100923fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173301, "uuid": "463568ca-801b-4569-867c-8969589506a6", "comment": "Malware payload (Mirai)", "value": "a5388125e62061af5df4ba65be6e40a6f56378cdd3814dcd41d82506cd0f598cfdc45a6f1bb8abc423b3725b8aeddedf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173301, "uuid": "b13573dc-14f8-4ce0-9016-8815f018bdb7", "value": "T19403846A2A228FECF76C853546B74A30975833D622E5D684D67CF8001FB434E645FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173301, "uuid": "be48194a-06ba-4059-b640-f51a1f6eee56", "value": "768:ysoGpEWOzigDoppGWMOM9GEFn7JrUSGn3NPa+ajpt:yTDHWSN7GNw+aj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173301, "uuid": "679f91ea-27cc-447f-a594-b2b76516b7ef", "value": 40600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173301, "uuid": "c6672639-e033-480a-ab38-90adeda0c978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173301, "uuid": "d18848f1-e609-4e14-bc36-75dd7923ad8d", "value": "0194457ee317a2287b3730d2060058e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be238a2c-3d60-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664172123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172123, "uuid": "092566d4-5345-43fa-b790-ce309859bf40", "comment": "Malware payload", "value": "8b86303e8c9f5f5183407d2a54587358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172123, "uuid": "e420590f-af9e-47f9-a139-6f0797bbd27c", "comment": "Malware payload", "value": "62713dabaffeb0e344fe048a2184569413699d03cd7350b22d5fdfda78f064f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172123, "uuid": "79d26ac4-8892-49c2-b111-0a7c7f28e254", "comment": "Malware payload", "value": "5385547a9e0ff6bfe1161ef30d4811b9c401236d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172123, "uuid": "a7f6e410-ca1f-4822-b85f-8edf4fe17231", "comment": "Malware payload", "value": "070e84b87e6cb834bcc8ecc7489fbb143433b8c4409d0f603ba00f1ad748616c3a4db07c0898ea09429155938758f884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172123, "uuid": "5b34cf54-e14d-45c4-b021-f64ae024cb51", "value": "T13F7633187EC0CD3ACA82343059921BE0F1B185E49BB65D273791449B7A7F01ED4BB7AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172123, "uuid": "c6442d3e-d879-45e6-a379-f2ba1d6afdda", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172123, "uuid": "6b61a0db-87c6-4d49-be7e-5c79c60c583c", "value": "196608:91OazXuuTToDg3coziJEba3LOLE+Qfoizbakrscgtk/VR314:3OC+uIDXo+JEaiE+Qgiy7cgCtR3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664172123, "uuid": "25d6a933-5e88-4635-98b1-475278f78555", "value": 7637644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664172123, "uuid": "67a8f46a-b28c-4b11-bfa0-d5b2bde21870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172123, "uuid": "9a6f6e3d-bf66-4348-9ec2-42d93d0000d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c16fc9-3d51-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664165539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165539, "uuid": "bac10e31-7cd5-48d6-bfa9-024724fb5856", "comment": "Malware payload (Stop)", "value": "c9f5f8c6f23456bbba7900e655f08769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165539, "uuid": "81a8ada4-ed27-45be-beb7-798fa21c7139", "comment": "Malware payload (Stop)", "value": "629c60bf855f5e2384d757e1b15457c7ffedea3bb9d5f118f96f9d88f7eee29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165539, "uuid": "27099be6-22de-41b4-be71-630359306736", "comment": "Malware payload (Stop)", "value": "f82a7d374e5fd0649c871f274ba6ad8fa99ec666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165539, "uuid": "887999d4-31d2-4a0b-8c58-cd248488d128", "comment": "Malware payload (Stop)", "value": "6d41d274b01766767c1e5ae7579a7fb351fb5675fcced1ce0eea46fe0ca54f1f3c16dcc346ce8e8b8a264ef3650a3e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165539, "uuid": "51a59833-f085-4c4a-aa65-000d4915ef9f", "value": "T108E423652B30F5B7C050B6B2613A4BB057BE3412923645973F9CAE2EED301D66B76323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165539, "uuid": "a7a21347-8aba-49ee-a7ab-67fdadd297c8", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165539, "uuid": "d4e30808-a986-4bf6-99bc-da71533ac93c", "value": "12288:AV0uUzy2ZhsIEWc4Z0nJvjM9Rr6phWbS5FYSiTTnIWweYp6:AS82vsIEW50Jv9jWW5JSjIRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165539, "uuid": "06f9a5e9-8b30-45d5-96d6-c6f9631cc819", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165539, "uuid": "fdd3c751-9ac9-40d9-bdf9-2d4f0d4513d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165539, "uuid": "c2636191-24f1-4fbd-b7df-3f9733d36eb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dde65c-3db8-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664209950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209950, "uuid": "a060b137-7b7d-4c05-8433-137de6b701c5", "comment": "Malware payload (AgentTesla)", "value": "1846bed6b4a27865822437c0f238b7fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209950, "uuid": "6ee3fb39-79a7-439a-b46a-eca39844fda4", "comment": "Malware payload (AgentTesla)", "value": "6307dace542414e5746003c6a25b46f51fde18a174c1400f44556debe1c4ab38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209950, "uuid": "cb0eb244-90ca-49ed-8a71-be31b1b5619f", "comment": "Malware payload (AgentTesla)", "value": "faea12892d64e407a0e38559a8c8e9f1038284ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209950, "uuid": "874ffb4b-f757-4f92-bdd0-4ae23d7771c7", "comment": "Malware payload (AgentTesla)", "value": "c25d8c7dce1b0166965e718f9a6616c5c51ee3a816af1fd9e795a04bf139a1590f593824c3cf8128ee73e00ba73a3723", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209950, "uuid": "2e5640c7-808e-470b-8416-58d3342fd6b4", "value": "T11C052A2425EB521CF4BA9BF91FD4B8F64D9BFA71252AB0FA24A163464733E00CDE1135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209950, "uuid": "15548a84-a6fc-4081-af84-2aab9aecbeb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209950, "uuid": "c2cac186-81a6-4d15-aa4b-220fe0d76cff", "value": "12288:KlMexIfblXVvVhFiTSDGfr+b+RJZ1ADqjJ5n:9fbXXDGk0ljr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209950, "uuid": "9f546d4e-89d0-4c93-ad64-81ad3dc69320", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209950, "uuid": "68559530-cd14-47e4-aa0f-4cfeb95506ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209950, "uuid": "f7f09be3-7152-419f-b28a-23ecc6aefdcb", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcdf67e-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664213841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213841, "uuid": "4c481e04-4c6b-4723-985c-0d6a24956363", "comment": "Malware payload (RedLineStealer)", "value": "ca6055c7536412989c9f08e41586b0e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213841, "uuid": "6d88652b-1128-4e3a-a2d1-2f208b8ff524", "comment": "Malware payload (RedLineStealer)", "value": "6336b9fbb76277167facddac816655d079a8604f7273b2bb8dad169d1723c793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213841, "uuid": "1f95736e-4777-49fb-a5a5-c94d99e234cd", "comment": "Malware payload (RedLineStealer)", "value": "2bfa09b4126abffdbbc1648eb624f523e8069839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213841, "uuid": "d7a7654e-fd9d-4afa-bb94-f491e27e5654", "comment": "Malware payload (RedLineStealer)", "value": "cb2a43a3a2b6da4f01c58b97e4db9ec57241dd48d4fc6c2e197d81b1c9432d2e1b40bce793cf7e6c6de2564b38ff9e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213841, "uuid": "feada0e6-0847-475d-af1b-c3ec5c938c8c", "value": "T11ED3F12278A4D0B3C563857C1864D781B97BF8215E768A4B3B0A275F1F327D26F3631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213841, "uuid": "b2e50ac6-a89f-4cf8-8e6c-f3b790c536dc", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213841, "uuid": "21a4d63b-fb42-421c-be82-d13fc6a1c04b", "value": "1536:X/SmjYuHqP45Tc5/KjCKwtylzDYEuCN7QhDSKzyXWiZfOEQVr/R19Ow5B:X6mjfTc5KCK4ykz1zymi0EUr/R195B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213841, "uuid": "40cc1ad5-5fbb-44d0-a1ff-9ca220e9f57a", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213841, "uuid": "b7e3ad62-8b66-4f74-b149-11db29c538ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213841, "uuid": "c48f0d23-9a4b-4daf-9638-e828d6d8f86d", "value": "ca6055c7536412989c9f08e41586b0e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b883946-3daf-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664205888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205888, "uuid": "39046013-2e6a-4b9a-a5e5-9b8855e8e79e", "comment": "Malware payload (Quakbot)", "value": "6d0d7e50918d6e7a30340223ed87292b", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205888, "uuid": "41a28541-baa9-4266-af5a-4e0dc4f5e863", "comment": "Malware payload (Quakbot)", "value": "63ade90920f3c771336089bd7fe255a76d81781c761347e8016d81eadd5ae687", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205888, "uuid": "d5017fa3-7e52-477e-b9e3-11212a9c9d1e", "comment": "Malware payload (Quakbot)", "value": "07f07d651bc22033ce453e7375d0dc4e78287861", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205888, "uuid": "752014fa-be51-4a64-acb7-b74f8668a655", "comment": "Malware payload (Quakbot)", "value": "0f2ffeb30991218383d8972eadc7fdb96210a9c69f1b80a8c2791748a5af1108dab49a7ed0dc5b2e19ec47f414a2bc88", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205888, "uuid": "ee5affd8-5e34-4936-add4-98734f8c7c6e", "value": "T1C8458D32F2914473C1732A39AD3BA7659D3ABE112E3869463FE81D4C4F396813D253A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205888, "uuid": "7bd21075-498f-42c8-986d-677cdfb5e4d6", "value": "24576:zVeK7bHY/DS6wku4EmQKyMeRP7IYqsS/HdcoO9u+5w9M4aQvcd:zZjMpn6oOScd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205888, "uuid": "0e950a89-06a8-40f4-8472-3dd485ebf848", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205888, "uuid": "37eaf4d7-8533-4d00-a35a-633f9c7dcc52", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205888, "uuid": "aaea8824-94d0-4ac9-b419-277d2e0f896f", "value": "Art#4224.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401300e0-3d9e-11ed-9266-42010a9c0072", "comment": "Malware payload (Neshta)", "timestamp": 1664198540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198540, "uuid": "cfb2fc28-d9a0-40cb-a0b9-460bff0dc549", "comment": "Malware payload (Neshta)", "value": "5bcba285a1afa444aa0cece39c88c178", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198540, "uuid": "5e17c100-3912-4da2-96fa-a3beedea0eca", "comment": "Malware payload (Neshta)", "value": "647a6859da705b75801e74fdbb713c7f219b7b024bd0a08681003225bbb31cf8", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198540, "uuid": "c308414e-3f68-427f-98c8-3caa02e22bcd", "comment": "Malware payload (Neshta)", "value": "185aad09818fdfa0dbc7b3cab55cac0ec2628535", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198540, "uuid": "b2dbc82b-54c5-432c-85bb-916b0818b90b", "comment": "Malware payload (Neshta)", "value": "63466d82fa96ac4a172ca75664936bc8e5077df1292b0a5e066c79d47834af2f324e225725deb6fae307e67440c13379", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198540, "uuid": "4ba828e7-6d4d-4d23-a2fd-b8766978a317", "value": "T15E6423D6EA191CB0654EC757389F239A3C64AFE1602388FF327B15BD43429D4922CA77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198540, "uuid": "938bd540-ac4d-429e-8c7b-835ddb4e146b", "value": "6144:v3uZgf060ydrLnzPU1dUxL2U8v3l0nQx5TN8ECvRkmL0SnDSnXpyDCt44AICc:GIbdnzU7Udf8sQx5lC5kUyZ7JAICc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198540, "uuid": "b3108ccd-91de-4c5c-88e3-dd22e54f4e08", "value": 323181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198540, "uuid": "4f36b594-69f9-4d80-8007-d78afcf31838", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198540, "uuid": "be856386-10c6-4c8a-8bf2-4e1c44d6b66a", "value": "payment-#9000000.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c499359b-3da1-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664200051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200051, "uuid": "f1971b4f-3296-406b-9de4-9ae7fce71225", "comment": "Malware payload (Gozi)", "value": "242be217a52e1938ea66724e82aad094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200051, "uuid": "5db54938-4ab2-497a-8cf0-410a8edab58f", "comment": "Malware payload (Gozi)", "value": "64a12c3edb0332baaefcb370a775bf933d44603472a55070e9f43e03a4b2e56a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200051, "uuid": "20b8ea02-c788-4f7d-8aab-461b3b9089b7", "comment": "Malware payload (Gozi)", "value": "2d92996757cccfe13da908219d3cf274f7c38432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200051, "uuid": "37ebe379-75a2-4262-98ba-d942244e0a99", "comment": "Malware payload (Gozi)", "value": "0f404af3427b3a3154cfea40a1b0abd470bfa201e8ce5b3d4f58bf9caf9427231fa7721d64e3a013c6b73ad117b942d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200051, "uuid": "404e6ec8-630c-45c3-8bd7-43a803bd5280", "value": "T183345D5AA3E50995ED6BD5B6C953D227EBF334092B64D30F53B0CAA66F17322B21C301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200051, "uuid": "5925a12e-2a36-4010-817a-6c167f54f25c", "value": "3072:dlfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqAPw5VgCK5hcjwcxJFoc:dlDosEPR66q9KgylInd6oqAPD54nFoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200051, "uuid": "d8c3ef44-9359-453f-8228-adff9bf0f791", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200051, "uuid": "3a97d913-f483-4b04-a9b7-e49f6c079382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200051, "uuid": "3576b640-44ec-4c9c-8cd7-8b2a2b63f4b6", "value": "9880000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9679ae26-3d46-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664160889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160889, "uuid": "84d8c287-da29-49a9-82b5-cec76f12729b", "comment": "Malware payload (GuLoader)", "value": "e31a8283093c7f499b8187f16a41a7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160889, "uuid": "495edeeb-f140-4d6a-8ea6-0d6d778304c7", "comment": "Malware payload (GuLoader)", "value": "65a08bcf5f98500a3870786cbd0688e6dc5317b440648d10cfe8a80189f26198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160889, "uuid": "d3ec455b-62ce-4531-b1fb-3a9ace67da64", "comment": "Malware payload (GuLoader)", "value": "0622aac21de20911ddda50f974092ebdd9409736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160889, "uuid": "5cd9584b-3379-46fe-9702-1001531baab3", "comment": "Malware payload (GuLoader)", "value": "d479222e1028a2d8e5c7b8967ec01029ea884662a6395f4d755eed2d103b685351bc8f55b46ab887316d706cddcc17b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160889, "uuid": "ee667c67-7136-44d8-8696-d2125492e0c1", "value": "T1F253C0106220C077D4B24772193A677B9FFA952562749F0B07602E5D7CB36C2EA1FBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160889, "uuid": "3a8ef655-24fe-4838-b51d-ca282c967942", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160889, "uuid": "131d99c0-bba8-4ec9-bdec-cfe0e25bf5bd", "value": "1536:N/T2X/jN2vxZz0DTHUpourbP/LxE+1EFI+PlD:NbG7N2kDTHUpourbLPdWlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664160889, "uuid": "e55bc0fc-8ded-4a38-ab7d-76d30e0a3e51", "value": 63157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664160889, "uuid": "7d95480e-64b8-4380-9992-256b7afd4b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160889, "uuid": "15d10615-923a-4058-8cf4-709d3341f506", "value": "65a08bcf5f98500a3870786cbd0688e6dc5317b440648d10cfe8a80189f26198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c916b0-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174416, "uuid": "52d96e4d-5734-45b9-8b5b-2fa2463cb8db", "comment": "Malware payload (SnakeKeylogger)", "value": "16b097f9953854b7f1c0c046ec34d366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174416, "uuid": "e2a83d63-5246-46b8-b5db-e8f31ada5880", "comment": "Malware payload (SnakeKeylogger)", "value": "6657fc401ddcb3ffdbe0d45b7850f9a2bccef46d42469b825cd890557a351693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174416, "uuid": "ceb260da-de6d-4616-9fd7-d4a1c46f3358", "comment": "Malware payload (SnakeKeylogger)", "value": "1cd3ff8497afb31a9ba5280ef0d8d939689ea597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174416, "uuid": "c17b1d67-eeb0-4193-8991-6c3aa14fb07c", "comment": "Malware payload (SnakeKeylogger)", "value": "26fd9989660cd452a69d820ebd7744cc3ab0ae1264167e2ee1b325b51e7dab64a5f0001d9b9c5de64cbf1a4f0e23e31f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174416, "uuid": "ed9e9cc4-c353-42ea-8b2e-60af5971986e", "value": "T1BD246A0B5B60BC97D3E177FBD8D6E67461243294FC024784B8B41AB7F9E3A892D022D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174416, "uuid": "1d912199-09d5-4fd8-a06b-6ac353ac1caa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174416, "uuid": "2c71b36f-a9f8-4ff2-b2d8-2a922c4e4060", "value": "1536:FOW5VXt2AfixzZ/widSImSU969OSuzrX:FOAQw09qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174416, "uuid": "b5bdee1f-5ca5-4d1c-a5a3-74e5a979b360", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174416, "uuid": "c87e8dea-bd1e-4fe5-8eac-532e66c33014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174416, "uuid": "9d01a750-8e60-4eae-9ff8-d41c8d079da7", "value": "Product List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cbfef9-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1664200838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200838, "uuid": "e6f53dc2-b1af-493b-b4e7-e4f00697d4a6", "comment": "Malware payload (DCRat)", "value": "b3dfa7af47703e6d730b8055a59355f7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200838, "uuid": "96655811-336b-435c-a326-44958ce86b90", "comment": "Malware payload (DCRat)", "value": "66cc00efebb6934149a52d1ea39971ee9bcff170f27c900f893258f45e8e9d8b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200838, "uuid": "d3fe3936-b44d-4741-a2d8-60ea2b892626", "comment": "Malware payload (DCRat)", "value": "d5b72586d7f9e75a2b33d9ba40068f089664da7e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200838, "uuid": "5afe3bef-e643-440a-9ae7-22f6ce926011", "comment": "Malware payload (DCRat)", "value": "ea882bb8aef0323725b5bb8eb1025398ea71e2704c21a478d21469318f6f6062c09116e84221ce6e06f3eb893f44de20", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200838, "uuid": "c25ceca9-a6cb-4cbf-9ec2-29b6a15b7c00", "value": "T1FFF486342EEA1029F177AF7D8AE47596DA6EB6A33707995D00B103C60723B42DDD063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200838, "uuid": "f3b9767f-a19f-4970-a737-843cfc80b3cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200838, "uuid": "836fd57b-3750-4f14-8547-da468e189c62", "value": "12288:B2NE5gtfty4zQzbc971saPR3OfYGoPqLo1/GorwRR1kZpn8zL3OA0By+rsUAuNmf:B2NNnQ/e71sa5dp1nyzL3OxrNaQQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200838, "uuid": "85f913b0-f20e-4166-972e-ec1718d62b90", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200838, "uuid": "729e3838-f525-4cba-8967-7dfa7edb11e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200838, "uuid": "ba359a91-7286-456e-bc2c-62b43e990872", "value": "66CC00EFEBB6934149A52D1EA39971EE9BCFF170F27C9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49977183-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180517, "uuid": "c8ddff22-8279-4e18-90b6-971d883d112a", "comment": "Malware payload (GuLoader)", "value": "8f8f6e61fe1daba3f589b2919b48abdd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180517, "uuid": "84ee26c8-e47b-4d6b-beb2-1e5caac6ce1e", "comment": "Malware payload (GuLoader)", "value": "678c8bcce472038cf212b33d065fc6333a2287bbfe1d0ef3e8fbd0d0b89a8234", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180517, "uuid": "88a3d748-3d1b-4cdd-8222-ad72da384228", "comment": "Malware payload (GuLoader)", "value": "71fdfea124bb7aaecf15f3ae01147fe67fdf52c0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180517, "uuid": "1ce70b91-1254-49ad-84df-238ae2c6597e", "comment": "Malware payload (GuLoader)", "value": "8be301c2eb350e73bc7f3a166b25e13a889f45deccd828fe1a1cb3064710fc0aa7992e6ed8eac2a11456023c21f359ef", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180517, "uuid": "dbbabf5e-b136-4a2c-950c-e1ed83c600c8", "value": "T1F404B42D4B31FCE03B9E75E9CE100B6D8458A94297B10A2AF51C1DBEE794301B7856FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180517, "uuid": "3488c872-3822-4863-accd-7e3888ff7bd4", "value": "3072:FwUoHZkckYujIDZde8MfwMR0Mb94wTaiFnQOevM8K4Ec5Cy3:FuZk9YujCZwLBR0MKwuiFnhe3Ecwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180517, "uuid": "bf5f31a5-7e69-4f4c-98fe-c9a6ba9cfa81", "value": 190183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180517, "uuid": "c13c4d31-cfcb-48f1-9a83-b41968a3db22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180517, "uuid": "34af03de-40fb-49e4-a52b-782b9c1e1415", "value": "NED.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59520911-3d4a-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664162505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162505, "uuid": "2d80534b-02fd-424a-b6bb-4cb6a856989d", "comment": "Malware payload (Smoke Loader)", "value": "209b953e713a0f791bbc31d401816f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162505, "uuid": "9c63a032-65c8-43a8-b100-a6eeb12c1e82", "comment": "Malware payload (Smoke Loader)", "value": "67fe5fc763ffce2a345e0bcc1e8af1aae50b9de19f623355582ed64f979b0aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162505, "uuid": "7242933a-da46-4323-a440-f0c490d95602", "comment": "Malware payload (Smoke Loader)", "value": "784761e66a054dea8e77e5beaa5b76247477256f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162505, "uuid": "bdbfc88b-7b6a-4342-bbc1-1d2b15a07d68", "comment": "Malware payload (Smoke Loader)", "value": "b2542d56cae9b6900aefaf67ddd8bd5e5a872ed111dfe6e7daa83883e2c98c3bcbd147953235f3cb68bf5db194bf6ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162505, "uuid": "81e7868f-35cc-46e5-a04e-76bb8570be79", "value": "T1B204E1027580D972C5559AB09478DBA16E7FB9214036178B3B9C2EBF6F313D217B338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162505, "uuid": "df661cef-d51a-40e1-a1e7-676004e88951", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162505, "uuid": "87d3fc98-0cdc-42f6-884e-958382a682f8", "value": "3072:OlRSGTUZuh35ZNVpfaK5FFrcQurg+qBFPRpyK15x:vKZuvwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664162505, "uuid": "757fb7bc-b830-4357-9901-68fadae0c573", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664162505, "uuid": "d4a02ead-6c33-445d-a778-3e9fc10b7d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162505, "uuid": "61735b35-7505-4a02-a2f8-94897c02382b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17eabf3b-3d45-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664160248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160248, "uuid": "98ad61e7-0e07-48ac-8c0f-1793570c87a8", "comment": "Malware payload (GCleaner)", "value": "5738eeab4dc44f85629aca4c6236f702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160248, "uuid": "59fcc559-8189-4923-8557-2eec7546ac4a", "comment": "Malware payload (GCleaner)", "value": "6845fad8a7b8a7abb86a3f788352c5e856f8863ac3c40f8bc22a112d363c998b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160248, "uuid": "27185bc2-3ad7-4b97-a2a5-51ed44788058", "comment": "Malware payload (GCleaner)", "value": "b28e072363e63c0047094e8c5d690e064f69abff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160248, "uuid": "8b41569c-9ace-4192-b19a-f2a3ceb07a2f", "comment": "Malware payload (GCleaner)", "value": "2c802e69fd4118f303fd465a11d9af91549b60acbc22acc3c8618b08acdcd88641b57836670f5302af82fbcadb9d0ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160248, "uuid": "28fb0b8e-faec-42fc-980a-70679891c3e8", "value": "T1D244F2623D909432C8AE7271D8B2CFE115BEA85105155243BBB87E7FBF326D12A703D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160248, "uuid": "ba006215-d6fc-4fb2-a427-66c19aafaeba", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160248, "uuid": "f9f8df48-ff7d-441a-93b7-00715f625774", "value": "3072:8nxUsW0naKr35qqKmw93Dk6v86KEXY9/BTaAIbvbdDuPmEPIkAVypQ10O8CFBKcf:GCjVf3jTK9/ELbdDIfWypQ10O8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664160248, "uuid": "8bd55031-fec4-490e-a1e8-2f4035a6e156", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664160248, "uuid": "67266ba2-9484-45f3-b8bc-62679b84386e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160248, "uuid": "4a3a8d0f-3f36-4549-b60a-cb2a79cb0e8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfe62e4-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1664180337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180337, "uuid": "5d6f95f4-125b-4191-8f19-ed5b570e4d6e", "comment": "Malware payload (NetWire)", "value": "4b7e91a5f07bfa63ebfbdc143210cc9e", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180337, "uuid": "b9bb4d9f-fb36-4a3c-a750-a608387312a5", "comment": "Malware payload (NetWire)", "value": "69230008ebd4db702b501b5d35d6c5551ae5d1cc779d0bbcf4526f606f332650", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180337, "uuid": "0970236a-de35-4d5e-8c1b-6a3d55a5330a", "comment": "Malware payload (NetWire)", "value": "169d96a1b25a369dd0ae99ac6f03c817cb9ff929", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180337, "uuid": "b8f0ee18-6ff4-4e56-ba1a-eef70f3a8c26", "comment": "Malware payload (NetWire)", "value": "b0436ddb1f5ddf66cb658edd051318f267d6b01d43cfc0506083553351d0fb46ef0fac19484e344893bb9f90b01d72e7", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180337, "uuid": "f866a9c5-b442-43a7-a635-1a66c939de07", "value": "T1E8B3D503AD448587E41843B9BC934EED2E19BE08ED5726FF30617FDA3E742528D5B12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180337, "uuid": "50386b00-0d9b-4e8e-b16e-76276eb755e5", "value": "3072:B9xEtjPOtioVjDGUU1qfDlaGGx+cL2QnAB9pWkmanzr0O8yFKdshErls4:XxEtjPOtioVjDGUU1qfDlavx+W2QnABU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180337, "uuid": "e5409a6d-4c4e-4955-8cea-2279975c40ad", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180337, "uuid": "8225eb5a-f2a9-4798-85eb-e618ea89634b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180337, "uuid": "2e17ea95-c082-4b89-a6aa-eaf9ffa52d2b", "value": "PO 0767532.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee0f066-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (a310Logger)", "timestamp": 1664180875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180875, "uuid": "344ddcfe-1c99-4a80-b2a0-b7dc35220acb", "comment": "Malware payload (a310Logger)", "value": "0af7850f647950d74ce157720aad4c60", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180875, "uuid": "351eaf7b-4dba-4ace-8ab1-754d7afcc682", "comment": "Malware payload (a310Logger)", "value": "693799febee756dc6a824254f8f1f63be3dbda75fdb8153ac63988f0c575706c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180875, "uuid": "d5df6131-d62a-4c61-a222-92a6ff2d0504", "comment": "Malware payload (a310Logger)", "value": "3c0b62623280ab432fe076a5418374e5d92f1b14", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180875, "uuid": "8938a8f9-662b-4c5c-8a3f-c12905827707", "comment": "Malware payload (a310Logger)", "value": "71d8fe3b30cb140896c2f8b724c7e51095f49c74dd85d95ae9debddb14bb5109e498020075ebb9422323a4fbd1279ae0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180875, "uuid": "1c724b38-696a-433d-b651-a3a30f3994e9", "value": "T1BC3501271BEA8B0BC011B578C1E1C2F1A7A9DD01E53BC6C76BCAAD1FF08A465DB61350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180875, "uuid": "9dc233b5-4b91-4538-a33b-bc29ea50b31d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180875, "uuid": "68b78af5-8cc9-44ee-b22c-c3d278628bcc", "value": "12288:lNgdDUrAY+iEcEgxOWQ47eD3fuHNPP7ePpU2eA7Hmbke3Be6hy781ukdxw3XfUl7:T8QEY+6VhbeCVcfm3Re3iuY6vUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180875, "uuid": "b48b6a8e-eb75-4137-859e-6b2ded3667ed", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180875, "uuid": "0c5062d8-5234-4ef7-9fcf-b8020a3c2a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180875, "uuid": "39d55095-9c36-41ea-8818-2fd4636ba59f", "value": "Hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4a02af-3d99-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664196599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196599, "uuid": "eb6d141f-1d15-4d7d-92cf-6d58133d4717", "comment": "Malware payload (Smoke Loader)", "value": "66d15b4524f745c711842ffa20439a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196599, "uuid": "6c81dc05-9f2c-4ca8-98f9-5784867f5671", "comment": "Malware payload (Smoke Loader)", "value": "6986084e3e88147d93a49889f97ce99557c37fc8535e1f14204f5253e17a2db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196599, "uuid": "02e54fe8-7a3b-4cee-ab35-fff386f9839e", "comment": "Malware payload (Smoke Loader)", "value": "1282372d06a87763207e0062547d71a40d65da46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196599, "uuid": "598f9567-a118-4d60-9f9d-f6bba8bcc71d", "comment": "Malware payload (Smoke Loader)", "value": "73e5a2c1705c6708c184f5454fc47793f9395806ba33d9304fb89b2578ef7a63d5b4886b24b1cf33a413965ad7f61251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196599, "uuid": "f84cb4c3-ec82-4902-96a6-ff7d203f50e2", "value": "T14EE3E1417690ECB2D41591F0A814C6E2A93FB9211A324D4777486FBF7F313C2AB7A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196599, "uuid": "68e622fc-acb5-4654-a305-ad49c878c007", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196599, "uuid": "80d49f43-04a6-407b-ad2b-82fc1f86c9d6", "value": "3072:A8zTF52Oc2++qvSqAXa4b2XzlLE1BazjY1l5Ydn5B:22++plaU2j9EyzsT5Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196599, "uuid": "f3d85260-feeb-4e24-9690-8b81cf054536", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196599, "uuid": "c6d79841-b1aa-4a42-a28c-34bd708ebc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196599, "uuid": "3b1bc95f-b149-4b1e-af56-59aa56e3bca9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e8e883-3d3f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664157691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157691, "uuid": "81febb03-9d9e-49ac-8ff8-0fdb083e32db", "comment": "Malware payload", "value": "a82f607d60d6c73e688adcee6924b391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157691, "uuid": "502746d1-29e8-42a8-abf8-9478d603be49", "comment": "Malware payload", "value": "69dd5e0ff166b54e18128b90d2c55194995ef43bf8b30554eb25e43c50725bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157691, "uuid": "8b9708ce-cb85-4ce9-b9dc-b6e198f8ed8a", "comment": "Malware payload", "value": "b3864cb110bec5fb33eb40d1bd0db8a9e4c96889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157691, "uuid": "ff071f58-47b6-4b4f-9ae3-88f56a5ef20d", "comment": "Malware payload", "value": "a2eca4266186d30b603ac5a93a95be20252f80fe1a9552bd462395845981a7049b7a15f750906dae41695e1e16017955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157691, "uuid": "ad62f2b9-a165-4e57-b397-a6c9be38aec0", "value": "T1717633193A53C4F8E3286D70D5696BA1FB34E8A817D9052B27CD0AAD193DADC470BF34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157691, "uuid": "4a1ebf96-d0cd-47cd-91e4-b7f42176e8b2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157691, "uuid": "008a2382-aefa-4d67-ab5e-ee0358536aba", "value": "196608:91OwPlWg6VnJzdg3C5Fsm7pGCEGm/3jiXaZCE:3OsnUJRgy5umEz3maH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664157691, "uuid": "9fd8f856-df25-4e94-8172-e61efb372d08", "value": 7586896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664157691, "uuid": "d4f0999d-b402-4ee1-b3fd-785da453e93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157691, "uuid": "294796d7-69ea-46cc-b639-a1be2b6ab3ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b494a743-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664173825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173825, "uuid": "aa80adf8-1328-4437-bc0d-c6a3a652e202", "comment": "Malware payload (RecordBreaker)", "value": "fe0c99fa7c65f818e29f3fcafb85b521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173825, "uuid": "40a81f55-138a-47c4-acb3-ea0c3ccc00aa", "comment": "Malware payload (RecordBreaker)", "value": "69eac55ff687843f9d856e7facdef36d1c53faa5df6ff3eab874a1426a5efcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173825, "uuid": "8fdbce58-00cb-419b-bd1e-a183a0e29256", "comment": "Malware payload (RecordBreaker)", "value": "c805356b0bbd898844256734cc3dcd9907f64148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173825, "uuid": "ec60764d-8939-4f39-ada1-84f350f726b9", "comment": "Malware payload (RecordBreaker)", "value": "61d5b16382a6bda6aad7196492bd3692c8b3afa02df027fd903fae3653a4e6a496cde7a6a8dc4ec631c2b49e616bf1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173825, "uuid": "b8c733ed-b289-477c-af1a-c50513346ac1", "value": "T117750115F00B92C2D992CD71EDDAEB316673EDD6382408A7DB995B3EED32E41609700B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173825, "uuid": "f85b8ead-9eca-437c-ab5a-e4f070b90591", "value": "96b43ae5ec1db67e8f009f90ecb1df30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173825, "uuid": "eaccb5b7-dc4f-497f-8c0f-49a9a28a148b", "value": "24576:vwZXuV+v7ClPtyhc+j0Fsa+IjRGbxsmhNgFFxkOiYdjNwR63d4MEu4Vm4ABwG/xe:vw9uVa7KVscg0FL9RGiMA443d4MEuXwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173825, "uuid": "65706a79-38bc-4b48-87e9-6998a66b3512", "value": 1551504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173825, "uuid": "0ea9582a-0f3d-416d-b28e-303f28a8127c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173825, "uuid": "878491a5-db7c-4ae3-a49c-f85c7152e8f1", "value": "library_3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed77dd1c-3d46-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664161035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161035, "uuid": "651c27e0-981c-45d2-9e77-814040c0f5d3", "comment": "Malware payload (GuLoader)", "value": "88bf314b864cedc9e2db582be2a8b71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161035, "uuid": "ffdf17b5-3422-4145-a4f1-3732dc2fe5d1", "comment": "Malware payload (GuLoader)", "value": "6a81126ba167c1cf8b57700e9b78757534168bdfb78cc5ffd1d6c8c6aae5cf7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161035, "uuid": "a3908b37-cb7e-4a13-b9d8-36ed387d9103", "comment": "Malware payload (GuLoader)", "value": "872ed39c18744a78ed60a04fc195506c4531fb3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161035, "uuid": "2517a0fd-76f6-41ce-b8b1-03fefbd5cde9", "comment": "Malware payload (GuLoader)", "value": "8a07552c0c98be8d82fa69dd04ae9eab4108b097cedc720e32ccb0bf477661588704810286e69503507148b88f469e71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161035, "uuid": "01d4f5a0-a6d8-482b-8227-3be3c0c87b8f", "value": "T1A174E033B780D217C5A26775A976E7B24BE55F142A218B072384FF6F3E326C31908AD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161035, "uuid": "d254f71d-1b38-4a7e-950a-090b4be85321", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161035, "uuid": "8f21a9d3-8c7b-44df-9940-2f780527dd45", "value": "6144:bqaFH+9CXWSqu3L1cosfvw9zOgz7aKaz+h3bzcrdqxgs:t5SSdL1YfveLzWKzRgrdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664161035, "uuid": "c1ec8869-5e82-4661-82f1-f77fa8fcbfe2", "value": 342992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664161035, "uuid": "9edc0748-f785-4e94-ab71-4619d929800d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161035, "uuid": "96bfaf1c-e1a6-4b4a-a10b-11e4c4884af2", "value": "\u041f\u043b\u0430\u0449\u0430\u043d\u0435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1369e52-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664173927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173927, "uuid": "9dfad2a4-a18a-4d8d-8ad2-5961e51a0081", "comment": "Malware payload (Smoke Loader)", "value": "3113faecbbc234671940bc97bf181dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173927, "uuid": "0efb24a7-fe41-408b-829a-6675f7281230", "comment": "Malware payload (Smoke Loader)", "value": "6a8edb56c715802281bed8c0c3e4b7b011b9a771539546db2f70124a76cb293b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173927, "uuid": "d819c142-97da-4006-98e9-f3acb30244ed", "comment": "Malware payload (Smoke Loader)", "value": "fc100032fa9768918b2567bab5a1482886ffbe5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173927, "uuid": "2657270e-5db1-48a5-8d26-7643a6c6fe6e", "comment": "Malware payload (Smoke Loader)", "value": "c94ebb6e71cc20392fb4cb5514cdd8ba8c2e251c5a7fcbd3058087afe4a4eb8d1d8b6fcbf296ee22adc7de1be29ff978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173927, "uuid": "1ed0d01a-f865-4d36-8df3-69e386c6349a", "value": "T1DBE3E0007B44DA73C41559340835D6E1AB7B7C229A726A877F882F9F7FB13C266B9312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173927, "uuid": "f876adf3-b920-4643-9283-cd92d93bf076", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173927, "uuid": "f5b5867d-af84-4133-85b0-4a99edf76225", "value": "3072:LBijG5QhFHe4XVa0i7VmEQZUJ4cBu+CTh5x:OdeGA/7UlZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173927, "uuid": "ef10067e-f032-42fd-abce-0392b7b610b1", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173927, "uuid": "8762b40a-d7c8-406e-9d96-4b9da32bdc6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173927, "uuid": "f8fcbeba-1964-4b00-ad20-6ccc18b11b1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd09e5f-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180471, "uuid": "ba6d2e7b-3191-4c71-9716-19a89d528eeb", "comment": "Malware payload (GuLoader)", "value": "ee1fc318a9c80c107706d0998289b8cc", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180471, "uuid": "23086cbb-a102-474a-b25a-cbc737e094ed", "comment": "Malware payload (GuLoader)", "value": "6ba42cf9b826414d41aa7c9f4af3991c1f43de50390a94051c46af642d72c49c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180471, "uuid": "59be11e8-7ad3-4a11-bd4d-ddf10c554d10", "comment": "Malware payload (GuLoader)", "value": "3a03032a4d739aac6cf35f219d921ec65c49ece4", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180471, "uuid": "d965bb9d-6e87-4630-847a-684e89431a92", "comment": "Malware payload (GuLoader)", "value": "0f30bcee382c4f4810e5ef20c7a75d5026edd92c612858c14c321326abd310f3c4eaeec6c2add10a9a3adc0b22a89879", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180471, "uuid": "067445f8-2328-46f8-b876-65640fdd0ee7", "value": "T16F147364797BDAEB775DB228C0074E4BA4F88152C331051DF75430ADAAE8B04BF199EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180471, "uuid": "9009f1db-02cf-48ed-a235-b05a8c0ba51d", "value": "3072:F3YF/18ykx5sTfzeExrLRGJH/ag2J9zdXIQevM8K4Ec5CfVI:F3Y9iVxmLxPg49zdXHe3EcwtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180471, "uuid": "68d16ef3-80e7-4fbb-b10c-eb6421cfd457", "value": 194745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180471, "uuid": "47b318ff-76fc-47c9-9fe2-9f5d8d97c1eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180471, "uuid": "408cb35d-a277-4c4c-a39d-b410be417803", "value": "195727592-042128-sanlccjavap0033.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7595e9-3dab-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664204359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204359, "uuid": "ad61eda1-7ad9-4882-b343-38945fb7b32f", "comment": "Malware payload (Formbook)", "value": "d6c7dc86f619cec833b7d803eda6fe5e", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gh0n", "colour": "#40CDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204359, "uuid": "d28d103a-3777-4335-9774-6b77c98dc0eb", "comment": "Malware payload (Formbook)", "value": "6bc791d983257b76515c375b150c5dcd130a1913c36e5efb206114f4366ab33b", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gh0n", "colour": "#40CDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204359, "uuid": "8a221e4d-71a1-4c12-9ba8-826ec5c490f9", "comment": "Malware payload (Formbook)", "value": "5d6b0247ec02300a84733b2fa0e0371669ca3b1d", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gh0n", "colour": "#40CDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204359, "uuid": "a03ba511-cefc-4ad2-a8bc-d683d7532c2c", "comment": "Malware payload (Formbook)", "value": "d6019d68f6a35f8bf04720b3ed4a6f0563e9872a4bedf7656f8a7b7750f3b93c112e9794a02ff75c2b136e80612d34c3", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gh0n", "colour": "#40CDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204359, "uuid": "522bc1dc-e6ee-4249-9e12-5d3080009f88", "value": "T1094423E802CDBAAAB170699711D364E7FB9297216D68D8E238CC1826F0F137D7D1C719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204359, "uuid": "00e9a23c-5db3-4232-8ca0-90d979d9c718", "value": "6144:HJV8YbYmF73WlWxHnb9XhjlqrJQ1GEQtErm2c7EamnBdwWcx6aKVo3Ivm:33g8b9XJSJQ4ErxL124m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204359, "uuid": "15a08d93-4d30-431f-b480-4397351524e1", "value": 261910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204359, "uuid": "074bd172-4a64-45f6-be85-51a132fd8c1d", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204359, "uuid": "9c2f2b4a-7c4a-4e52-ad15-38849f6be7aa", "value": "Image.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca248220-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215093, "uuid": "9b7a5f86-d9c3-4917-b34b-4183944d4886", "comment": "Malware payload (IcedID)", "value": "d7ea47bbb034c9490a465863e8bb4b04", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215093, "uuid": "fa2075fc-012b-4a7b-9e6c-f7e06a1cd888", "comment": "Malware payload (IcedID)", "value": "6cf4b6897928f8630040e5cb5db66fc6b979be1d3b8849986db9f0ac5bef1b84", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215093, "uuid": "879fbf29-c43c-42e6-b11f-f7b87f3a3d42", "comment": "Malware payload (IcedID)", "value": "b3a9e5e6e12c5a59b8bd3d3323a497661d79e783", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215093, "uuid": "21fcb002-0708-4fe3-b763-8d1df499b362", "comment": "Malware payload (IcedID)", "value": "a68b13dac74a85fb064242a655a9c25614af7ab2359f17c0445f93513bdf99d596525d74825869bae2b02ff533db4131", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215093, "uuid": "e69379ee-638f-45c1-b17c-10bf72c7840b", "value": "T12115F101DF14646BF00B683E371765D7A8621C2B348BDE1A6B86112E2EC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215093, "uuid": "5df94362-b26b-47be-9aed-defa675e958b", "value": "12288:EZk9KVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE54gb9orp/G7obL/PXSE:vKV2jUeQRI5wPN/AZb9oBGsnPXSYqaiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215093, "uuid": "aaaa0de8-84e0-4b67-8ee3-ccd1c8916561", "value": 886788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215093, "uuid": "bc01b29d-9b37-49e2-92e1-bab59623211a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215093, "uuid": "58c861e8-6334-4c73-867d-0f5046a1761e", "value": "nckcn-invoice-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a259b8-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180585, "uuid": "982a7b27-8a9b-49a6-915c-d1d332ea8b27", "comment": "Malware payload (GuLoader)", "value": "7a1de08f80d1896c4128dd82162c697d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180585, "uuid": "6452690c-05ed-4d14-b4fe-7819939f40bd", "comment": "Malware payload (GuLoader)", "value": "6d60102c7c6e6c9051182bc7e2a939df3ba15beee75bbd8eed58d5d4a14decca", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180585, "uuid": "63eba075-9131-421b-b89a-4ea916208ab2", "comment": "Malware payload (GuLoader)", "value": "23b4004afa0cd3cdd221ab08979a17e99ada366e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180585, "uuid": "ee16b1f0-d376-422d-9c32-396ad8051ab0", "comment": "Malware payload (GuLoader)", "value": "f4feee2aa5a2472592febef0057f56c61d69db808ede9a4d789e9df74d27d45ed57f04a1a84c3d598a3a287ca514a29f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180585, "uuid": "fa0b2172-e1b2-44c9-a270-674f8ada186d", "value": "T1491471B0C915D8E57B8DF068DB080E98F83CF1225B22C539EF8514E56B853867B199FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180585, "uuid": "ec0b3158-a5d4-42d1-855c-d609b911b89d", "value": "3072:FPnHPtzN1QaH8rsz2Pu2N39gNzKeIbqf5IfevM8K4Ec5CIE:Ffv1CrszJ2xWNexbqf5Me3Ecwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180585, "uuid": "eb10e353-366c-4d3b-8a0a-800a0e4af070", "value": 194471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180585, "uuid": "a1aee57b-5c1e-42c8-a833-41b9b92c8dde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180585, "uuid": "10ab490d-e85d-4790-8aa8-052b96a82846", "value": "JUSTICANTE DE PAGO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f625369f-3db2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664207436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207436, "uuid": "e269dafd-d2f7-495d-8dc0-a231c29a5d89", "comment": "Malware payload (IcedID)", "value": "9d2db15627d67ead31cbcd1f5bcdb57c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207436, "uuid": "7a2e8088-3eac-4626-8cf1-706783c8acab", "comment": "Malware payload (IcedID)", "value": "6d6f93be1849c4fb0ac660f6ab6c4a2f8e7a1fe081670af3abfa5754f4743c25", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207436, "uuid": "6f63a550-5b93-408c-97f2-7140c3ea8d0f", "comment": "Malware payload (IcedID)", "value": "530b7c68696c5d0cd1e5288585b986c1f19f2fca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207436, "uuid": "829b3760-0f38-41f7-85a7-71bd4be8b143", "comment": "Malware payload (IcedID)", "value": "14c280933fcf88dc184d47162cfba687fa674a9774406c4f5a55f9d7af49a2a06f578c8d3803d0981947a896bd720c1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207436, "uuid": "554f0b9f-91de-4bc0-9f81-017eace453fa", "value": "T1D66408D9B7D2B0A6C3A3B474403F110BE27B6D91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207436, "uuid": "56a8e447-de1b-4134-9feb-e04a9b6aa66f", "value": "43477103f62b5dfd408bf7b94c0e3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207436, "uuid": "8e59fc2b-9696-4c18-8e5b-e7fba5ad3a97", "value": "6144:sJIId9kP7+sYAdo9ZvHsJge7lfh+mQVri2VrpgEhBvL:A9kP7I/sm2lfv29pgEhhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664207436, "uuid": "b1843718-385a-46b4-ad82-300098224bd4", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664207436, "uuid": "25111ab5-6c9b-4fb3-97a1-16df54182c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207436, "uuid": "c4a0d45e-6bd2-4409-bf0d-5236ff5dd609", "value": "9d2db15627d67ead31cbcd1f5bcdb57c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfb682f-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213193, "uuid": "6f9d1982-4cf5-4c57-928b-03be6aab5dfc", "comment": "Malware payload (IcedID)", "value": "90d96e06a7cd0bccdfe7dc2a65b67d45", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213193, "uuid": "316efc65-5250-425d-bc7e-38a4cd9d7102", "comment": "Malware payload (IcedID)", "value": "6d8a66cddd81c9d8ab0f017bd38f72e3dd65235989ed207670fdbc9427f45db1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213193, "uuid": "65280c60-7be7-4232-a423-7cb70b7b2bdd", "comment": "Malware payload (IcedID)", "value": "43b3ddadebc58523f66031b89a7b80bdd5d71733", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213193, "uuid": "4254eb72-73ab-4b63-8702-90056609b286", "comment": "Malware payload (IcedID)", "value": "2a46ba42021f1e5f9ed61ae3eae341f043ccd6b3db080b99c1de2e100b4d151b694b1db10af09b2a9fde79bd39448059", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213193, "uuid": "44fc8aa1-faa7-4ada-907a-c5a3ac711843", "value": "T15615F101DF54246BF007683E371765D7E8661C2B308BDE0EAB96112E2AC7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213193, "uuid": "1d012088-8ae8-4b54-9b4c-c3d8507dbceb", "value": "12288:nVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEQeKDDK2HiFg6htEMOoS:nV2jUeQRI5wPN/ffDKibMpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213193, "uuid": "58c88aea-5db4-4c31-9e4a-84f50c127fa1", "value": 886853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213193, "uuid": "233db7bd-dbb3-40b7-8563-47121fb4e102", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213193, "uuid": "033a4541-f28a-495e-9730-b2405531ecfb", "value": "naturahouse doc 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24365a41-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174442, "uuid": "996aaeee-74e4-480e-96ee-fb1e7aa2e8db", "comment": "Malware payload (SnakeKeylogger)", "value": "e83f2b7e702afe96e4ef80d2d455defb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174442, "uuid": "36137d13-ba57-4789-acb7-37154c375581", "comment": "Malware payload (SnakeKeylogger)", "value": "6dec5d623ae09a2e17014760d22da6d288ce14a2465cee207d193f98d8e26ad8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174442, "uuid": "70d06f61-f3b3-461d-aa4e-108c483f0648", "comment": "Malware payload (SnakeKeylogger)", "value": "0742365bd4dcfbfe74ecdeede2766ccb4df4128c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174442, "uuid": "ba7095db-c364-4868-8657-d530b75aa5f3", "comment": "Malware payload (SnakeKeylogger)", "value": "92ffa82b7eefb805333c8c1822c2e09e2805922dda52c0273e8595dcf70689b232e89814d499f814d69e88ca492cabf7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174442, "uuid": "ece7dd46-473c-4484-b76f-8e77b5cce611", "value": "T156F4E09BF5299585F810D7735E2988700A4B2E189883A2DB289E7FFF71FF6811CC6D05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174442, "uuid": "f508d410-9127-451f-b38a-c8196d81b362", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174442, "uuid": "833695c1-87b0-4ef2-ba15-84f0afd2f886", "value": "12288:V0aedmMgPh+ngZUklbzB99GvEzunrBfOSFi6hXAFgRW2EAmD:ydgpEYlbz+XZRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174442, "uuid": "35ed3444-5bad-4806-b387-3d3ed6c69b30", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174442, "uuid": "03e54243-f011-4571-a352-4a26dc88e820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174442, "uuid": "87fb9c7b-0f5e-4cdb-b20e-5179777ae9c1", "value": "DHL Shiping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27702a0-3da2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200477, "uuid": "3dfbc4be-6749-4730-99c1-18d688503303", "comment": "Malware payload", "value": "d3bd5064f995f83a59130acfaecc0829", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200477, "uuid": "2e76e309-ae5f-4298-98f9-caae362167df", "comment": "Malware payload", "value": "6f420387b378ae86014fae057f7cab5668a6bfcc6cb46d0ad53237d61fe7a67b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200477, "uuid": "8702d50a-f0a7-4a03-a4cd-3342ad3cbdf7", "comment": "Malware payload", "value": "872a5223ead3e34c1605743fd9ad0a1252545a72", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200477, "uuid": "e32617ab-5bae-49a7-894e-443d875be4db", "comment": "Malware payload", "value": "3a599ac4748e2a2d76eac4503a7bc8d687b7666e0804472714a592217185b504bc17490ba4989cc7704c6bb6afa5f6da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200477, "uuid": "0290f5f6-d35a-4be7-a36f-b6d98ef63efa", "value": "T10EB2AE35C59F683ACA0797F8C600039EB33A716AD013E74E1D5971D89D839BF0A56E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200477, "uuid": "a2bc37f7-faa2-4b80-b09b-4b0a45e209ac", "value": "384:qgs50oxEGYxwpS0MOA4GAUb02j97F1BPd+I+DgdnEMT5iP+noUvGTJ2sP628ktIg:EGGEGqEMOAYl67FvE8dnjTYP2oUOTUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200477, "uuid": "9761de2a-1821-43b9-840a-6c67a0f72c8e", "value": 23560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200477, "uuid": "0638dd1f-9888-4dc7-9abd-694b8f265c2c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200477, "uuid": "4608770e-d526-49b9-bce4-70ecb00ff019", "value": "Untitled attachment 00008.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2435be-3dbc-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664211638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211638, "uuid": "48818bda-cd94-4603-bfa1-65d4e26ba280", "comment": "Malware payload (RecordBreaker)", "value": "848c4428ff884b8ba0b141fccf45316b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211638, "uuid": "d5b7b96c-fea1-4fef-971b-59b36657611a", "comment": "Malware payload (RecordBreaker)", "value": "707a04a12631b78cc0b83d4218a3c2caab5a031a0352fb85c2b5c761c937b0be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211638, "uuid": "1ee99b7a-ab7f-4059-9864-b07b2fed31cc", "comment": "Malware payload (RecordBreaker)", "value": "82093c862a4e80217f6e86404685b4dc21c50960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664211638, "uuid": "5748bfc6-01ed-4509-9c67-e65ca4f627a3", "comment": "Malware payload (RecordBreaker)", "value": "de9974f78c2be198cd7065dd0d23bf8dabc54ffdc1e4f15a704a4b11f962d710a0cc075485f7ba1e3b4f513ec7a786a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211638, "uuid": "6818e322-c4c7-4f9d-8f9d-61fed29f53c7", "value": "T154E3E0107B81D473C52645795824D3A1BE7F78220AA66A4B33A87F5F6F323C2BB39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211638, "uuid": "3905bdf7-124e-423d-b839-b9eeb0662b51", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211638, "uuid": "c615121e-9c43-4841-a2d9-148b5136376a", "value": "3072:JvvK2BTc5XUg22bw7m+t84VIME6BJ81J5B:lgy+w7/JVIdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664211638, "uuid": "6c78591f-16ad-498f-98a0-dbc8ada0baef", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664211638, "uuid": "1fe3ce10-1831-4c60-97b6-e99dad8bf95c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664211638, "uuid": "91550ad8-2158-459a-9f10-5c053cd4197a", "value": "848c4428ff884b8ba0b141fccf45316b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91f19d7-3d36-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664154076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154076, "uuid": "6cfcdff6-3b16-4b78-aee9-7c81fa1197e1", "comment": "Malware payload (Smoke Loader)", "value": "1e82b4e33ecc0d6ba0f852d2743787bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154076, "uuid": "9fae6d45-510d-4982-abc2-edda693baa2f", "comment": "Malware payload (Smoke Loader)", "value": "7081a05296e6992522cb799ddc461f49e3142f317bb5471175e2bee665da7479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154076, "uuid": "2442e84c-835e-4a11-a2ca-d4a71f87b3b0", "comment": "Malware payload (Smoke Loader)", "value": "4fdb89f42307d382987162dac7981d6d48a3ca11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154076, "uuid": "3546b386-7aa8-4fd5-9b50-11124b7e2f06", "comment": "Malware payload (Smoke Loader)", "value": "5f6a30ede27bca1c32c03d8fe59c150582570b0b8bb7dabf11458fd928670283d99c5d59eaf420db064799da8def3100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154076, "uuid": "bbcd1ca3-d7ef-4279-aa9c-2c7627af8238", "value": "T12004E0113A90E431C556AA714470C7A06BBBBC22417A478B3B9C2F6F5F313E256BA357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154076, "uuid": "3e8566a2-13fc-40a6-826c-d09af61cf351", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154076, "uuid": "8c3d7f5e-b25e-43e2-9a71-1e678827f87e", "value": "3072:+zscmZcCO8z53UwD5ccirnBbtBvkwyf/YyoBkqt6z05x:13UwCdhkwyf/YyRqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664154076, "uuid": "98346a67-49b3-4b67-a648-f1dd9065676b", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664154076, "uuid": "c1d09aa6-fef6-4a41-931b-bd961690f070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154076, "uuid": "2d3726eb-132a-4f04-8272-c3ed0333df85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee20347-3dd5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664222348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222348, "uuid": "bc067eb6-40b6-4e91-b2ee-438ba250df38", "comment": "Malware payload", "value": "5cadf38203eccc6041f9f38c5b86da91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222348, "uuid": "507260f8-19aa-486b-b98d-854db148b890", "comment": "Malware payload", "value": "708a4cae7ec9fafebd1d8e842e6017033fc7d5891b0cab5e731c6469b1387f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222348, "uuid": "dde87e01-b9ac-494b-aa18-a4e4ef8cf995", "comment": "Malware payload", "value": "c20ed12dfafb0300572ecc905808434be3c4d919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222348, "uuid": "2d614bbb-c007-4a6d-b6ea-dc0c9bf80497", "comment": "Malware payload", "value": "3d912dc9bb3577cb0d6081756e57616a213d7ea7cb299b7da80261683c410be3e986e1300c784748601053a434a022f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222348, "uuid": "9ec9747c-a4c5-4046-b1fb-63530ff46301", "value": "T19DD3D0003862D573C062D5B04879D751AA3FB8316A79858B379C2A7F1F713E29B7A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222348, "uuid": "5afb0d48-9b97-4876-8a55-b58d5464316e", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222348, "uuid": "df80f587-2574-425f-ae65-87c1f8cd267d", "value": "1536:k9YbNryvqqPkjT55BvhqvLDEucMlU/RUxiMJdYVLd1175kvxBZ3y49g5B:k9rvYT55r2ZlumYtN9kvHZ3ta5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664222348, "uuid": "7dd1f21c-58ca-4602-8022-075d14381527", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664222348, "uuid": "8e6d1ff4-bd8a-42b7-a06f-7e3b5ce89957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222348, "uuid": "fa6df477-3c4b-4815-be91-eaeb01d07130", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bf4509-3dee-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664232941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232941, "uuid": "99735805-965a-4f02-ad8d-3e68acf3ac1a", "comment": "Malware payload", "value": "18414aa4868e063889b620a64431ee17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232941, "uuid": "247971c3-e3f2-49fc-b464-b745bfff0e4c", "comment": "Malware payload", "value": "70cbb10f9d587b921118e259b835fc71eba96e04383f4afdaad69a76ac72edcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232941, "uuid": "3b3d72e8-9afb-417a-97e0-4a4b465bf817", "comment": "Malware payload", "value": "0bb96cc26f0de7585343a2fb018411e4860b7945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664232941, "uuid": "3e7dc2e2-6cc1-435a-981b-3311cc5d9210", "comment": "Malware payload", "value": "d9ffa88693e6318f795f98e7de3b743e087c592c025023724e5c9e09b5c43d8950d52d24d9a8bbfc6a61567489b8f793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232941, "uuid": "0c7eb8b9-c3e0-4c3b-9a58-af5b2dc65e62", "value": "T132D3D1017C945533C46396B51832DA502B3BB8612BB589C77BD83E6E4F713C25ABA32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232941, "uuid": "96d3c013-e39d-4ec4-a9f2-14a2ddcfa508", "value": "d7d5eb29f8cc9aa72be1b48a07c02672", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232941, "uuid": "10b073e7-ec4c-4ddc-b8bb-ac59a121103c", "value": "3072:6Wdv+mT85kNP6LWr1cuMDBGEOL1B7W3PoSgAA5B:6+v+26LhDBGxXyfoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664232941, "uuid": "b058b9c7-500e-4abd-9756-4edc6cb13ed7", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664232941, "uuid": "70e2fa5c-b6b6-454e-9f89-69e07149563b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664232941, "uuid": "b0fd6a20-e9e3-49c3-ab4c-8bb36dc3a6be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43758cd3-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664180937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180937, "uuid": "5b808e88-3718-4231-82a6-1ceff486f03b", "comment": "Malware payload (Loki)", "value": "cd396805543271312a50ccc6aab63a87", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180937, "uuid": "0970af6a-e7cc-4d36-8446-d02cc2d518c1", "comment": "Malware payload (Loki)", "value": "7170f70697de62eec47230b614f38bd8b5186bcf70131333e6cae03d8b59537b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180937, "uuid": "25ce3639-93fb-4b2a-992c-450a807a3955", "comment": "Malware payload (Loki)", "value": "367fe58a88bf36f803f812a2db7c5a9ebde2cf63", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180937, "uuid": "116ca066-f43a-4f15-adcb-6b10ade19052", "comment": "Malware payload (Loki)", "value": "ae5b1b0d48fa978e09235fc0e214bc969f83b79011e99ff9da6cba1753370fde998a6a482917f9cacc475f0b537fd8d5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180937, "uuid": "d4d2f49f-0901-4f7b-a786-bc2725dc8104", "value": "T1EB15F1370BEA8B0BD11576B895D0D6F6A399CD01E46BC787BBCAAC1FF08A4619730315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180937, "uuid": "abd92eb0-793e-46cb-b795-d0b7e2603735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180937, "uuid": "62dd0f57-d0dd-4944-82cf-27b46b55a4ad", "value": "12288:K6BRAwe8LY3L0xHQhCrvoDrKNZaJJo6eMS/jhxmdRxRQcxosfBK:DBlHM3AxHQh67URS/jPaDucxvBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180937, "uuid": "ab13143d-a59e-4163-8f7b-2efe3c199773", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180937, "uuid": "d96940bb-1993-4d9b-bee7-e2c2f41f95cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180937, "uuid": "0f95628e-a005-465f-adce-328e92c14c72", "value": "DHL Shipment documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59121546-3d99-11ed-9266-42010a9c0072", "comment": "Malware payload (Gafgyt)", "timestamp": 1664196435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196435, "uuid": "92766abd-9245-4b98-9c93-3d5b5122840d", "comment": "Malware payload (Gafgyt)", "value": "3c0e4fae9f243c313ca18d1e0c2b08c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196435, "uuid": "8b349097-d8f3-473f-97ff-435f33adab22", "comment": "Malware payload (Gafgyt)", "value": "719ccafe481cb5fec19a18fb22ab4fb16b4032ed27079bd19d7c58c0d8827c66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196435, "uuid": "32ee8103-626c-4e09-bd12-995ea76a39d2", "comment": "Malware payload (Gafgyt)", "value": "bdf82220262847c470423877fd4251637e76174a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196435, "uuid": "d2f231a5-e8cf-4522-8a67-1e0e8aace938", "comment": "Malware payload (Gafgyt)", "value": "ee150c902d4230aa091e5808f7c0547b63954f11177c0aafa6f635706d1ebb5f17dc6cd84a1cea940c8f447075ec0a63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196435, "uuid": "0321519e-64fc-49fc-8102-78a8f833d10e", "value": "T18FF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196435, "uuid": "ddec43c4-6c19-41cf-abb4-258de88ab83d", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBsYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/2YnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196435, "uuid": "ea5c04d4-aadb-43c2-af10-fa81fec163b3", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196435, "uuid": "f925c7bd-f38e-483b-a76d-6a8c7e991091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196435, "uuid": "41a0043a-3e00-4ad3-8515-2f5aa8506e35", "value": "3c0e4fae9f243c313ca18d1e0c2b08c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5f8574-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664181170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181170, "uuid": "e9a203aa-9dad-49eb-ab10-d9e00535cb49", "comment": "Malware payload (Gozi)", "value": "9d395687dbce310ddf3a3ed4a930a5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181170, "uuid": "441a307b-1586-4483-b1ed-577049045f8b", "comment": "Malware payload (Gozi)", "value": "7204e4550639593b5b5b197c171a986833754a9e7e0f7a3e1ef6d31b6ce23344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181170, "uuid": "59fbd570-a4dc-483f-8a75-26c9beaa8670", "comment": "Malware payload (Gozi)", "value": "3e2c248b96901150c36e722e3722e974eb148144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181170, "uuid": "6cb238d2-9070-4e08-a133-5825a00e93d1", "comment": "Malware payload (Gozi)", "value": "433a895a236c686639a544dd41f8d04727d8f1bc14b0d64542031fea7074f30297385f484132b19f3c51ee1fbad8b092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181170, "uuid": "0961397a-55e9-4eb6-a384-3d1669522ade", "value": "T1A2344B6AA3E51995E96BC6B5CD53D227EBF334492B24C30F5370CAA66F17722B11C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181170, "uuid": "81ac40d1-d73c-4f3c-a757-06e93d27fbe7", "value": "6144:3+nZ1o+NJWbn2CMFIzSTRDR1vwQR5kgd:3+ZNNJWbn2CMFIzSj1vjDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181170, "uuid": "52feb6af-7a38-499f-8dad-19ae7122cd93", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181170, "uuid": "7a4b29cc-2f6a-4daf-8664-48ead03e6010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181170, "uuid": "c504b1ba-5efa-4136-9d81-b4a36af61bea", "value": "60d0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34647d9-3d6e-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664178145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178145, "uuid": "4bab743f-67e3-43ce-9a2a-f7d15c8060b7", "comment": "Malware payload (Stop)", "value": "42a721247a23d0ed54927e69eecd51e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178145, "uuid": "cd393a17-aa37-4ae7-ae86-875891b9a2b1", "comment": "Malware payload (Stop)", "value": "7228ed4d25d6dc3883db167200065f6b3ae914c6487120879908a0ce7d6ea43b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178145, "uuid": "b6d83ea4-85f3-4b7c-a829-d7a5a7e58f72", "comment": "Malware payload (Stop)", "value": "da9d751727282fc8375624b66dd915271910229b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664178145, "uuid": "45c359a3-61d2-4cc7-9ba8-1e796ed22f01", "comment": "Malware payload (Stop)", "value": "d0526567828e37e6d5f2a840035bb25041077adca3833b64f2402f8b7dee08e7d3b57b20ae1f1a2c30ea2f7099b4d2ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664178145, "uuid": "8ef30b08-5745-4959-806b-192c28d9fe0a", "value": "T1ACE423107B90ED7BE51517B1082283D09F6EB81A82236B5527983F1F6F301EBB67179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664178145, "uuid": "b39a475a-39cf-4a40-a99e-8f8452ee484a", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664178145, "uuid": "c6c9a5c4-9ea3-4e46-ad7f-0effc2b0a5a6", "value": "12288:1LhgqhBldTil5Jy17S8ESs7nCDxmssO38z/2O24dPuF6q51dI:19g8PTkJA7HErDCDxmuMji3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664178145, "uuid": "d364f14b-4f3c-4428-acca-ba8de19eaea5", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664178145, "uuid": "5ca02f06-cf12-43a4-961f-9236ec15e7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664178145, "uuid": "242a874b-e26d-4460-8aad-b4ae669828d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d9d67f-3d7b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664183459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183459, "uuid": "0b71c504-7059-4143-80e8-f6bb3a0904c5", "comment": "Malware payload (GCleaner)", "value": "8ead10bab768588415d9c7f55f58c497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183459, "uuid": "48ee435c-c9d9-4ce6-85a1-2635c0080a37", "comment": "Malware payload (GCleaner)", "value": "7252dbb7b6045ffea61ce61a4a80d115db857ed0a8aeabbfaee116f4fdc2c080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183459, "uuid": "43d35187-f50b-4bcb-995a-a21caadbd9ef", "comment": "Malware payload (GCleaner)", "value": "9a1a9849533cb086a18510cdc29fb357f62d6ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183459, "uuid": "d8023945-6aed-4b5e-ada1-928aa7c3cb67", "comment": "Malware payload (GCleaner)", "value": "a92f239866bed1fd3d1da8747a34ddf7a55af225249b4ff61dd7da31cb67f4c23ded3aab4d121ff5063548fb9194fd50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183459, "uuid": "c9bf082f-e152-4a54-a03d-980ac5517d59", "value": "T1EE3402517D94D832E95AB031C836E9A4A8BFB8414722568273B83E9F5E732E07F743C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183459, "uuid": "e2b58ffc-533c-42ec-8e9c-f62ae131649b", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183459, "uuid": "e7be4f21-1d74-4b16-b6f6-94ee8003daaa", "value": "3072:YBfHwOG5TK/gWd+S/ORb35iiHMgJprD6mDuezSHU/rNIuWn+BdC/1aPyLtCFeB4Z:QonSmtp9sgJpqDdHsO3n+BeLtCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664183459, "uuid": "dceb2a35-790a-4cc9-b8ed-85f49827c579", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664183459, "uuid": "7afb5d6b-ea98-4f94-b568-fff352e53d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183459, "uuid": "7f93dcf1-4bc2-453e-8225-c635ca4be4dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453ea1f4-3d9e-11ed-9266-42010a9c0072", "comment": "Malware payload (Neshta)", "timestamp": 1664198549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198549, "uuid": "7f2b6426-6fae-420f-b80b-ca3ade4aa7cc", "comment": "Malware payload (Neshta)", "value": "5d31ff727ddebc94f37cff188c0fc3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198549, "uuid": "67c6cea2-e3ce-452c-9fa8-aa92fd0aa51c", "comment": "Malware payload (Neshta)", "value": "72a9187d68249e63f4562b466013c4a77b622621a229249874572e667fb80b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198549, "uuid": "544602f9-39b8-4adc-b970-8533adc220ad", "comment": "Malware payload (Neshta)", "value": "64b79513675b4421a1d6c36502a07d9395d3aa24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198549, "uuid": "ad90614d-dccb-494d-b154-0166118ad3de", "comment": "Malware payload (Neshta)", "value": "1eab58d62a4c8a2758fe909395164370335e2745f6b38bde2ffd8fe3729876705dd94d28cd1e2e87022b90a680175c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198549, "uuid": "5c1047a7-70df-439c-bd8c-bc7f41022d37", "value": "T164155A1AB2D7143BC43607BD492752645C3B7D202AA6585A5EFCBF4C0F392A33C36E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198549, "uuid": "580283b0-eaf2-49e9-b93d-fad85b37857e", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198549, "uuid": "7e16133f-deea-4043-9248-01efe4f82709", "value": "12288:zAtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEJ1888888888888W88888888W:zANzCtUpQ9WWPBSSRMTEpMNJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198549, "uuid": "5e61dcb9-6079-4ffc-bb71-fc654a512f22", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198549, "uuid": "60b8b307-e49f-4e65-b85f-be6c0fc83468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198549, "uuid": "2e49cb0e-2536-4e2e-98ab-795ead0b6001", "value": "doc-file#98765678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7134e16a-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664180154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180154, "uuid": "703390e3-c2b7-4e81-be93-075889c841b3", "comment": "Malware payload (Smoke Loader)", "value": "1e1f1c948be6335c9a1791c146fdf19f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180154, "uuid": "6ac67a54-8367-4134-bde6-72de5bb742b3", "comment": "Malware payload (Smoke Loader)", "value": "72ba4cfd959620d844ee73b52d5094ed282344cdbbcf2762722ba79dcb86225d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180154, "uuid": "0c58df58-63d1-4370-9ef6-138166cfd8e5", "comment": "Malware payload (Smoke Loader)", "value": "fa385f4aca17ac4d3980a08140b41304e8a47677", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180154, "uuid": "8e7ceba3-c597-4dff-aa68-cf991d13f5bc", "comment": "Malware payload (Smoke Loader)", "value": "b4539f1428934e56935c0d87796f3e66ece8334285f108c8275e55b6e350223564a28b7a11667aed9522d18e0ffead74", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180154, "uuid": "bc53f2ac-7688-45c8-b3e4-57debf14ecb9", "value": "T1D8E3F101B7D0F973D4049470182AE7E1993FB822463A56473B842FAF7FB12D267B935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180154, "uuid": "4e45e408-894d-49ca-b8d1-679a6c4950a7", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180154, "uuid": "d22ef24d-d0c3-46b1-b7d5-7d300dce1c89", "value": "3072:WYNtFG5AfVfhHVIHY2sbtFnPqoJBPbB8JvH5x:lRBVBFPHBEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180154, "uuid": "c2cd8c2f-885a-42d2-9eaf-958aabd71b94", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180154, "uuid": "95df7c56-d649-416f-985d-615ef7da4370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180154, "uuid": "187d1ef7-1b39-4044-807d-ab8f51ce42df", "value": "1e1f1c948be6335c9a1791c146fdf19f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e190d5-3db8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664209771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209771, "uuid": "3924c956-cb1e-4b42-9d91-25bd5c4e39f3", "comment": "Malware payload (Smoke Loader)", "value": "dc921d6f0f9a4ef459cf28007a4aaeb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209771, "uuid": "098bdd40-5223-4020-b152-153115967ee2", "comment": "Malware payload (Smoke Loader)", "value": "72fdabca5be40539c410215ddd82ecac0c9649f2764568bc0d58845233ea6906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209771, "uuid": "882053dc-5390-4eb2-88db-64b04cdc3f22", "comment": "Malware payload (Smoke Loader)", "value": "5b82576db6589448d5b422308b99714986d054b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209771, "uuid": "96f2fa57-c850-4351-b52e-9d95865b6ac2", "comment": "Malware payload (Smoke Loader)", "value": "782c3042ddcce163323ddba77f670aa57e0dde9ca3c9251620dd0a9f6227e38f2f6dab79e0d020f155aaa11495878c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209771, "uuid": "c302d6af-9c12-46ae-93d3-bc381d596b88", "value": "T1AFE3E000BB40E873C01155B11834D7A1B8BF7861527A49473B98AF5FBF323D2AB7639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209771, "uuid": "9319f9f4-1e66-4574-a849-344d9589b042", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209771, "uuid": "5fde973f-3783-44c6-9f52-32bd7a468f3e", "value": "3072:fFRnLMTc59lZUVfGOD+I1gkGvFpEXBQgYmD5B:rLLlZUtD+wgZ9S+gYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209771, "uuid": "100e7c87-04da-4444-b705-2fb8f84b31f9", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209771, "uuid": "2f38cfee-8808-4fd0-bdec-307ddb8b5fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209771, "uuid": "abafa716-a3df-4538-8267-cf8d7a48a343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fe4f07-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664171215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171215, "uuid": "15e1f439-6b9e-42a6-9a26-3c134b22659e", "comment": "Malware payload (Formbook)", "value": "361878f663025ae20b12ddf0f7ebc336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171215, "uuid": "1f752500-77da-46b4-ac3a-b6fa223a7142", "comment": "Malware payload (Formbook)", "value": "7351dcd98b075ab0d6126a93b977479fcfdba800b3e8e31cdf95fa673bd90ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171215, "uuid": "3b79e771-07f6-415d-8a78-d580005990c3", "comment": "Malware payload (Formbook)", "value": "fc955971e0692a4fc01547d09ef0b7a7ef888b43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171215, "uuid": "0cbaeef5-f9db-44ad-a422-30c083e3d07c", "comment": "Malware payload (Formbook)", "value": "477c1a0ac51413cd0763c602768275c472cb2b1c2c2a6eb7e045942646c488ca96ee1330572466f7afd7aafd33ad649d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171215, "uuid": "876eb066-906e-4feb-a58d-4e3f90f739ba", "value": "T136A44C2C3A055A63FC0ED33899030A99FFE60B8372C0E99157CF96CAD75F0656D65CA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171215, "uuid": "589a10c8-7841-4403-b2d4-1c2917adaa42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171215, "uuid": "7e01812f-8f6c-4464-9c87-3edca08a275a", "value": "12288:YPGKihryo/OJQFkkpHr7Nv7FccQHiR+3ha:NKQvVr71Fx+iR+xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171215, "uuid": "3af4dce3-8941-4028-ba1b-26aa96c67fac", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171215, "uuid": "19560a04-f5cd-49e3-afc9-3d3967e8a333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171215, "uuid": "1a794d53-e7c9-485b-afb3-8ec4bfb99c3f", "value": "SecuriteInfo.com.Win32.InjectorX-gen.23297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d7b121-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180459, "uuid": "02e41a20-a17d-4e20-92d8-55920bb94c1e", "comment": "Malware payload (GuLoader)", "value": "dad98a2d5689a2ee4be1de125d128860", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180459, "uuid": "96d9503e-fa26-4a56-8c3c-e17c00fa2d49", "comment": "Malware payload (GuLoader)", "value": "7399977115ce8862bf65017f7d5a27315007c7350b3a1d090cbd20abfd684fc7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180459, "uuid": "9c937798-4351-4c09-a953-2e7fb66eedd8", "comment": "Malware payload (GuLoader)", "value": "867fe30cfba38ff6497aa2f6df21799bc146d2f8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180459, "uuid": "cb5b9af4-23f0-46c7-aac7-58d398200b3d", "comment": "Malware payload (GuLoader)", "value": "16a65c467db6f92ec07b561164b65c84c7ee0527883a2e732b1874ed5b13ff77485f6c3e4600eb08d530e1c771e6865e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180459, "uuid": "0ca1129b-2f7a-4c7f-b4fe-27a9d3738a9a", "value": "T173048278C5FAD8E33F9D31F9C5006A58A01EC93243E1152BFE2934D5AB9CB0587952EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180459, "uuid": "6aac6f13-afcb-43bc-8cfb-ba77a6fb6f56", "value": "3072:FTos1wgCJJ7KsyEppyV6678XFglnkFevM8K4Ec5CGPz:FctTVlpcYg8XFgln8e3Ecw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180459, "uuid": "4a1b215f-e86e-4931-a39d-1060bb44fb29", "value": 180378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180459, "uuid": "d5546b9c-1ec3-488b-9f46-30a2e4e4909b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180459, "uuid": "4b1282ec-6e24-47a7-8c3d-7235f254e193", "value": "Transferencia de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8705db3-3d36-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664154048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154048, "uuid": "c834ce31-a798-4cc9-bdc9-c9fc5204fc84", "comment": "Malware payload", "value": "f9b08a0b4df48efc072fdc16cb5dd22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154048, "uuid": "93c04e6c-a6f3-42c3-8be6-de27b2c6d017", "comment": "Malware payload", "value": "73d467286994dcc55455b90d2b4e5ad771b21e97a666a500141e05c567c67422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154048, "uuid": "c9df5812-8146-4add-b4d1-194d6e31c65a", "comment": "Malware payload", "value": "8a91db8504ca2362219f3c563a04be56a48daaf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664154048, "uuid": "a9e620c3-3543-43ee-a11f-2085d238772a", "comment": "Malware payload", "value": "093afa4b3a1c16cbf295f934f2b339e6d73214486548a33cba11dfefbafb9ca3033fa9902428aeb084eaa149380eb13d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154048, "uuid": "a961296b-62c4-49b0-ab2a-f4d810910b42", "value": "T1FD7633903BD5C671C028453B46B41EDAA1F4487C1F2AC83B23D73C6A9E3DA7EC9A5D58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154048, "uuid": "dddafc80-dc3c-46ed-bdf3-16f822b6f513", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154048, "uuid": "49f78f8d-6c1b-466f-bb3e-30796ef7c73b", "value": "196608:91OqA/UtvlgsQVJR7LOIDJonq4IsaDzfWwOdkoFQHZHCpI+:3ON/uvtQl+IDGq4piDGQHwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664154048, "uuid": "c1d74209-adf3-4dab-8971-2a227798974f", "value": 7651638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664154048, "uuid": "d1742512-28f9-42db-90a7-ed4f4731110e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664154048, "uuid": "a22ccf08-2a4b-499e-b669-f1a94f1968e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86926a0f-3dab-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664204242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204242, "uuid": "daa9afdf-095d-453f-aa4b-1110adafd71f", "comment": "Malware payload (Smoke Loader)", "value": "6a9b2c3164f30f73c41a3da26f8ef936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204242, "uuid": "dd1f896f-b93d-4d0c-a2ac-bf8be68fd957", "comment": "Malware payload (Smoke Loader)", "value": "757ec4bdfb9ded3d0d68b3c96760e145beb95aad33cbc07c205b591a9a8945ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204242, "uuid": "89af9618-0c67-4355-900a-86e71051511d", "comment": "Malware payload (Smoke Loader)", "value": "b4ade644f1969cfc7920832afa7a7522643c1178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204242, "uuid": "d796e31c-3133-4253-8d0a-8735b42f26b3", "comment": "Malware payload (Smoke Loader)", "value": "b783a3b6fde3b0fdc69c3cd726c111cd79f5c368f2bb85d386fe7b7410e7eeae9b92f4064adf4e560689bd685ee921a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204242, "uuid": "b5e779b7-a632-4fab-aef5-5ac987e8f77b", "value": "T15BE3E0527685E873C42148710434DBA1A77F78261A76AE863B4C3F6FBF723C26679302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204242, "uuid": "1ffb0992-afdf-4ecc-83a1-57925391c898", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204242, "uuid": "a08b3633-ea96-4508-a56a-75771232aaf9", "value": "3072:OWmQTF5+IEfAHTTGIS2CfBEyc11Blcassxn5B:EzfAH/w1Tc1N7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204242, "uuid": "e2e0add9-562e-4f15-9766-3e694247821f", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204242, "uuid": "b76233d1-ef28-4d69-84f4-4600aec2d08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204242, "uuid": "27b42cd5-65fe-4a46-b0bf-d71faa7305c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d60811e-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664180926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180926, "uuid": "bfc9e7ca-0b3c-4e0a-8eab-884b01d903ce", "comment": "Malware payload (Formbook)", "value": "ae736339719fe7e033554ac13db4bfe8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180926, "uuid": "f954f611-bbca-47c0-9456-98dea6c6f3cd", "comment": "Malware payload (Formbook)", "value": "759145621f94949b40fccce63ea37d4d797d9a8548e0e2243bc53cd8b38d5ed8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180926, "uuid": "0d984653-cda6-4275-aa42-58a9378b7c49", "comment": "Malware payload (Formbook)", "value": "ed008045ad9867d5567e2790265149b952e6de99", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180926, "uuid": "4d555324-5627-4317-b265-795ef50793ac", "comment": "Malware payload (Formbook)", "value": "62c21c462eefb3df404890b07364e10b68dc8a0fe21a826762f4cadc36a3ef77d527082a1fc63ddf42950da6103ad165", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180926, "uuid": "3cb7d5a5-990d-407c-b3ea-d83f96eb3b0c", "value": "T1A325F1271BEA8B0BD01572B895D1D6F6A7A9CC01F537C6C36BCA6D0FF08A4769B20351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180926, "uuid": "52591bc8-c812-40f5-bda1-88d8b2bd38c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180926, "uuid": "8f7624d6-8188-4f64-8158-abe9c7b22c06", "value": "24576:rYMJZwFfxkf44xTio1249Ln8TmCV/U8U:rYMsrRITio1bLoMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180926, "uuid": "159cc4f0-0eca-4aa8-bff2-e8fb7ba486b6", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180926, "uuid": "700c6ba8-cf64-4161-88c2-b62159f22596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180926, "uuid": "53afa2e6-0375-4942-9b60-293d1db84cde", "value": "DHL Shipment WaybillDoc_TransportLabel_3950350973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aaabc3f-3daf-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664205859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205859, "uuid": "246e2527-75b5-4a0c-8364-da4e3601e30f", "comment": "Malware payload (Quakbot)", "value": "0248e62fa564708d68239cc8aa5ebc93", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205859, "uuid": "1f32bb0a-0d0e-417e-8b3b-158123c6b299", "comment": "Malware payload (Quakbot)", "value": "75efc81fcd507e4f7956f5c3522b7e8a2f876118695d8c153e53f68360a77139", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205859, "uuid": "15b8f70e-9d75-4a1d-9fa6-bafebf17d8f9", "comment": "Malware payload (Quakbot)", "value": "c95b7ca41aa98379ca36e1d60dd786ba3d1e4d15", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205859, "uuid": "8cbe2b0c-afeb-4c9f-9f36-69f3e290a85e", "comment": "Malware payload (Quakbot)", "value": "c784cd01031dd106d709cf9416d7e1fa92d6c80775940e89e9b0059c2b2cd5da44877533b8d4a013367318b301130637", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205859, "uuid": "0aab9e02-4f2b-4397-9da2-705a076e858a", "value": "T1E1D423D7BD87E2D6AB1F4AFCF00AE7F3051BDA211C20141D28E8EA3EFC465692564791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205859, "uuid": "b7c22f57-3b11-469f-9e81-a18196d1b29f", "value": "12288:KPcD+D79GWtn+PKq5dEUqZ1Ta0zGKqbZZBt9ec2vSx:Sk+/+p5dEUqTm4GKqbZZwc2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205859, "uuid": "4ecf972b-e8db-4f92-88e5-ae2cea5d884b", "value": 606128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205859, "uuid": "40af5583-8de5-4b91-8b4d-d4c3c64a8589", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205859, "uuid": "bad65e9b-68da-4317-b7f3-10c0dc1b4255", "value": "Articul797297999.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19489152-3dbe-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212219, "uuid": "63dfc97c-9850-42c6-95ee-62e54df16c67", "comment": "Malware payload (IcedID)", "value": "148c8d4e6757f187fe2ebf2fac3d048b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212219, "uuid": "e06f5e38-da1a-46c8-9e9b-3287e591c35f", "comment": "Malware payload (IcedID)", "value": "768ae10d748df22e799a878c2bd5eebddd0cd331196d28e26b1a9b2e0ca989c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212219, "uuid": "c31a1d15-e4d0-4277-bd74-4e65f16995a0", "comment": "Malware payload (IcedID)", "value": "a4ef0e39b1768b9b1bbc5738eaca6fb22f5036e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212219, "uuid": "cf27324f-91bc-4170-b5f8-4ab9d62ffe08", "comment": "Malware payload (IcedID)", "value": "de34500cf18c3445ee987ef6239d59f4d791d8fd850e04cceaea85aaf5af149500b7686808f0ce913331edb6bb3c4297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212219, "uuid": "a4716beb-df5c-49b5-bce3-65f172c18f9d", "value": "T10FC46CA5B5C13026E2739279A0AF6546B2769913B00B89E4F17EE4E0DF749CE0133F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212219, "uuid": "64a3ac3a-fa44-4193-81ba-18a9c5720d3c", "value": "19c10135117a704516e8404b24282c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212219, "uuid": "9f22cd18-04d1-47d7-85a6-0925fc7ae51d", "value": "6144:U+86v2VKRnZEvCijwzDv35F5+Djwy/QCn5drokAieiV:U0v6vCij+3yB311", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212219, "uuid": "424810fc-47ff-4209-9ae8-93453ab3f107", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212219, "uuid": "c384cd70-01e9-47e0-b3cc-8905c94f7960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212219, "uuid": "a3b80550-d301-4565-be08-6335a09cfb2d", "value": "convolving.db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95ec0e8-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200891, "uuid": "072c2a5d-7c77-42e5-b7fb-00881ddc5d8a", "comment": "Malware payload (Mirai)", "value": "67be54d9efe762e586213cc20328758d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200891, "uuid": "5cd68d86-a158-4c18-bdf4-c30ab2fa4894", "comment": "Malware payload (Mirai)", "value": "76de6602adbedba0a48d102560e29c4f887c6b9897f2be6b2734fc1a85665f88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200891, "uuid": "4f8a01db-9bc2-40e8-8b4c-4c4fb98ea21c", "comment": "Malware payload (Mirai)", "value": "052a946b0299a06da366598a21366e5c94071c18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200891, "uuid": "9dd91169-e7c8-4c5d-8b97-c3755da19d9b", "comment": "Malware payload (Mirai)", "value": "2037693a172364f3cdf6e5528565d271808996ec8fffd5d937c106b98ed4d90962aae34eb813ba6a639a45759811da56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200891, "uuid": "3fd330fc-61a8-4c66-a20d-5c51043d176d", "value": "T168B3A40DBF611FB7E8AFDC3709D91B05288D665A21A83B797574D918B24E20F19E3CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200891, "uuid": "26dd8623-ff39-4928-87c2-461d4b26e23b", "value": "1536:oRtqoQTkiZ7V3jewrcAIPjRZ8EDT/8Zzexv/JPof1n:oRtqPDj3jepGE//8WPi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200891, "uuid": "8480a461-7ec5-4b33-b5e0-52884fde59e1", "value": 109768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200891, "uuid": "44a4cbce-6002-4697-b088-e1fe28febf29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200891, "uuid": "040ab730-775a-4b6c-a067-c9bd50593a97", "value": "tamkjll.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a458017-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664179257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179257, "uuid": "3509258a-ed58-47b5-9740-3dd57a6f9b22", "comment": "Malware payload (RemcosRAT)", "value": "a3e3e5b0d27a0ec1ea58f8f099fd0e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179257, "uuid": "45886b40-b3a8-451d-8de1-ec402e8e2120", "comment": "Malware payload (RemcosRAT)", "value": "77138e337a54f434bc13de0dc4d4b4eb9fffb85fb169c79dc19c2acf3ccf5e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179257, "uuid": "3f59c420-a198-437f-99c9-9f413950e371", "comment": "Malware payload (RemcosRAT)", "value": "a5f18071850176731109c4f5b38f21c90d1545e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179257, "uuid": "57882721-c143-4914-898e-027b5d44284d", "comment": "Malware payload (RemcosRAT)", "value": "11ee4e0e446f8ec9d38e0e64c00793da5c1efc73d32136b36018135d7a76b6c2cb0642d2ae73932e9a1adb0b00f14f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179257, "uuid": "986e8a85-15aa-44ed-97fb-21eac389adba", "value": "T1E855013B06FA8A0BD0246578D4D0C2F6A7ADCD10E577C29B6BDAAC1FF49A061DB71311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179257, "uuid": "fe331dad-754e-4dae-9926-5d92b5f1df5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179257, "uuid": "5c2b316f-80d6-44cd-9486-097ff3c903ca", "value": "24576:2gX3qL9oCTF/8lfKMhk521CSicnSoyDSPnUogVnK:R3gVp/+KMg21CSicnSoKS/Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179257, "uuid": "8957badf-a3a1-4598-bb79-9fa02f217a28", "value": 1326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179257, "uuid": "056934cc-93c5-438b-9cb2-5671199809a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179257, "uuid": "67254830-7a9e-4261-845b-77443b301356", "value": "belgeyitara-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3c544a-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1664173808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173808, "uuid": "b4b819a1-95f5-486f-9908-43969473dfa7", "comment": "Malware payload (ModiLoader)", "value": "4d41a3920b9e57e33f888ed61b205f85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173808, "uuid": "c02b2466-d08d-4bc2-982f-ae6307b3e817", "comment": "Malware payload (ModiLoader)", "value": "774fa8863d2cb1747c338ef9023103d535715b30b6d5450a9ee146663d77c89b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173808, "uuid": "508cf673-be72-4a93-9e52-91f8cad6840f", "comment": "Malware payload (ModiLoader)", "value": "ea1dacd994b1b37829d870971b78d34279632e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173808, "uuid": "16377aad-b916-4964-a923-84e127e846e9", "comment": "Malware payload (ModiLoader)", "value": "7e6bceb50ad6891c9a86c971dad3ff91cb5f9fce2a493ebd9d806ed9d16fcda8df13d92150a45cda5db7cb320fcec249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173808, "uuid": "ee862269-a27a-473a-a112-e7e8f882c4b3", "value": "T108E52A90790DB8CBD2C7557EE9DDC913754E62E950398603AF62BE3EF1D2C392289B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173808, "uuid": "1160eb46-e1d8-4c79-88c7-99a8903f6eaa", "value": "b615d746e4007bbce667868c7c2c7428", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173808, "uuid": "8c03f1ff-6aa2-41fe-b66a-9f88bb701849", "value": "49152:WZHNYBI8Zzxj6grOdQCAgMprXAok8WaSXQb/:WZHNY7ZzxWLdQCAgszk8pfb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173808, "uuid": "d66fedab-6576-4eeb-b053-59e59d491d46", "value": 3151888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173808, "uuid": "217f9162-1a91-4ad1-85e6-7f023a0df610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173808, "uuid": "d6614309-11d8-49d4-a0d0-7542b30d4cab", "value": "library_1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c5f6a9-3dc7-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664216215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216215, "uuid": "22883fc7-96fe-42e5-86ce-711b60a8bd22", "comment": "Malware payload (IcedID)", "value": "b055b549a81ce1c75ddd7351354ffa0e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216215, "uuid": "b0cd5661-c508-45fb-b673-3425fb3a082e", "comment": "Malware payload (IcedID)", "value": "7778ec0e63f82e94f18b343c2ebe1950b6057a1dc3067c1aeedc0ed6cbe69355", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216215, "uuid": "166716ca-375a-44cf-bead-b567bb4767bc", "comment": "Malware payload (IcedID)", "value": "5f26efbe932c7abf2e5e475fe52ab6f1ec64437e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216215, "uuid": "d633a9a0-6466-45cd-8bf1-f3c44b8af658", "comment": "Malware payload (IcedID)", "value": "5b6862a8bcefe8a37cb0a125c0747f48f6456b81b9129139407c35fae46b49deb89b4764f90ab2413b8f18caa94bcc46", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216215, "uuid": "819ac5e7-7f05-47c4-b197-709281c15917", "value": "T16A15F105CF10616BF00B693F371765D7A8661C27304BDE0AAB86112E2AD7FA0FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216215, "uuid": "d3820f6d-3cdd-46d7-b5c1-f008e450bb0d", "value": "12288:wZCVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEevh9d/+C6z5Yb1nsmbvDq:wZCV2jUeQRI5wPN/H8X5SsmYi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216215, "uuid": "76eac12c-bc33-48cd-8e46-6dea768b850a", "value": 886700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216215, "uuid": "952ff5ee-9f89-4089-8d30-74c5a314b958", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216215, "uuid": "cc9a4a0b-a321-4c13-9aff-9a2832627e44", "value": "musonic-document-09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413c9536-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173202, "uuid": "30da94b5-383b-4676-a487-9b30ae71818b", "comment": "Malware payload (Mirai)", "value": "879d177abddbf624a607d3b3b00a18d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173202, "uuid": "ac9feb56-abc9-4420-9c33-19d3414db5cf", "comment": "Malware payload (Mirai)", "value": "77d411209ce403109d7b7e6862282360e1121c8e7a4f9ec6a58a093adeff9615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173202, "uuid": "2f5fe22c-b6bc-440e-9505-9413b378869f", "comment": "Malware payload (Mirai)", "value": "4cd04068a880be91a24990455c565a04b55cac61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173202, "uuid": "8f28b9d1-a019-4b19-9408-c6f9a379d561", "comment": "Malware payload (Mirai)", "value": "558adc5eee281131d329a5316ebe810e2ecbc48dbdb1b27e491688dfcb1b873a3cba66c7f1423f770b5d570510a2d791", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173202, "uuid": "24cfb8a8-2636-4d32-ba85-66e554599572", "value": "T1BB33F11F50AC7D10EC4D5879018A07748FD832C42B97DA48ED2A4886F7A634B727DE7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173202, "uuid": "727a6c7c-36f8-4656-b878-4d19224dad4c", "value": "1536:QNOV3v2H2PSS09zJ2aJXM6oWeazP4EjvZDRQw/:QO2S8J2Y86GazH/Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173202, "uuid": "830bfe22-672b-4f63-b601-676287d04727", "value": 51668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173202, "uuid": "4c2f0577-366e-4415-8740-20593ce5ee5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173202, "uuid": "7e9885ad-dd2d-466f-a18b-dd2debb624c7", "value": "879d177abddbf624a607d3b3b00a18d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297c3bc8-3d3c-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664156412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156412, "uuid": "70bdc6c1-9891-4509-b6f4-5ecdc6df22d3", "comment": "Malware payload (GCleaner)", "value": "3e521e8675d4867970ae8430cd8bff5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156412, "uuid": "cd60ea1e-9c95-4654-b337-f149cb3e9246", "comment": "Malware payload (GCleaner)", "value": "77eb4811681537b111712c5f61cf3d70b4456cebc7139dbd1f898a1659fe6ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156412, "uuid": "b8b14b6b-1f6b-4cac-8dd5-8cd28f4f9ed9", "comment": "Malware payload (GCleaner)", "value": "26d03e2385fbddc258074c24e486e904b4a99d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664156412, "uuid": "69582be8-7246-43c8-b5f8-29f3337f93c3", "comment": "Malware payload (GCleaner)", "value": "a41132856b328e9e3e12df86431ccae7be542a714c641ab363037e77cb813c772f1b6dc0b82659a18a12311d86674936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156412, "uuid": "7a284a36-e035-4b1f-b1c3-e8bbc5ef93e1", "value": "T1A944F1023D80D531DC697232D836EBF40ABE685115656683B7B83E6EAF327C06A753C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156412, "uuid": "eff0f159-38ab-4ffa-a4fa-f5b689b8b2ae", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156412, "uuid": "c59cc94f-e106-4529-b5c9-dccf3f5efad6", "value": "6144:mCSVx/PymtdE1pLLAYhSRczycCuipGcC:BSXymtdErLTG5cCRGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664156412, "uuid": "51a8fedf-87e5-41e4-bc54-b1d09694044f", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664156412, "uuid": "89243423-7cd0-486f-adf1-cc25b3fe41cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664156412, "uuid": "2bba3cd2-323d-45b3-9439-4d58b66093a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe200b58-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215609, "uuid": "18b44a1b-83cb-45df-af16-45db7e892a9b", "comment": "Malware payload (Mirai)", "value": "210f399aaeeaa6140f068ba7c554a4f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215609, "uuid": "f0515faf-c9a3-4d65-a093-e6f6a3efbc4a", "comment": "Malware payload (Mirai)", "value": "784469375a016509aabd330a8e12d88033559d7020125abcbfd8ad89913cabca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215609, "uuid": "a334ff5a-0440-4ee0-bb75-6cb06e916070", "comment": "Malware payload (Mirai)", "value": "5cb0ba30b52c181f9cc10284e395aa6ce18c4904", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215609, "uuid": "c04e2443-1972-4a5f-9fad-f9485a954330", "comment": "Malware payload (Mirai)", "value": "235a6d42d0d5197418a707c2742e0ba0fb4128ce532387d97ef791a6b9a8f7cca0a7fc5cf203da2a42a982a8d8634cc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215609, "uuid": "e1f9d326-1c4a-4319-aff5-4810e8e6a58e", "value": "T11E63381BB94181FDC09AC174077EB93AE93375FC1238B36A67D0FE262D55D622E09C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215609, "uuid": "bc0cea00-9ca5-4723-86b4-9f7291ea1fb2", "value": "1536:pUluhdikJUVWMxMa0cFdy3cwpwVp5bqlGiI9lau6YLYbqFUm/VLt:iuhdiaUMSMa0Kact5WlGiIz6YLYDm/Vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215609, "uuid": "38270909-8fdf-47c0-b5a8-2cdc2a1651c1", "value": 68064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215609, "uuid": "15d574ef-dfd8-42b7-a10f-a9ce1f677e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215609, "uuid": "5177261f-16f0-41f1-814f-1a379b97260d", "value": "skidv2.x86_64-20220926-1806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cbed65-3d51-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664165512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165512, "uuid": "ac15c5d9-6f6a-40c4-93f1-af8a5df93440", "comment": "Malware payload (RedLineStealer)", "value": "efe799e2f4505031c22134a10757e1ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165512, "uuid": "5802ad3a-7c3c-40d4-ba8d-fed8f3b5d410", "comment": "Malware payload (RedLineStealer)", "value": "78c6c77ec2b36ad4a40bee8eea816e57606427aedc3efe44c966203b440b07e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165512, "uuid": "63f0c8a8-8a5a-47db-aa47-c2cf52b5a262", "comment": "Malware payload (RedLineStealer)", "value": "22e9d07c53d52021e8e0f55ce0fee9460ee80329", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165512, "uuid": "434bb772-5a20-4205-9c02-ff9b67ffead4", "comment": "Malware payload (RedLineStealer)", "value": "ccc90b5935121fdd55fe29d415b06293ca5ee12e452f044493775d7cb21cfb3d5d1cb44ef895478f1848745ea0544c28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165512, "uuid": "48c60288-8c0e-489b-9f70-80077e08f425", "value": "T166C6090674E0204F6788E6B3AB08D9B577838BCD555163D91AEFCBBB613D7123B112AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165512, "uuid": "4e411acd-df41-466f-9059-90161352e37f", "value": "3eb5d209f4deee0471ab0b8f8e9a1a3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165512, "uuid": "2d445b1d-093f-4652-9d61-3c33be4a5cc0", "value": "98304:wTn01RGaUuHaAy3olT+vosYf1qnTlzS/efUif7i9DBvq+QbfcG3UpN9+67IqIbAo:wuRGZoyo1RRWa9bN9Nf11f+/OM+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165512, "uuid": "c227653a-b656-47fc-b886-68cae10d5899", "value": 11708416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165512, "uuid": "9e1b0b20-799a-4b43-8a6a-48ebb15ef31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165512, "uuid": "31ce3b54-960d-4fa0-a018-790eed6b4f3d", "value": "efe799e2f4505031c22134a10757e1ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53050480-3d3e-11ed-9266-42010a9c0072", "comment": "Malware payload (IceXLoader)", "timestamp": 1664157340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157340, "uuid": "288ec1b2-fbdd-4215-bb0c-2e9865ad7831", "comment": "Malware payload (IceXLoader)", "value": "6210be523c5fab6a205772fc1a6abfb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157340, "uuid": "33784ab5-834e-4686-9bbd-7661435ce4d1", "comment": "Malware payload (IceXLoader)", "value": "79915a1352da45f69fbd193f7bd28bba64949dfe6c2baf8090151e676aad2448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157340, "uuid": "5cc5ea78-725d-4746-844f-c3a5f891e90b", "comment": "Malware payload (IceXLoader)", "value": "b9ad3b37702aa0187592fb39b26148d8b320b6ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157340, "uuid": "b888f6dd-8dcf-4cfb-8e16-a3ec8cf2e236", "comment": "Malware payload (IceXLoader)", "value": "42021e01861fe88c00f8cfbde131b843531f2d2a7d15e1d7de97b3f782611e0b2cd6c4f9f889929905adad89c106b462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceXLoader", "colour": "#91F647", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157340, "uuid": "435c5111-427e-4690-9de7-eb94a073b9a3", "value": "T12A744B54EB918CBAC921633B89C7D277623CBAF44363DB476E251934EA532E15FC9302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157340, "uuid": "c74b7095-1312-46d0-8d26-1f37f3771b20", "value": "ddb8da8ce9f6d7c99471e82a46c98901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157340, "uuid": "56eb2ef8-fcf5-4534-b735-98ca07e6a99b", "value": "6144:ZbslI7b8btZ1WMYORbMV9bwkn8gfyVQhAyPlb/2:ZbvwnEMtWwk3fyVQhAyPlb/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664157340, "uuid": "13a1e178-7ddb-4f9d-a8f5-fff228019e67", "value": 356643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664157340, "uuid": "50b279fb-bc89-4678-8366-de1089e2c736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157340, "uuid": "43af7af3-3ff5-474e-8e79-408bb99b5889", "value": "79915A1352DA45F69FBD193F7BD28BBA64949DFE6C2BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146289ff-3d39-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664155088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155088, "uuid": "540919f0-97f4-4901-9782-0994d5d1fa2e", "comment": "Malware payload (RemcosRAT)", "value": "50b35c36ff8b820bd749844a3f7e3c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155088, "uuid": "dc506465-187b-4234-a1e0-59c17c226d6a", "comment": "Malware payload (RemcosRAT)", "value": "79bb818fc30e74241f91b22bef1226e587bbc3ab5851c75951e3f0578dc9b443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155088, "uuid": "51b13434-921a-491b-9d05-eb0b6b2eb080", "comment": "Malware payload (RemcosRAT)", "value": "9f6371165965c83b97db610bca7ee0e6da6955a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155088, "uuid": "8882a1b9-49b5-44a1-906d-5dd83fe8bc96", "comment": "Malware payload (RemcosRAT)", "value": "663e61facf4de59d71de9ab9a7562f22de99ecf3d3319ca3fe612c37b35f3d54e7ba17c607b98b7fd72b01ad57a2e3b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155088, "uuid": "a616b586-5c43-4a5b-836d-25742271a31a", "value": "T12B55CF957680668FCC169F3584A0DD70A3667C23A637C14F92CB3C5FB56F6D28A207A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155088, "uuid": "90b1d3f4-f2f6-46d9-a654-909b01382764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155088, "uuid": "49c22211-6a81-41e3-819d-0d751818de3e", "value": "24576:uz7VEpXGzQqX8tWakkQ0OALxr89Toy6snv:s7mpXGda3Q0hLx89Twa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664155088, "uuid": "7143d6a4-3a62-4e02-b06b-eb7208f3b3a6", "value": 1312256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664155088, "uuid": "39d3e8d2-e867-4168-a699-545ad7e09957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155088, "uuid": "af214d72-2556-4a7b-9e25-2c09b7fa6ee3", "value": "attached transfer request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bf072d-3d51-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664165479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165479, "uuid": "c10a67d7-4edb-4522-9863-067ca23d6ed4", "comment": "Malware payload (ArkeiStealer)", "value": "158d9316aec4349870263c7822c416ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165479, "uuid": "25e83993-a7fa-436b-a8a5-0eede34b67cd", "comment": "Malware payload (ArkeiStealer)", "value": "7a2a40b536d4cc69886636cfee52eda36c84b8ef3aacef5d45ac599610a81dab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165479, "uuid": "42a3717e-2108-41cd-bb18-e80c23e73d53", "comment": "Malware payload (ArkeiStealer)", "value": "d7f09e7682a0bf2ff225171ab9aed702ea0471e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165479, "uuid": "e9a710fb-7e55-4b8e-aaa5-490ab1482fc4", "comment": "Malware payload (ArkeiStealer)", "value": "df08d5c9cfb6631f3267146daace53005417d19b23e8dfadc0f64ee7c41a164230abdf983943c6fa74f8a59d52d2793f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165479, "uuid": "b96f3653-a564-4732-b733-1ffeccde180d", "value": "T131C6190674E0204F6788E6B3AB08D9B577838BCD555163D91AEFCBBB653D7023B112AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165479, "uuid": "7aade0e6-db18-45a1-a65f-ee340c83459e", "value": "3eb5d209f4deee0471ab0b8f8e9a1a3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165479, "uuid": "2e3a01fe-cfb8-44cd-bbb2-26ceeb59a6e3", "value": "98304:WlXW+rqJ0Qjbfg8WykZwLTG+yFiE0AcBUie6duGUajfTtEISfM3PdZFJFtvq7pef:WGVggIwZlIXajNPTFJirgxRChvA1qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165479, "uuid": "b02b1d0e-4554-4470-a411-e3c0a236d602", "value": 11901440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165479, "uuid": "b49328b8-2891-42a3-a4ff-840b8517c0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165479, "uuid": "32b6867c-a550-49a8-af3f-d6f33db2f63e", "value": "158d9316aec4349870263c7822c416ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356ba799-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664189932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189932, "uuid": "5df3e3d0-445d-49d0-a61f-fdeaf5c9d077", "comment": "Malware payload", "value": "326b5a4d6826c3c2dfa31ad38fae5928", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189932, "uuid": "39b2b880-afda-4a17-aa6b-6a011eae7870", "comment": "Malware payload", "value": "7a3904e7e3bac826c98a3f5433a1f6be1d5c7b4e0a45fbf07bd3da4420ab9a64", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189932, "uuid": "37c6d82e-f3b3-4874-a435-cb7f1344b81a", "comment": "Malware payload", "value": "1deaa5b0e624d0144d23741424c09f073922169c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189932, "uuid": "cf8dda6d-77f2-4bc6-9497-33078485e1c2", "comment": "Malware payload", "value": "2613223b99db5fecd1d4a4799f01e90855d9ecbcda12fc68612f208868ff6c98200b897ed578c1d97c03122872c95bb6", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189932, "uuid": "192f16a4-486a-4d72-bee2-fdae7e93f0df", "value": "T187D42378733576AC4ACBC22E06D2CE150A574575976FCEEAF2FE930205B13E87128176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189932, "uuid": "d938b003-467d-4d02-a682-a82a73000140", "value": "12288:WcAz1XtDQ56z6V9c3D6+S1q2yUe1GtkwqqBvd+T4UkJEXBK+:Wcm5FZj2I1okwqqBF+umd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189932, "uuid": "39a9ab9e-cce4-473a-bd86-652dbd30ebb4", "value": 602479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189932, "uuid": "b84e3fe7-407d-4579-a8c2-4c551932f806", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189932, "uuid": "8e733e8f-c14f-4e47-805d-242569bb634d", "value": "521275002022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9b6ff8-3d4e-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664164332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164332, "uuid": "535428dc-82d1-4b76-bb41-6bf10ea828c3", "comment": "Malware payload (GCleaner)", "value": "a314267102e34f113beebd63d54d4d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164332, "uuid": "d3b0a718-2cf9-45b0-8e2a-dcc75dfdc0af", "comment": "Malware payload (GCleaner)", "value": "7a57b4ffa3a93adcc50c41b08409763c33e292143c0775e8c525957e41c4706c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164332, "uuid": "caaaed35-1abb-4c1a-97c1-c3f875928a02", "comment": "Malware payload (GCleaner)", "value": "90729893843eb2a3d92b78a6691a445cfca6c920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164332, "uuid": "c08ae9d2-14dc-4bdf-8385-79b2e0879d2c", "comment": "Malware payload (GCleaner)", "value": "64b5c2f9ca8cc119eccf73e54c142f23d82c73ce9dd56f9065ccfd6fbc373b0b3c16dd14a61bae1e2b2229d35b2344b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164332, "uuid": "87cc6fb6-0257-42f8-b830-dd85bd50c13e", "value": "T18134F151BF80E832D45932B08932C6E19ABFB85165215A4677F86E6B7E732D03E343C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164332, "uuid": "5e31ca12-0377-4cdd-9604-9d8dd7c1054f", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164332, "uuid": "ef8187fc-e7cb-496e-bfd1-c4e618eebac7", "value": "3072:+Kq0G5avU+CfCV6nG97tfdl4yqKkk1HNsdm3ekOupGtctiCmvPvUwgMB5W+5x:jU+Cfq997z5B1HNA01FrmvPsw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664164332, "uuid": "25bd3a0c-d081-4ce1-80d4-1c6d0a436b3b", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664164332, "uuid": "bb811a01-f7d6-4656-bc17-1783fa16c8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164332, "uuid": "9fa5cedc-3a97-4728-98ba-c8fd0aba22eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd64921a-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664215125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215125, "uuid": "754d326d-1fc5-46d0-b45e-54edf861c6d4", "comment": "Malware payload (Smoke Loader)", "value": "bedc12f0bf88584c2dc4a9e9bb3b4a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215125, "uuid": "1070c9c6-d226-448d-9de1-212ded8c657b", "comment": "Malware payload (Smoke Loader)", "value": "7cfb016588c51d6ce75aeda0afcf0e5f979cdcaa59b2ecc07d488f1a5f6180d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215125, "uuid": "33e92c94-952e-49d8-b18d-1ca584f371ee", "comment": "Malware payload (Smoke Loader)", "value": "a822940d174f6c4dcb5443337aa374a9a7c538a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215125, "uuid": "839eeeb6-bea2-4aa2-8aee-5d54f5e4f53e", "comment": "Malware payload (Smoke Loader)", "value": "cad0fa2f5c0a6e2f065dbc796a322ec9539584e4f4bd43da2d587fc38597c073b83d903bf8ac81fe8e97eca172c54c99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215125, "uuid": "14ce8aff-a4dd-435a-8ef7-9eb4c47a9c65", "value": "T18ED3E0027690C4B3D0678AB56C65D691AA7BB8121DB18A973798277F8F303C2EF35313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215125, "uuid": "d0545dbc-c7ce-4c91-9575-383b24ff3928", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215125, "uuid": "14fa17d0-9a02-4438-96f0-fe931dd2d4d2", "value": "3072:7Lh5Tc55KZjE5RXOEqmGBS5PTMrHBQq3d5B:cKZ45RX7B5PwrhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215125, "uuid": "675e93be-9b97-4bf0-ae75-dc73f6067294", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215125, "uuid": "d55401e3-bbd0-4baf-81e7-4879adc1dc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215125, "uuid": "b6441891-0824-451e-b970-d1fbd75fcb2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011acf72-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227211, "uuid": "c51051d5-bb01-4da0-8aa5-965a22ada90e", "comment": "Malware payload (Mirai)", "value": "3b805dc0f2a531ed94359ce116527b52", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227211, "uuid": "5d55a846-b2ca-413f-a584-20e35db03a66", "comment": "Malware payload (Mirai)", "value": "7d099e25e5ef8545c2ca81271737d0ef69502c3f5714dedb42d25ad4e2c68aaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227211, "uuid": "3cc438b9-4886-4df3-8c2b-86af8e68939b", "comment": "Malware payload (Mirai)", "value": "c3b3ed9c1e4d96d62313af7e18e6cb8132395eb4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227211, "uuid": "4f4d26ae-52c1-48f4-a869-8f3fa55020b3", "comment": "Malware payload (Mirai)", "value": "271b0bd3336a45a9eaa5307ed25ae9aa5910f1ffffe220cc945d4f5ca260e7d3cc6a9488ae1d15556ff2b35e0fef6a16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227211, "uuid": "136d5632-7976-46c7-a52f-25799feca2b9", "value": "T15AF2E17D9601458FD21692B041F90B883C3347A26547CC1FA581B2DB9E938717E4BBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227211, "uuid": "9793b354-cac2-41f2-8ab8-405f5a3b0f63", "value": "768:x9XwWgTvsmXLMEgd5YLW51VHzVY0atquYMs8IbWCHwJgGlzDpbuR1J5G:XXckmbEdWKjxzocM5IPHwVJuzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227211, "uuid": "0d20cf55-1d10-4d62-96ee-0f83f62f9b55", "value": 37152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227211, "uuid": "628e650c-71a5-44d3-a1cd-71c667c976e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227211, "uuid": "40a28be7-b567-437c-8a50-dd7ff94ddf43", "value": "bk.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615acb55-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214487, "uuid": "4502ff53-c5ca-4287-ab5b-eb7378f5dbd3", "comment": "Malware payload (IcedID)", "value": "39e9bea9c5ab21d972bb27115b4d4320", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214487, "uuid": "46dc7abe-6584-4a37-8d9f-a832f6763b4e", "comment": "Malware payload (IcedID)", "value": "7d58275a08f80b689b595cabd092d8466ab645db8de60b9cfde04b89738ff778", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214487, "uuid": "a6620ae9-48d7-4308-9857-c8f24113efa9", "comment": "Malware payload (IcedID)", "value": "3cbf53e5a1247a9db30c8f64bcfbc59c1d0b88fe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214487, "uuid": "2a211b88-a640-4ca3-b11a-551a3d4824d1", "comment": "Malware payload (IcedID)", "value": "23e200c61eb1ded435e89f91045ace1c62c2b03529bebb1033fe7a5079576bc0d21553dd7131a9c9d0609bf5ac6c5d16", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214487, "uuid": "a8f994f0-3bfa-4a40-ab1b-6feff4b8f304", "value": "T15215F101DF10616BF00B693E371765D7EC621C2B708BDE0A6B86112E2AC7FA1ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214487, "uuid": "225a9e3a-3147-44a0-9d83-92984cd388d3", "value": "12288:GVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEO4gb9oeU9g4/PXSYqcMmB:GV2jUeQRI5wPN/5Zb9oeZKPXSYqcMmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214487, "uuid": "f33be43c-d99a-49a9-9b47-e6d51d6695fc", "value": 886963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214487, "uuid": "63abd18c-7042-4f63-8ff1-c115bd40ad10", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214487, "uuid": "c11c00a9-374c-4263-a22f-8fabab048529", "value": "mimagen,document,09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3298843-3de6-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664229738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229738, "uuid": "ebb20c59-977d-4e55-a14f-4cdfe26c6871", "comment": "Malware payload", "value": "cb0bd0bf38342c8fda2b6f8ae761c46d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229738, "uuid": "c9e83e96-1570-4998-8007-e8bc553a722a", "comment": "Malware payload", "value": "7d887e39bbb67f8c50cd36743e2b98ba96e6df226aa49e38c51c919cf2ec8c8e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229738, "uuid": "b33afe73-c078-4f74-9fbb-be87da89a22e", "comment": "Malware payload", "value": "a6a19a8f1d1ba6f1d6a0b3494288120f3521d28b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664229738, "uuid": "164e9e68-67a0-4165-bd36-5c3411aad5a3", "comment": "Malware payload", "value": "f4df09c2d1ca2e4a09554d3d3aa2a06ee7627acb3a3effad101c75edf7d4a9bffb247b2132d81845332fc292afe32a21", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664229738, "uuid": "2b3551aa-1464-44ac-928c-be9d47c0dfd8", "value": "T121E4D059F2C16EDBE233983BE1B712821128FD615645D64F60DCF20F36B26421E67FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664229738, "uuid": "3b088eeb-33cf-4197-a31f-fecbcc345040", "value": "12288:5iXupIuCH0bz1NInOlNT15kQfnxeYnWzAlNT15BQrxs9V:5iX6ITonx5kAFKxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664229738, "uuid": "726d6b2d-57a8-4f22-b8a3-6e0f9a61371d", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664229738, "uuid": "aea5a04b-390a-4fa8-8ae8-09bdc2fbbedd", "value": "application/vnd.ms-powerpoint", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664229738, "uuid": "80f0a245-973d-496c-9695-87c9aa25ef8e", "value": "7d887e39bbb67f8c50cd36743e2b98ba96e6df226aa49e38c51c919cf2ec8c8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaf348d-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213867, "uuid": "c71e7ebd-215d-4e39-8bfd-9f3f2affea79", "comment": "Malware payload (IcedID)", "value": "0ef1a9a3a21786ecfa41b2dde315f262", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213867, "uuid": "783f91f2-ccbf-407d-81cd-c21b0dbffda1", "comment": "Malware payload (IcedID)", "value": "7fc1d7ba1c77dc2d93a982ea92db6c81d2af658d5ba5116c7167fa82614d114b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213867, "uuid": "cdf6c0fd-4de6-45ea-b258-ff5d4aaeb43b", "comment": "Malware payload (IcedID)", "value": "721205a2bbe8bcdadc17dfd4fbb1f724642a1206", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213867, "uuid": "90aa893d-5cae-41aa-9e76-d4b6f2ae53d6", "comment": "Malware payload (IcedID)", "value": "f7d6c07366dc760054bb5130bf8321d0addeaf9bcdfdd319003ed85f64c09546eaf70176fbc3a88ade5668b02e106b29", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213867, "uuid": "5982d240-b817-41ae-811d-6a129fdc0920", "value": "T1F515F105CF54606FF00B693E371355D7F8A60C2B308ADE1A6B86112E29D7FA0ED36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213867, "uuid": "067d76c7-fed1-47e4-a176-0447c7c0d417", "value": "12288:20uVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE5fHhmuVOkGnCNl+lmqej:20uV2jUeQRI5wPN/UBmZDd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213867, "uuid": "91ad1d78-4e38-43f3-8b98-10131df004bd", "value": 888074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213867, "uuid": "cae32350-9f9b-455e-9b7a-cf09bf75643b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213867, "uuid": "d97f3e08-57d6-4648-85a6-1ec181c0ab05", "value": "kingwoodcable-document-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6804846c-3dc7-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664216217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216217, "uuid": "8d9f0d90-5b55-4453-afc0-789360f7bfe8", "comment": "Malware payload (IcedID)", "value": "c70608e32fa0841a26a477521ba26964", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216217, "uuid": "78d8ecf3-c815-4389-bd12-fce37b1d4f3b", "comment": "Malware payload (IcedID)", "value": "80388e408f4208e1ddd8cf42d39ec382fe085819c4431013aeb5e609c32bb014", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216217, "uuid": "27a461f7-900d-4b75-a148-f9c8185e13c1", "comment": "Malware payload (IcedID)", "value": "bde8feba267b31dbd39fa6437a63b57aca48925d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216217, "uuid": "1cc44e98-44a2-452c-8bd1-fa42809442e4", "comment": "Malware payload (IcedID)", "value": "d95a85601e9fe57c0ca66af854a2f8ed7470882ad847570ec57be389aea1b5b61c70e2c334247aad642ce1a2114536c8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216217, "uuid": "67147570-623b-4e69-8885-d6227c1bdba5", "value": "T11715F105DF40606BF00B693F371366C7A9A50C27308BDE0A6B92116E29D7FA1FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216217, "uuid": "d09427d1-2e8e-4553-b957-e0e0f2feab1e", "value": "12288:lVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEV+rAjDDK2HiFRpr2MmQ:lV2jUeQRI5wPN/vUHDKiaqMmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216217, "uuid": "8b8690d2-8968-4a97-a10b-e8a2062aab24", "value": 886671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216217, "uuid": "0041048c-dfe7-41c6-9208-a3232367f12e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216217, "uuid": "6d22243c-3a16-4f23-9032-53e1fcb2b9aa", "value": "nehp,file,09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0527531d-3d52-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664165800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165800, "uuid": "513d9f9e-9b0f-4c62-b3f6-ee039d99cbfa", "comment": "Malware payload (Formbook)", "value": "6ddf8fea67d0395e8a80b12436421fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165800, "uuid": "2b735836-b625-41d4-b52b-acda26eb2385", "comment": "Malware payload (Formbook)", "value": "806a765203bdd0a1e4c715bf6022dce830d04ae041ef978b3b2890b158a7e180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165800, "uuid": "281064a2-2583-42ab-adfd-811af43644e0", "comment": "Malware payload (Formbook)", "value": "260717c42ba6ae92dc88eba4abe06c3ea17607b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165800, "uuid": "b91ad149-80ba-464b-aa0c-4e905b3689a0", "comment": "Malware payload (Formbook)", "value": "9e39207ee563ac1fab498240ca3add5084c9308bb028eef1abeffdea0e74aa5deffd964547633461c2f33f783b12fa5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165800, "uuid": "2aab5bce-77f8-4911-894a-dd4d1a8a2977", "value": "T16D426D0BF7A48536EEE642F418269B94133053707C12D7CABCD892A53D29F988BE1F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165800, "uuid": "6bc67b5b-b161-401d-8872-27a82df035c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165800, "uuid": "c101b22d-4051-4a2a-aa5a-cce8454750ab", "value": "192:0/HCd8pL5pJshCE+29vuS9iDA1DQp+AA7g+4OW4/4Ic6nGmE:0vC6pL5LskE+CZYD8DC+k+IWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165800, "uuid": "3e7b0064-da48-48c5-9895-112a6b7c3a01", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165800, "uuid": "241dbc78-a4af-47ee-babf-f489d1c5bf63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165800, "uuid": "44a796be-8387-491f-b22e-9cc8ac0b735a", "value": "SecuriteInfo.com.Win32.DropperX-gen.12246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8886e8b3-3d8f-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664192219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192219, "uuid": "66adc39f-3492-491b-9b1f-774ea624d3ea", "comment": "Malware payload (RedLineStealer)", "value": "7c0da6486a0d127e8eb97c89beb99b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192219, "uuid": "f6199203-7d2f-4481-aa3f-6cf2b372ef49", "comment": "Malware payload (RedLineStealer)", "value": "806e158793f38f4ce3d4433582067d62e0616442d235d4735cbb410d46e397df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192219, "uuid": "ae3423ae-44cb-4d2c-8ff8-975013a78328", "comment": "Malware payload (RedLineStealer)", "value": "a4dbe2985aefa5f9c7de8dd5677f66fd363ec1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192219, "uuid": "59fdac5b-7aac-4733-a3f9-4389c949e05b", "comment": "Malware payload (RedLineStealer)", "value": "78212b8f86c04a52704e5a23548ba2d019f6b61e7f86b9919605733fc16026b7ec84112829690bc37c3602c4c39bf6f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192219, "uuid": "9d6c278a-af05-4bd9-9e9d-9af0f13716f6", "value": "T172E3E0103B94D9B3C1118A705420EBA57FBA7C619A394A833B583F6FBF313D199B6352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192219, "uuid": "d4497be0-e102-42c4-9d30-7b3ac882efc5", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192219, "uuid": "78ca6ffe-9df3-4160-9ce7-386c58b8f00d", "value": "3072:UCQ4z5smIxMGShl3+T4g06z9cMoB0Mkst5B:7+MGAl3BO2gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664192219, "uuid": "65d02210-8d25-4396-8fda-9492447d4181", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664192219, "uuid": "701188ee-cdc7-495a-8671-473ea66d960c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192219, "uuid": "664cd6cd-3919-473b-be27-92efb967b359", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63a374f-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213449, "uuid": "0ffea08c-4465-4405-a227-2e3be6f31bba", "comment": "Malware payload (IcedID)", "value": "b48acfc1e413b37d29e7284e4dc059f4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213449, "uuid": "a4284f4f-b4e0-4b98-9b7e-94bf2fb2da12", "comment": "Malware payload (IcedID)", "value": "807fb8634a8e1fea7d7927dd6b00a351e51b8533009d76184a930f41ebcbcf49", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213449, "uuid": "b6caa09f-4787-410f-ab8c-a86b0adccabf", "comment": "Malware payload (IcedID)", "value": "0518c18f78faf9e97be202a9c530f9725c389163", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213449, "uuid": "a6ae5176-051f-493a-82ae-cc0a85abab2f", "comment": "Malware payload (IcedID)", "value": "f2c8593a340e12297b7d1a2aed2c081dd465c7a9c922f5ce85535e056bcda2d847b0172db0d0e3da612a46a6e7ade328", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213449, "uuid": "60e112d9-ee4a-46ac-b566-adc13d3f940f", "value": "T1A915F105CF50206BF007693E371365D7E9961C2B308BEE0AAB96512E1AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213449, "uuid": "d6cd151a-b88a-468b-b683-5c4fa8d0cfbb", "value": "12288:TJVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DESaYjfH9lvYz9Q6d6:tV2jUeQRI5wPN//a0fHAz9QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213449, "uuid": "ed19b661-a805-4433-a44b-f233b1643f7f", "value": 887119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213449, "uuid": "5f7141e5-b6b8-438d-aaf8-4ba2e169f870", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213449, "uuid": "be070dd0-41c3-4702-93f9-49dd35e0ac3e", "value": "mvsdocument09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f59224-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174419, "uuid": "63588394-78cf-40b5-9394-4426acf09104", "comment": "Malware payload (SnakeKeylogger)", "value": "54f32e2168fb40c14ee1388cb860a714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174419, "uuid": "bf746fb4-1b49-4c43-8ef1-5954e3177461", "comment": "Malware payload (SnakeKeylogger)", "value": "8087e9377059c473e66ce6293c2e2c9de5330723a30ffcea8950c33b0e0303f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174419, "uuid": "9f66afaf-31bb-4724-9a2b-6aa6652eb050", "comment": "Malware payload (SnakeKeylogger)", "value": "4f606765f59e9f63a7a5028a08819d8364194057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174419, "uuid": "450bf352-fae5-4a25-a58e-42a57126bce2", "comment": "Malware payload (SnakeKeylogger)", "value": "dbe1670f16aee45ff1718b633675111c0e5690438b58f7b52b7b54516f8fd3cc933cf21bab55306dc3aa777e335c4017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174419, "uuid": "c825a556-f682-4a29-8170-d29d3dc76fce", "value": "T11935F13317EB8E4BD01636B485E1C6B1A7AADD08E477C24B67CA7D1FF0B71229A61710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174419, "uuid": "17848d11-13ac-408c-b9ac-31e8dbe9ec27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174419, "uuid": "fc5e526f-6465-49ee-99d5-970de22167b6", "value": "24576:8YfsI03Y6+ySGUrhJUHOPG5oGgjhArqJQeASnxwcE6Sccwky9ltkZ:/sI03dZgFJK63ArqJdASnxwx6SwkSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174419, "uuid": "8919ab2f-f3b8-45a4-8397-2c13a681fdfe", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174419, "uuid": "e914f179-88b0-44d2-814e-979a9c116a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174419, "uuid": "8830b59b-9d0a-49c1-b005-5b15cb5422da", "value": "receipt_scan26092022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82156711-3dcd-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664218837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218837, "uuid": "1fd2dca7-5021-47ce-8e1c-f45278a6816e", "comment": "Malware payload", "value": "a5b42b8db00153c4edf1031d94bbb70f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218837, "uuid": "f89ff496-cc60-4959-9604-99144de22bea", "comment": "Malware payload", "value": "808cda366d8faa3931f23e08259ccbf016646ed93b60728277114e8a7d110b07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218837, "uuid": "7cb41da5-d734-4f7d-b6ac-c383a0fdcf14", "comment": "Malware payload", "value": "53e8af0698264e55215a93f43a586f6e260637b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218837, "uuid": "25a4a1f5-d5b4-488c-9901-36a89dc4acdd", "comment": "Malware payload", "value": "92e3ec324511ea4385f245317ce66efb8ff9203c2d27f2348a51b80a6aa130996fdfc1c7814ca482c470c4feed910dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218837, "uuid": "81283927-4a6f-4c6e-bad5-4ae15df6a752", "value": "T1E076335137D688BAC3A74230C61D5BE8C071EE2A8F5478A77F884D5D2F2B904E1AE17D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218837, "uuid": "0791cd88-9fa2-4b8a-b5f8-6ed3e9f7536b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218837, "uuid": "bb44ecf2-1e94-440e-aebf-3c79cea0cbe9", "value": "196608:91ON/2c3Nju+okpDZFWOjiwvPleY+nSaHyv0VaTvi:3ON/2cSXOewHcYta+0VaT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664218837, "uuid": "dc8619eb-c99d-4654-ab50-c0db6bd2fd4f", "value": 7625537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664218837, "uuid": "bc50bdf0-dc51-4881-b8f8-7be1c0e41efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218837, "uuid": "23125ceb-7733-4153-abb9-a8d793290ea2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a3f844-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212854, "uuid": "b9c5cad5-2d6c-42a9-bfc9-dad3eb886aba", "comment": "Malware payload (IcedID)", "value": "8c82042cb4799c5da6da2e8fd68cad7c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212854, "uuid": "aa39bb40-a843-4b49-8708-22be86cda61c", "comment": "Malware payload (IcedID)", "value": "80a44124ac0e7a9d5857dd15535b4353099272b1803b2029262d0e9d2b4a927d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212854, "uuid": "273845c4-c3e3-4891-85f6-cb420b9c402a", "comment": "Malware payload (IcedID)", "value": "fe27d3093baa1a9e156529c41513fb5ab51e90b3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212854, "uuid": "c7071279-da91-4180-ad58-cb8982638e57", "comment": "Malware payload (IcedID)", "value": "dc5f19426a9a7c41c3239e2c3f1122ac650f0d4365497c9d5f7aad770794c35e9f64f833b774e1902f608bcfe619bb27", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212854, "uuid": "286dbd42-14ce-41ed-b341-41c96873474e", "value": "T10415F105DF10606BF007693E371765D7A8A60C27308BEE0E6B96512E1AC7FA0FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212854, "uuid": "4cc5bbba-a41e-4a15-8fa7-f13aff68d0d5", "value": "12288:tbPrVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEFp9d/+C9DDK2HiFV9e6y:5V2jUeQRI5wPN/MUODKi89eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212854, "uuid": "4ee2fe4d-33e1-45dc-9bfb-6524a21f3587", "value": 886816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212854, "uuid": "089930b3-6c44-47d0-bda4-2b0e695909f8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212854, "uuid": "f00f4276-5079-4c44-952b-21635b493274", "value": "monahanfam.file.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d396de89-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214679, "uuid": "c42247fe-5636-4e5d-bb8a-dbd3747f4806", "comment": "Malware payload (IcedID)", "value": "890805470da9015f646b59db0a19e26f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214679, "uuid": "aa19b65d-3321-4ab6-8389-7291ad811b1d", "comment": "Malware payload (IcedID)", "value": "81c6bbed61f2ef06c3a64d623a882a9f5d83cf35aa63ee9d90b74af72122d30f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214679, "uuid": "502f018a-777b-4e14-85f2-b98931536677", "comment": "Malware payload (IcedID)", "value": "66266a1d0a3215c097913a8470e57bb6569c2e1f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214679, "uuid": "b8f095a8-d43c-41cb-a91b-cd453a8ca6c2", "comment": "Malware payload (IcedID)", "value": "fadc35b29800ef580d0d2ae4a29db971c4a50b2888aac6b73b90f065fbb109bf1c4d167574f8aa1c0b8b56bf21cbe176", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214679, "uuid": "04f69a8c-caf2-4d51-a9e7-87715e5fc7f2", "value": "T12315F101CF54606BF00B683F371765C7A8A61C2B308ADE1E6B96116E29C7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214679, "uuid": "401e550e-5bd2-4256-89c5-3d5208887e54", "value": "12288:AdVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE9vHNxTp/G7obb9f8xom:AdV2jUeQRI5wPN/sHVGs58um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214679, "uuid": "d057f7b7-4726-45b4-9337-58945a27da03", "value": 887097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214679, "uuid": "1c15ada6-452e-4ff9-8b73-53f894ce1638", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214679, "uuid": "1f1fb618-af13-4052-9c26-910ab122c746", "value": "monomoyislandferry document 09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8f0992-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214672, "uuid": "b3e4dd76-a097-4279-894b-9f2cfdf87c04", "comment": "Malware payload (IcedID)", "value": "6f651aca2bc78559404475aeb81f4bd0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214672, "uuid": "54e3091d-69bf-413c-b18e-20c84625cfce", "comment": "Malware payload (IcedID)", "value": "8279ce959f0a6218a93336f9ce5e9cbee68e62faf40027e33acd968237acdf71", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214672, "uuid": "e93ebd6c-dd33-48a3-b25e-c22062724913", "comment": "Malware payload (IcedID)", "value": "8f0393c2f4521d256f8ba8e9fc855776cccf91a4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214672, "uuid": "0d31fa31-9605-4b92-8f2a-31b5808b1c22", "comment": "Malware payload (IcedID)", "value": "9e0d633a96aba2872001be5db786b2a11b8a1c2940344e055e3b6bf91accb93175db889356544ff9ec98c9f9f0cd8659", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214672, "uuid": "e6a4ca59-6113-4b52-8687-164a54d315eb", "value": "T12C15F101CF04606BF00B693E371765C7A8661C27708BDE1B6B96512E2AD7FA0FC39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214672, "uuid": "759989e9-7c2b-45aa-af04-43576ba86706", "value": "12288:MVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEL6HNxlU9g+6dQhF0:MV2jUeQRI5wPN/1HpZ+6uF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214672, "uuid": "8132fccf-dd08-4d04-b29a-c6b0d413274d", "value": 887016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214672, "uuid": "bf20ea0f-d047-4291-9f2e-22ecef9e9f28", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214672, "uuid": "520e666c-1d99-461e-a236-55f892a4e613", "value": "mobiletel,invoice,09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59aa764c-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213186, "uuid": "d1eb660c-d87e-4e67-9668-fde50a5d5904", "comment": "Malware payload (IcedID)", "value": "0470b1147379370ff7c2463506d24adf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213186, "uuid": "21a3bb07-fd44-40a8-9eaf-9731390763f4", "comment": "Malware payload (IcedID)", "value": "828ba54cdeef23fac240726ae04f3768a35dc3c871c9eeaea685421916d872c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213186, "uuid": "cf6fdd49-8eb1-4215-a8f1-b455689d4449", "comment": "Malware payload (IcedID)", "value": "8e7dbdb5aada7ef2a6cb7af44c219b4a0d7d1a55", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213186, "uuid": "52f484be-a9c9-4bdf-b418-f65227d93ff9", "comment": "Malware payload (IcedID)", "value": "e41def27ba785c29b0cc04d17326b589434dfab2a85ccdf83d36ba8ea8847a3b6743688f1eb125a60fec65aab1ded1f0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213186, "uuid": "2346a94e-8da0-482b-8705-bc21fe7833e8", "value": "T1BE15F105CF10616BF00B693E371765C7B8661C2B708BDE0A6B86112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213186, "uuid": "1779b86f-4352-4588-85ae-b24d8c4f8228", "value": "12288:lMPVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEgpcYU9gJDumhFV:iV2jUeQRI5wPN/pcYZJqiFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213186, "uuid": "b239ca36-e830-4e63-a05e-1e776d2959c9", "value": 887204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213186, "uuid": "10739e3c-af1b-492f-94ad-f69ba0eb2f77", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213186, "uuid": "80aa8304-a434-48f2-be90-9adfc9eab3d7", "value": "musicinyourlife.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5459eb9-3d8c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664191006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191006, "uuid": "6dd8aa43-ddc5-4876-8077-35266b2f57dc", "comment": "Malware payload (Smoke Loader)", "value": "932a7cf09ed7464e229f8efc2037450a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191006, "uuid": "51ddf93c-d984-42a5-8d22-82f23a7524b0", "comment": "Malware payload (Smoke Loader)", "value": "832f4376cb37f4e48822d69caa9c09e3b1d50861f6cc40423a68ac3a6fc20c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191006, "uuid": "f39d36d1-2f7b-4602-8c25-c8148c2a8ef4", "comment": "Malware payload (Smoke Loader)", "value": "e16bedcb3bf80302c2845700c014731c21d3727e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191006, "uuid": "998aa54f-8607-4aa6-a617-80028c40b92c", "comment": "Malware payload (Smoke Loader)", "value": "cf5b4283bb07f5d7c9d66fcefa70d03becfa3b33789827186e8987a49103dbfa14c44260362e2172e7c47a59b8e269cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191006, "uuid": "d6814d92-0637-4363-a23d-ffcb20d72b4c", "value": "T1CBE3F1417A84D8B3C00596701831C692BF7EBC3159365A477B586EBF6F332C3AAB6352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191006, "uuid": "b1484021-64be-404c-9150-cbc46e712e91", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191006, "uuid": "6e15ce17-0205-41d8-bc83-10578cb17cc6", "value": "3072:EpAAmz5c45Oc+wYW13vrqzHEo7ziuvDVBTJO6rROr5B:NphxqrvPrft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191006, "uuid": "bbd1e0ac-1258-4885-9cc0-ee1100bb4714", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191006, "uuid": "b163e206-8283-4533-9d60-90f429557291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191006, "uuid": "0ebbc65d-fbf9-425e-9b08-b42b505a7707", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ae608e-3d50-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664165134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165134, "uuid": "9b3449da-01f0-4246-aa12-b5ced2b2a2ff", "comment": "Malware payload (Smoke Loader)", "value": "0cd40a610884abee0a158339af97a09d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165134, "uuid": "d7d95887-e404-4e23-8c78-fecf043c05e5", "comment": "Malware payload (Smoke Loader)", "value": "835d1eafd3fd258240c76cd6739667f07c510c139ef7e3f427d16bb57dc34bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165134, "uuid": "243c38f6-58bf-452a-aa2e-d6830dc7a15d", "comment": "Malware payload (Smoke Loader)", "value": "83fe493ace35279925230a4978df53ee6250649a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165134, "uuid": "5de24589-951f-4658-9fc2-1c68351c68dc", "comment": "Malware payload (Smoke Loader)", "value": "a97557c3aec5bea512a798e668fed934cc9905c56ccde264218b88fe0e080b0affc54adc8a87d58a1a67a470daaee966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165134, "uuid": "8370e980-7325-423f-91e5-9da0b525779f", "value": "T199E3F11277A0E972C01193B01835C7A06A7F7C6245369A473B582F6F3E722D3BA7539E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165134, "uuid": "988a3b36-19dd-4ee6-81ff-7cb52b86353b", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165134, "uuid": "a79fe650-4264-4aff-b288-0a0aa80a95f7", "value": "3072:D/fcG5O0SGhQYSNYBYyQI4/sigju3R4hdBTy5x:OlIxUydfA3oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165134, "uuid": "de3b5e3d-e08d-4639-85da-37736c143c65", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165134, "uuid": "03acbf27-27d1-4917-bdb1-cb8d4cee9fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165134, "uuid": "8e41dfe4-bfa1-4a52-b25a-81ab417a11a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785c7a18-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664184461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184461, "uuid": "1145f86a-cb0e-48ff-9a73-be31bc4b0d30", "comment": "Malware payload", "value": "c99033f3545c96a6a2528d7f6e9454b5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184461, "uuid": "4117a73a-8b14-4358-aeca-110ab3d2f1d2", "comment": "Malware payload", "value": "83edb9186ef9db6225a5098f78218db550d6b6bbb18043f9462822ed2b006607", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184461, "uuid": "da1460b9-4663-4409-86bc-771895eeced4", "comment": "Malware payload", "value": "990fa3c44ec69681b7e65fa80840943d2a3f0ade", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184461, "uuid": "998d54b3-9843-4e67-b3ed-7766f25c7b67", "comment": "Malware payload", "value": "102f30ba38e121dad3547250f52034fd63cf6fcb9898d12ee55b6ef4b9dc01edf5b69087a699a494268cac582ab0b683", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184461, "uuid": "9cff1900-834d-4259-b347-8d4f6909056a", "value": "T1D5E63382F7D9BD2FCC7380324BB51A7661864C59CB13E2436965736C99F7AD08E81BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184461, "uuid": "3bd21659-c44e-4475-8f83-50c8dd98b200", "value": "393216:imaBC9u9O4X9uGtUNCK54bOZkLx0hb2r2fZRpoBb:mBVc4X9uGtUXzset2r2ffp4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184461, "uuid": "b52f0771-e420-4840-9d2b-0e51b1a4931e", "value": 14004085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184461, "uuid": "b7f931cd-6270-48e1-9317-a46039326ba8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184461, "uuid": "e5dc150e-5d9a-4935-b357-f91e5cf1b8df", "value": "83edb9186ef9db6225a5098f78218db550d6b6bbb18043f9462822ed2b006607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1da8e0-3d44-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664159985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159985, "uuid": "4f004fc1-c2f8-4190-bcb6-735d4a9c5606", "comment": "Malware payload (Smoke Loader)", "value": "f80aa621bd6022f5f7cf713c21004230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159985, "uuid": "c3b8ee84-2d97-4d23-a93b-f927864af433", "comment": "Malware payload (Smoke Loader)", "value": "84195fee744253c67106bcd4d9f01b8ae0f833eacd8ea349c6731118441b7844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159985, "uuid": "b391bc74-e569-4abe-97e0-20da03a81d56", "comment": "Malware payload (Smoke Loader)", "value": "91eaf26cfe1687409f516eeedb23a30089b3f825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159985, "uuid": "b910272a-f553-44ee-9f51-5168357f740f", "comment": "Malware payload (Smoke Loader)", "value": "efb02b7d5575b7f840e90be084e7b621ce62082a240ba0d83db84abaf5500cfda2c8c32760aa659e433afb5e6d748ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159985, "uuid": "025f09dc-debd-42e1-baff-d1d9dd8dd1a5", "value": "T1B504E0023B80E972C86295315434DB915ABFBD22563716C73B982F7F6F313D20AB635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159985, "uuid": "60776866-e40b-4fb8-8a6a-dffc370d985b", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159985, "uuid": "e06f44db-41c6-4875-870b-b93c0ff32eaa", "value": "3072:LLwvgnNo8s35BNn5yS5JWbonsGBr6nuDT5wsB31G3l5x:iLn0gMbo5BrtT5wE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664159985, "uuid": "0aac4585-8cf5-43cc-bb94-cd1f5047b20a", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664159985, "uuid": "79d1e7df-75cf-45b1-8cf8-69a74caa9b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159985, "uuid": "6763b727-d556-422e-b510-166fad8de534", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaaa6b86-3d5a-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664169621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169621, "uuid": "79fd2a87-05a8-4f1d-96b0-40e244845f7d", "comment": "Malware payload (RecordBreaker)", "value": "62db2d1c5590385c8e93980e8e24f2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169621, "uuid": "d72cb1bd-5ff8-4de0-87be-a1c3ab50d1d4", "comment": "Malware payload (RecordBreaker)", "value": "84c8d2870a963d57c96181677dbee08350e71dffe2688d1558e3aff64e880b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169621, "uuid": "471a46bd-2eb0-44f8-b35b-6bb222e38c31", "comment": "Malware payload (RecordBreaker)", "value": "3c8573098655b35753df46966e286161d5fcdcf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169621, "uuid": "7afb9fc3-20d1-4e3c-99aa-e23d98acc032", "comment": "Malware payload (RecordBreaker)", "value": "759eea4df2fd633b46d2e3027cd859eb098fb2cf525f1125314bca7a984ae2b5bb78ad52fd7d1052d2ac392d8fd8d331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169621, "uuid": "4aa438ba-99b3-41b1-92b0-6df5e76283da", "value": "T107E3F112BB80EC73C41596B45432D6F0A67EBC120A3596473B881F6F7F723D29A7A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169621, "uuid": "03a41e54-fe0a-4a7f-a30b-483e29453361", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169621, "uuid": "1c7c33d3-3ec0-46fb-b48b-4806fa64f81d", "value": "3072:A9UHG5MOC+nEd2hhqwJ1DxCBM2XTGYa5x:pVMTlLHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664169621, "uuid": "969b7158-fce0-4004-a249-f2e8cd995c48", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664169621, "uuid": "7562cd57-e8c3-4e0b-9983-40c68e39c256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169621, "uuid": "43291558-1267-4fad-99a1-71d8ad0f1a26", "value": "62db2d1c5590385c8e93980e8e24f2e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d0b6a4-3d8b-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664190519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190519, "uuid": "ba8bfabf-36ec-4e5a-9d67-297000ce62c3", "comment": "Malware payload (Smoke Loader)", "value": "470e1bb0b3ec4f89a79bf51c214bbb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190519, "uuid": "a12051fd-2a8b-47d3-a69e-9ad2d3357cdf", "comment": "Malware payload (Smoke Loader)", "value": "84f140800ec19ffd6a6045cc800ecf3ac69efc10e3ac85aa089bbbe92f06beae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190519, "uuid": "d3b2eac3-5005-4305-8d3d-e1c0e4f29c59", "comment": "Malware payload (Smoke Loader)", "value": "f96a35dbe73224c4e2777f911aff552f69d1e96f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190519, "uuid": "fd398a21-7d00-466a-b251-6777645d25e4", "comment": "Malware payload (Smoke Loader)", "value": "57a0716e29bfaaf0a84794854f79e4c95242fe74dd426e8bd9704308a698abf179d1d8ed9221ee7619c939ed01970e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190519, "uuid": "183b8138-15bd-47be-85b7-fd9d80ee1906", "value": "T184E3F100BB84E4B3C5250A705836E3A1BE7EB8614A75994337542FAFBF313D2BA35316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190519, "uuid": "e4f1d9e7-0a2e-434a-972d-c031a48357a6", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190519, "uuid": "4e520aff-85fd-40bb-9721-466bbfe8dde9", "value": "1536:8TdYHLhXqEeP7Z+JzUz5bi+twM/W/aTcaNikMpdIlSwkJqDgNwA1xgSezjYj1Ei7:8hV3z5++mpV4iSswi2gDgSeQB5Nv5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664190519, "uuid": "5de92362-3d93-469e-bb7a-0dcf567cabfc", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664190519, "uuid": "91b9a4cd-065a-4b3b-a39a-6ab2da1d67ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190519, "uuid": "b462ab2f-8245-4ca0-bfa4-c7a4d8d3da07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28923527-3d86-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664188193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188193, "uuid": "dbe7791b-92cc-4417-ba90-006251f89633", "comment": "Malware payload (Gozi)", "value": "094f41bc4ba276ef66971ddd35c63365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188193, "uuid": "d62c7fb9-d684-44b8-a4e8-011e13e79bdb", "comment": "Malware payload (Gozi)", "value": "857ea4a7ea0b6903992bc62853453e780b8e8e6af87daa574660be322473b9fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188193, "uuid": "7cbc8ebc-92e5-43a6-960d-7153e2d92d35", "comment": "Malware payload (Gozi)", "value": "3aefe72b7f7e4aef5c68c1c5ca60ffa25071984d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188193, "uuid": "e427d957-fa77-4f54-ace1-250a829abbee", "comment": "Malware payload (Gozi)", "value": "3e41dc2e75b63042eb3ac87970a4ec0eb5c04e3d52bdd5ea2d37e57b540b0a3e84628c69a00450c818194dbc1f684405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188193, "uuid": "981b593b-6eb5-4f10-bfe8-3d70434a1e63", "value": "T1DD346E5AA3E10995DD6BD5B5CE53D217EBF234092B24D30F57B0CAAA6F17722B21C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188193, "uuid": "627a2eaf-c542-42b8-9291-022a2051deb5", "value": "3072:UlfGqwJTeTEom3lIkR2SCD6q9KgyItk78mV0dfgxT/cqAlw5VgCK5hcjgSxJFocW:UlDosEPR66q9KgylInd6oqAlD5OnFoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188193, "uuid": "b8ba6a97-e184-4e39-9ad6-ba1858e0fd75", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188193, "uuid": "89c04aac-cb1e-4ecc-8dcc-3c2a1253ea56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188193, "uuid": "6173d3d8-8120-4b0c-bf26-e606b28a57a5", "value": "51b0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9565f531-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212857, "uuid": "c191c7ce-4121-48d1-9eca-ef89e8c026fb", "comment": "Malware payload (IcedID)", "value": "609a963327903814b2f9406858fbbbca", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212857, "uuid": "2674f27e-c5b7-4fdd-aea9-fb2608969208", "comment": "Malware payload (IcedID)", "value": "86905033625f22c13a09dbdf5332c31a1a853ca26a83dc4c5188708a5a035fff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212857, "uuid": "978d1e8b-5384-4528-8261-a95d5ca0d955", "comment": "Malware payload (IcedID)", "value": "d405faa96e77d451084d76df58eae3b0c495a2b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212857, "uuid": "c39c1b8c-e461-497e-a39e-9dbce35d68a1", "comment": "Malware payload (IcedID)", "value": "745cbfdb2dfd308cde14ab4f941cfebc9a8f2c1c14235a93ef8379ace643a3a4e20197b9691ebdd396b88a4744de556e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212857, "uuid": "a793a7ec-152c-4ef6-a2a5-04ff97f44099", "value": "T1DD15F105DF40616BF00B693A371365C7F8661C27348BDE0AAB86112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212857, "uuid": "49249ff6-2eff-4154-9087-f8885961a15c", "value": "12288:vPX1VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEhpcTJWKprlSM:nX1V2jUeQRI5wPN/McTFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212857, "uuid": "6c01b86b-9900-4fa4-ae18-d8cf0f399399", "value": 886934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212857, "uuid": "d18cd1fb-0fa8-405a-9c64-11bceec1db82", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212857, "uuid": "a946d5a1-9a2e-4b01-a8b3-7f7dc52522c7", "value": "myfairpoint.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b06f788-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215282, "uuid": "b157e834-e110-4940-bc59-c13bd9f33c95", "comment": "Malware payload (IcedID)", "value": "a7c938d257bc19280ce73dee25241d32", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215282, "uuid": "19cc95a9-6652-45c0-aca8-031549a9af5c", "comment": "Malware payload (IcedID)", "value": "87684f6b5141c781f2f9bba8b6317a7138c609c00c240c09d21872eea06a06b1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215282, "uuid": "40118494-bf49-4ebf-a72e-32e1332cf4c0", "comment": "Malware payload (IcedID)", "value": "73d6ceb83fd022c99c0b2ea85ebda01467c77f7d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215282, "uuid": "b622541b-431b-4e65-8d3a-3c3292bf5631", "comment": "Malware payload (IcedID)", "value": "6758fdcddad367b8d0a15a399f52287a305b22d9fd6bb33f53cddf01c5fe568c23bbe23e9deb793863c6f74e101ce19b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215282, "uuid": "650b71b6-f432-408a-bc1e-316bc8d01521", "value": "T1D415F105CF14616BF00B693E371765C7E8661C27308BDE0AAB96112E29C7FA0FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215282, "uuid": "1227db07-c965-4394-b2d0-6e8e9cb3434d", "value": "12288:aHVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEEpRcTqz5P6d8oho:AV2jUeQRI5wPN/PRcT25P6lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215282, "uuid": "b9ecbaa3-be3a-403d-bfa6-9371f75c2102", "value": 886826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215282, "uuid": "f502eaa6-b224-4c2e-940e-43af27b6e83d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215282, "uuid": "1c94c9a1-a367-4f33-9706-1ea9a9157698", "value": "mobiletel-invoice-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf03e3a-3d70-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664179072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179072, "uuid": "b525b306-9224-4a59-bce1-e0c7c25beefa", "comment": "Malware payload (ArkeiStealer)", "value": "8f0c690d27ce5ad69c5a145534e37b34", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179072, "uuid": "837b7287-00bd-48c3-be49-3679d1cb0822", "comment": "Malware payload (ArkeiStealer)", "value": "8880c50c5b835f082ffc1b49fd4f53cfd795103b17b60587d7765556df418f8f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179072, "uuid": "45b247dc-e629-4264-bf33-527bce13d9eb", "comment": "Malware payload (ArkeiStealer)", "value": "d653342eb665f82b336c7531eb10915509f6b7f3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179072, "uuid": "0e4ac4bd-8f9c-4d25-bc31-7a50ea366f35", "comment": "Malware payload (ArkeiStealer)", "value": "4657591aed410e1f852edf4c58c8836ff920bd161cda1075a4c8231e567332126ab0f374943b1ee1a5b4b36c72aa243b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179072, "uuid": "d20cb9b7-5090-4476-8f32-711f6bfed16c", "value": "T15BB4F111B9D18432C472253209F4DBBAA63DB9700B5659EFA7E80F7E4F303D19731A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179072, "uuid": "a2812cae-f663-474f-9ec0-bfddbcf58544", "value": "a05b6b647653f286b723f7b8ec217b15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179072, "uuid": "7bdaae1a-dc2b-474e-8c0a-e239a489f43f", "value": "12288:UN1cypy1o1sU+tR6EkMN9F8fXcGuudhDpstntJ6A2TD:UN5pH+PQEkMbF8fJ3Dpspy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179072, "uuid": "a5c73696-fcf2-4c41-bbc0-d511781ad421", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179072, "uuid": "d1784d17-936a-4b9e-8aa9-a0c141f10552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179072, "uuid": "b6ee81a9-4d36-4286-ba4f-dc4b9a606c45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5b4820-3da2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200470, "uuid": "e6fa3d5d-a28d-40cb-b8e3-097f29aba402", "comment": "Malware payload", "value": "5cd821e1069426a837654929812746fc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200470, "uuid": "7e8d75df-8cbf-48e2-bf0a-c1a39f5d3e64", "comment": "Malware payload", "value": "89232034ffe460fd0b435d70860c32f6bc5f5b8848257f706ffe67fe558bcb45", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200470, "uuid": "538a1251-0b4a-4ceb-9d93-d45e532818b7", "comment": "Malware payload", "value": "108b6d8c344a233c22016cf75591afdd7a7969ad", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200470, "uuid": "ab3a1ce2-2559-4482-bca1-52185de4faa0", "comment": "Malware payload", "value": "ce6631faecc5a68ffde914ca0710b4e75f4c9ff9307bb753eee9a1a60802b1e214145a92a058feb270e64c56a28dc5ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200470, "uuid": "af38cf8f-7563-4945-808b-cd5e47dcdba7", "value": "T1FCA2B025CA9DC466C20A93F215480B8B773AA097C123E93B7C9DE5D456868BD0FB2F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200470, "uuid": "56565d6e-497f-4f75-84c9-2c406b6de674", "value": "384:iSL0PtzckZhUMG9wVc1ENF1BPd+I+oYksSl5noNIq/s2vGqPLZm6n8cdWPGLz:iSStzckIvAc1ENFvEJ0lZoNd/nJ8c6G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200470, "uuid": "48505162-52fd-4e59-bdfd-b4ac671e3174", "value": 22374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200470, "uuid": "78147e5d-7254-40bf-9ca9-5e581be80257", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200470, "uuid": "1701f63b-69fb-48a8-8c91-d111d198159a", "value": "Untitled attachment 00005.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca13ab35-3dc8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664216811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216811, "uuid": "878a5004-c74b-4551-b9ed-b9b508faf446", "comment": "Malware payload", "value": "c33ab088eb37444d88af666a37dac807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216811, "uuid": "2d4b4039-7d07-471b-871f-1adf83c6e80a", "comment": "Malware payload", "value": "897d0d6582a5feb51ad47a96fb4a37bfedf267f2a03d42fde5b288dcdcd28e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216811, "uuid": "707e9166-ff8f-4ef4-8464-22e7493a5a27", "comment": "Malware payload", "value": "ad02c196a9732e638cce36795d82738a12cea788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216811, "uuid": "decdef52-a269-49bb-930a-340f496dac48", "comment": "Malware payload", "value": "f620931e1a10e88b36b055e794c66edf064cf2d6717dc3a44b48519727ff32a0aa6d7c9ec59193cea78f298f1face311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216811, "uuid": "ef2f9071-7082-4c6f-922d-1f4d69a260b0", "value": "T10CC3F106E7A1C817ECB24F31157AB77E9EB7A22429406F4707605E4CBF627C1991F3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216811, "uuid": "db824ec5-b744-4bb2-8706-aca907b9b2a9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216811, "uuid": "43bf8cac-e3fe-40c8-af9e-e6e1d420d26b", "value": "3072:MTJ4TJdRVDZ6Lt+uQNbg9fgsKWXPzB3AgQQCXwS:MVGdx6xKg9osKW/zXQQC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216811, "uuid": "1e656763-baaa-412b-93fe-e4dc12174aff", "value": 118408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216811, "uuid": "ec68c2d9-3181-4858-9371-6934467971f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216811, "uuid": "874fcc64-165e-4d44-a396-36b1aaeba0eb", "value": "Preallege.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6569b132-3d52-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664165961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165961, "uuid": "bb008894-af0c-4d84-827e-8c4fbd091069", "comment": "Malware payload", "value": "8dfe0036c90b0cd9e0331c5a65e13494", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165961, "uuid": "8e0701bc-e434-4f84-b78a-47d9e7d1d1cb", "comment": "Malware payload", "value": "89c6d5850811a8f4abe39d0f055d19ed63235f57032ee38ff94185edbed85048", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165961, "uuid": "e76d6df4-0096-4164-859e-98c5e3362f3b", "comment": "Malware payload", "value": "8717f2f089143cad886c67d9f39f92045b1903ba", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165961, "uuid": "bd6b120b-20ab-4709-b991-4a19e0b7b1e7", "comment": "Malware payload", "value": "eb46cfb945319dea924634cc44fc8deeccaf4c617505e86151fb0283f47681f543f93bf92c399bb65bd0d2086e5c3510", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165961, "uuid": "2f238691-719f-4062-9c05-00842fca4de7", "value": "T18CE63382F7D9BD2FCC7380324BB5167661864C5ACB13E2436965736C99F7AD08B81BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165961, "uuid": "725ef2a4-2b5c-4918-bbba-92b7a0399114", "value": "393216:imaBC9u9O4X9uGtUNCK54bOZkLx0hb2r2fZRpoll:mBVc4X9uGtUXzset2r2ffpgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165961, "uuid": "95f39107-ae2f-4019-bdfd-29c87aac2b6a", "value": 14004085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165961, "uuid": "19a38d62-6c67-4c3e-be75-e481c2afcc2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165961, "uuid": "b595cad9-12a9-49b3-8d6b-15341c34caec", "value": "89c6d5850811a8f4abe39d0f055d19ed63235f57032ee38ff94185edbed85048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4868d03-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664171221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171221, "uuid": "9c2c0d90-b40d-4c66-ac44-2bd71d1bc557", "comment": "Malware payload (AgentTesla)", "value": "c7df5341bcc7fe90bc02a1eeb653bb4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171221, "uuid": "51524c24-ae53-4031-8e84-95e575310074", "comment": "Malware payload (AgentTesla)", "value": "8aa4295ba55d4375ddf998facfb0a7a95394cdae9c4eac0a0fbaccae4df717c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171221, "uuid": "d7dbcc1a-6af1-451b-9c6f-131de22eb269", "comment": "Malware payload (AgentTesla)", "value": "6977ff3cc9d29f8649968184f8eb22438449f646", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171221, "uuid": "1c4085c3-1a17-4dc7-8656-ddc12ee5c8b5", "comment": "Malware payload (AgentTesla)", "value": "65c8e3d6c2976742c9b2e9bd2e218084f7be7b8bd5c99806b18255b69fab3b481e471ee77ec7707399e7ab5377d83751", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171221, "uuid": "1174edf2-a4de-41dc-9014-1da02809f1c7", "value": "T18E8252115BA46E6BD9574FF405017242C3F06EE7CF85CA4B5DCE202A3B3A2E17C8AE19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171221, "uuid": "e75d1c37-6b2a-448f-ab69-cc662922eeab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171221, "uuid": "d63de169-2fac-4c73-83f9-0ce345bca2d2", "value": "192:zz35d9xrL9XChCEJKpd2/Daryr13kQf3gvxk4Hkq63D:zz3D9xrL9XCkEJKy/D2yrlffkxtt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171221, "uuid": "9be7779b-9ffb-427a-9d7e-950a03304d8b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171221, "uuid": "79c86308-fcf5-4570-b679-5e0b85ff7de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171221, "uuid": "21ef9097-ed90-41e2-ab81-25f584d9d9e0", "value": "SecuriteInfo.com.Win32.DropperX-gen.20213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a3383a-3da0-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664199440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199440, "uuid": "0e261911-4125-4b7c-a209-40ee02aaac48", "comment": "Malware payload (GCleaner)", "value": "3ff3d92ae81fff0d892ec25f38d69d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199440, "uuid": "2cc46d05-0abc-40a9-b2eb-24222e45eea7", "comment": "Malware payload (GCleaner)", "value": "8b3de1965b1d38636b75c218221adb852f204aace985d074515ac817b42b4263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199440, "uuid": "384030d4-4f6b-4e2f-8e12-c4166912e5ba", "comment": "Malware payload (GCleaner)", "value": "d5aec6c0cba179a116282feb8750d2dec07edf56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199440, "uuid": "fc4a1a14-c8c2-4157-a6e8-6880866e291d", "comment": "Malware payload (GCleaner)", "value": "31fab481ee12e0210a3b43c03f7b6af8845bef31681dd58d378e46f922d8372a59c76655ed0cce0b443db9e07553ed1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199440, "uuid": "96619cf5-ec14-4624-8469-898f63a70112", "value": "T1DB3402607D84A872D02A74708C76C7A16ABFA5510A174E4277F82F1FEF72BD12B39385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199440, "uuid": "6b4267fd-e62d-4532-832e-d1f10c1bd722", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199440, "uuid": "80a0bb51-38d6-4784-a658-8cad8296a8cd", "value": "3072:VO+HcNTF57p1FONiyQy95X0TFZqAxRVAf89CKyQq+DauRMQOpX9AuHfaeyAGng2h:1cxgYmY56f89xqYOQOpW9eyAGg2io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664199440, "uuid": "c44aa01c-b53d-480a-9834-bc9f3fefe130", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664199440, "uuid": "e564c43c-6a0e-408d-9b7a-4ae94af422d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199440, "uuid": "5ba69e05-0475-45b8-a92f-888fa146df13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c911e41-3db5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664208547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208547, "uuid": "58833aff-6f7d-4434-b4b5-3c37970e32e4", "comment": "Malware payload", "value": "21f42191d0705e7d21a3631cfcb9696d", "object_relation": "md5", "Tag": [ { "name": "2537954433", "colour": "#F01B2D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208547, "uuid": "635b8587-c559-4625-8f1d-42554d8c8ef9", "comment": "Malware payload", "value": "8bac7df54648d64d943b80706db9de86ec5787d7cf3b330e860972568d100c4e", "object_relation": "sha256", "Tag": [ { "name": "2537954433", "colour": "#F01B2D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208547, "uuid": "da73e5b1-7833-4caa-8b84-d178507089e9", "comment": "Malware payload", "value": "28b46f4b6b3431e70b42fd9077152e892bfad0b5", "object_relation": "sha1", "Tag": [ { "name": "2537954433", "colour": "#F01B2D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208547, "uuid": "56d39293-47cb-4a1f-9810-fc6ee58d6ab0", "comment": "Malware payload", "value": "ce810541e77a8ac0a10fd353b7f57d7f3629b37580d0dfa7a62fb50dbcd55048b8640fb22a148a8d2ed8a2ac2f62a8f2", "object_relation": "sha3-384", "Tag": [ { "name": "2537954433", "colour": "#F01B2D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208547, "uuid": "ad4ec869-3286-42a2-8c7b-8ec72dead498", "value": "T15554231C169B30DA7D80CDBCA292EB1869B719A33227D7FA00E6077C879178D3575E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208547, "uuid": "a11ab2c0-f55b-4208-a621-99661a280caf", "value": "6144:hG+4B0OYfyppAYMk7Lx7nu+S73gOINHRrAqkIE:k+YfCmytaxAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664208547, "uuid": "dc6ee553-9045-482c-b919-22ae580febc9", "value": 300910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664208547, "uuid": "f987afe2-9f2b-4631-ac49-d1183847bc68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208547, "uuid": "f7783be4-ac07-47fa-8322-75d8781c91ed", "value": "Document_092622_9193.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791c15e0-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664184463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184463, "uuid": "4e48d4af-5c23-4e67-b158-804c793c511b", "comment": "Malware payload (Loki)", "value": "afee30a9a83102d0e1134aa039f779db", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184463, "uuid": "59b6a158-0cff-4e15-b61d-37481d475304", "comment": "Malware payload (Loki)", "value": "8bebe97050b9199b8c7b978437b538ecf8ebdc6f10649247316690ece8e50502", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184463, "uuid": "c372e409-6734-435b-ae5a-f2b51c6f2dbe", "comment": "Malware payload (Loki)", "value": "afd80f660c671699a008798124b0d2ffc3e0d02e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184463, "uuid": "5a569856-4328-450c-98d3-fd8db5204342", "comment": "Malware payload (Loki)", "value": "6ecf73d6dfa9072ff340402716a0c98bdba51a66ead7e9fb6676c9b472b474e8be2e0b26315114a40cc5dcab7fe68af3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184463, "uuid": "f676d2cf-6476-49d1-b2c6-69528fb86a36", "value": "T1EF42A274F6C2CDD4C24BC0D8534F3A522A31F99986C698C1C7ACFB748A9169F4B6F860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184463, "uuid": "b8af1432-80f2-407d-b47e-97bd710fac42", "value": "192:rDva3H/0h71VZa/CgqTR2sVWcptWqE6lNYzGOW45v4/:SH/0h5a/CgqTRpVWcb9EeWGGv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184463, "uuid": "645eaee2-0b8e-490e-ba2a-64e1c9f2f4b9", "value": 12970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184463, "uuid": "7a03321a-42c0-49f0-a407-5436b0734cc1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184463, "uuid": "21db8400-bf7f-4802-aea7-d11455f23aa8", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.14375.23939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4d1432-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1664184387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184387, "uuid": "04502335-e596-4e1e-afa9-8a42a29d0fd5", "comment": "Malware payload (NetWire)", "value": "8562b4db21d7ab120b4164026146663b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184387, "uuid": "9ca10ba6-b517-4699-8e4b-6f555a9be6bc", "comment": "Malware payload (NetWire)", "value": "8bf0c3505263c0d5101750057d26a58377b6af83db9fad3ec45bd412c2121d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184387, "uuid": "728fe9b1-b9ca-4f8d-9a09-d8ed196bc866", "comment": "Malware payload (NetWire)", "value": "825f06b14b5150c0b76398b01969bf13c27d09c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184387, "uuid": "eb66f576-88a0-442d-9943-419e8f51bd0e", "comment": "Malware payload (NetWire)", "value": "2afa356dd3600e7843530462a4188ed7e8e52ec3394726d54e7d11d26268e68368745aed27fae0ab392900eeb3414b66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184387, "uuid": "8cdc2f73-051e-4acd-928f-b471277ec77c", "value": "T17BD4AF23E6914C3BC0631D7CAC975B689826BD013E64DC067EE81E4C4F3939179E9E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184387, "uuid": "5a87ae48-d33a-4d41-ba9d-7a760bf05fa5", "value": "fe895aedd16ceec2ae2be0942fa7418d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184387, "uuid": "97677fea-b2a1-4f1e-9c63-af1c08184cc6", "value": "12288:vBJ1YFRuFKa00Cl3MY5ygMiQOjgONQkS49tN0i/vO80Wynic9:vVER/0Cl3MYRnNQM9tN0kv8jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184387, "uuid": "a67934a0-36aa-4c4b-bb9d-79a460affbcb", "value": 625594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184387, "uuid": "7d291d34-b79f-4c55-96cd-f9dca2f51f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184387, "uuid": "941b3141-b079-429c-a108-338cceeed582", "value": "8BF0C3505263C0D5101750057D26A58377B6AF83DB9FA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fdf54c-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174445, "uuid": "a1a5f3f9-c3a7-409e-9ef8-681112569604", "comment": "Malware payload (SnakeKeylogger)", "value": "5654a13c7cdee095436eff8bc3df63a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174445, "uuid": "48a17814-178a-48ef-b185-bed24bccfccb", "comment": "Malware payload (SnakeKeylogger)", "value": "8c1a2bd2037b1cee06fb12bd64c04ea42a72808c9ad0cad33457e54d90a3466d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174445, "uuid": "f504d122-e9e5-438b-8411-07673f62a3ab", "comment": "Malware payload (SnakeKeylogger)", "value": "d75f3ae0dcc796c4af65a66f22e1e42673bf463f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174445, "uuid": "6bc19e02-6f42-415f-a03f-6cb93e3569e0", "comment": "Malware payload (SnakeKeylogger)", "value": "206226399feadfbf95e899a0f8a9991500482217bb8bd847b26afd0a4ca4893f8c159666223ca9a7ee6634ab4bae5abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174445, "uuid": "2dc89b5f-80d6-4aa8-8533-87f2589fb5ee", "value": "T193459E92A190C89BE86B15F1AC6AE53021D7AE9C94A4810D57DDBF1F75F3312209FF0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174445, "uuid": "0426997e-1d11-4db9-9636-bc70c8b2985e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174445, "uuid": "168fca8d-16ce-493f-833c-e20352b3f890", "value": "24576:J4XnbsnKIVorcn+7blaUrAgBj6Z0xGb0:KXboKh7UYhHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174445, "uuid": "382096e1-ac9e-4e43-a984-626aa270271f", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174445, "uuid": "50227fc9-57ae-4e67-8d91-f8a82259ca35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174445, "uuid": "ccd2266b-c441-4274-a9c1-b2cdce0abcae", "value": "P0A2249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2522867-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180666, "uuid": "e241ae70-2bff-4dd6-9b04-311960e76e6d", "comment": "Malware payload (GuLoader)", "value": "600d270fcfe822e7d085dc1749cb05dd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180666, "uuid": "78cf171e-be2e-4ac7-b0b4-64eac7d4c7e3", "comment": "Malware payload (GuLoader)", "value": "8c1e6237e4bd4bd09f517dc78323e788d1f0bd6e35dc471afa3f272d7d15679c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180666, "uuid": "cbbb79cf-dc5e-4a2a-b1e3-db99f6ffce1c", "comment": "Malware payload (GuLoader)", "value": "96163f2e88082215abeac61600020066298c9703", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180666, "uuid": "7f5623ce-9029-460b-bb91-f75476455eca", "comment": "Malware payload (GuLoader)", "value": "e5e3b384ac16096e3be4b8a3c255966b9123da2a7b3e329682835ca782f48189f3a73e9165f541646c7f83267979b2b0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180666, "uuid": "42f96a35-9963-4cfb-9c41-6a2868f4581d", "value": "T1C61474788916EFED7F5D79EB830F4BFD71648A1383313768E5881095BA90224871F1EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180666, "uuid": "75a6248c-dda5-4334-844e-33b0d0450cc8", "value": "3072:F/KlmoEomNRXYtSVde3UH+NytodlZiC0J7ITevM8K4Ec5CLH:Fkmpx2+IkwuUZiC0J74e3EcwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180666, "uuid": "7dda4402-d2cd-4f11-8d67-8e70db488acb", "value": 195885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180666, "uuid": "2b52949a-5912-4ba3-ab2e-2b9518ed2ba8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180666, "uuid": "f2ad27aa-f3d3-454c-96d7-62787d59ba09", "value": "Orden de pago emitado a su favor.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71909f3-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664191492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191492, "uuid": "98f0bfe7-a200-4fd8-baf5-07d6160a943f", "comment": "Malware payload (AgentTesla)", "value": "e81987197d93779970db5d289aa37a98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191492, "uuid": "05fce91c-d611-491b-a43e-5a1a39988676", "comment": "Malware payload (AgentTesla)", "value": "8c7a7cd8e6e436f78fffcb7fcdc970a98dbdb2fa8a784d81b3efd7c3fd4e25b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191492, "uuid": "f0757819-26b3-4717-8f9d-fe40284aeecc", "comment": "Malware payload (AgentTesla)", "value": "9ea755dadf00a2305bde1813f05dd20c9d9739a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191492, "uuid": "852a6853-0ff4-404d-a6fa-0ac728ab3836", "comment": "Malware payload (AgentTesla)", "value": "c1aebe49777c63b8b16513f1e6724e53c6c1af55d764b155ef7f405fca03afc3f22a98355beb6e5ab502852394c23030", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191492, "uuid": "1c1e28a7-0029-4449-8fc5-e8a54e3708bb", "value": "T11634D081B3E89847C95A5B3417B7415A4EF4F817BEC3D35274EBB72C0EA13EA260D582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191492, "uuid": "01a81405-f66c-43ec-954e-482138113c86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191492, "uuid": "270ff112-30a8-4418-ad5b-b5de846a7346", "value": "6144:SGoH0faCCduMU9YrSVIxPLp7drKBKa5Wj:/MlVMVKs0PL9hKpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191492, "uuid": "9cc7e642-d7f8-4261-aa1e-85e58e131715", "value": 239600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191492, "uuid": "8dbc9102-aab3-42d1-8835-95cbb042e3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191492, "uuid": "1c442e25-79a6-481b-ab52-cb74c0925305", "value": "Payment PO-2062409102_GTE_2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca78a91c-3d3a-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664155823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155823, "uuid": "db691b85-cc3a-499d-bf11-4b742f10c7a2", "comment": "Malware payload (ArkeiStealer)", "value": "4bd652a8a983bb4d3c33705989c6aa7f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155823, "uuid": "63d3f0b8-6b98-42f9-9ebc-34759e4ebff5", "comment": "Malware payload (ArkeiStealer)", "value": "8c982f7f50fed1b136c6718fdbb1603f877d99ebc0a5685504f8a64adf6a15b0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155823, "uuid": "3b7fa0f7-efc8-423f-89e3-ab3d9e446adf", "comment": "Malware payload (ArkeiStealer)", "value": "d8a9430ee6b1421f471fae94af0be87fd1c2e80a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664155823, "uuid": "407d5f89-c0a8-44ae-8683-e174b70c3542", "comment": "Malware payload (ArkeiStealer)", "value": "2298fd579ac2d059ab7b57eaab21802eeba2ee681f70d697248e6a0b2613b66e97b13ee9c5284ddaf5900bbd16af1378", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155823, "uuid": "b92c74a5-ebb5-428d-b7d0-fa0cff91c2b3", "value": "T14A04E1127780F473C42269769878E7F06ABEB9121135564F3B580E6FAF303D16EB6389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155823, "uuid": "bcd3a0b0-988c-4e64-86cb-dde0342b77f4", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155823, "uuid": "3bb5af63-43ea-49bb-8d8a-7d5476d0c9f7", "value": "3072:GCW0wMJ8QS8z5VVp4wL5pD7Hn3U+RyF7QB22Bjzyt95x:nNRbzzn3UXcB2wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664155823, "uuid": "16790332-4f6f-4f26-87c3-24944ce38ee7", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664155823, "uuid": "e6a4de0c-3124-4a69-9e0f-64e587440f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664155823, "uuid": "2905ed8a-6613-406e-86b8-e2aa2b063b23", "value": "4bd652a8a983bb4d3c33705989c6aa7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f940d3-3dd1-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664220639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220639, "uuid": "cefa86cc-7dc0-4f02-9665-4b26622610fd", "comment": "Malware payload (RecordBreaker)", "value": "1aa033829db2e59afedd9aa31eda5a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220639, "uuid": "87cce5b3-7639-49e6-9fae-463c8485f443", "comment": "Malware payload (RecordBreaker)", "value": "8dd6199575a6e16a403450d36056a98c44e6f5deed1384e03bf38a33e7e7b5a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220639, "uuid": "7c608d39-264b-4d6d-8d99-ee024fe75997", "comment": "Malware payload (RecordBreaker)", "value": "4fdb5cd48922263452529d861fb0838f4d093b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220639, "uuid": "2d3fcb81-8f8a-4021-9a48-921cf2071349", "comment": "Malware payload (RecordBreaker)", "value": "73620912b48ecde4c6190ffbb3be37aaffca86b710e6b675a1d58fc4b911ef118da7b1ab5c3f63a5db3f2691390e9f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220639, "uuid": "5c77097f-d9a6-471e-af73-faa3f72b17a3", "value": "T13C75F1113197DC11E20952BDD670E35B470B9DB8C631108BA1BCAF8F7BAB8E6578136E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220639, "uuid": "b3d67c88-04c5-43a9-bcaf-7c3b9509e58e", "value": "ab76b7c4fdb06bb68745be55bde958b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220639, "uuid": "ff59679d-f5c7-4161-9d81-0017196019a8", "value": "24576:Bt4T2gXXACuOKRKwt+s+PXbwOZ44qkaiZ083Fv2D1ubK0pe0Uqa/akVBpl+x5ji:D4TbXXcRF+sOSqaO08Vv25udpe0Op6vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664220639, "uuid": "484fdf11-859e-4769-9311-b6f40aefc3ce", "value": 1615272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664220639, "uuid": "bf74313a-9e5a-418f-860b-7a7ebdb2003d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220639, "uuid": "4312b345-6969-4134-b077-b1c0107f2be5", "value": "8DD6199575A6E16A403450D36056A98C44E6F5DEED138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9b64d1-3d46-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664160873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160873, "uuid": "73561c21-7a18-438b-93ca-dbd82dbb5ab4", "comment": "Malware payload", "value": "e60b3d75e2c4e3796bed5194d12ac9e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160873, "uuid": "76e4054d-298c-40bc-8137-ed0c35d9bcb6", "comment": "Malware payload", "value": "8e7f3a2e664e530015fd20fc4034bb957c97da500564d0d9354127896b6458cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160873, "uuid": "e3230e9e-4a2e-45f5-90b5-5f84b5f0b3a9", "comment": "Malware payload", "value": "66d169e1e503725a720d903e1dfaf456db172767", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160873, "uuid": "67f6d301-c968-4425-b339-2b71d6df3195", "comment": "Malware payload", "value": "ed562233940d6d02c8b8203ad2c5de21a06f0513b5499405e6231340307377302f440ca3fda6f23eaacf601e559dbba0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160873, "uuid": "f3fbf641-9250-4a8b-a3e4-f0566e338888", "value": "T155837C1172D18079D0FF067A05BA8A510B7D7D32EAB55C8B7BA5158D4EB02C0FE3AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160873, "uuid": "b6a58211-2eb2-4019-bbb5-33cb62eeeffe", "value": "0bf36e344ae3289e384bb6470098c855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160873, "uuid": "4b3dbafb-959a-45ee-88a8-8b0a649e288a", "value": "1536:KwJp3vj4rv+0pwS36z4GB+1WBNqc++LngosWjcd4RtxFh:npbA+USq+Ln0YtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664160873, "uuid": "0923a7f3-4a73-45b6-9609-e433bc45ec74", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664160873, "uuid": "a71a7d16-9641-4c74-b384-6372f3287f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160873, "uuid": "a83753e0-00b0-4b0d-a639-ecdac254961f", "value": "8e7f3a2e664e530015fd20fc4034bb957c97da500564d0d9354127896b6458cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efc121a-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664173789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173789, "uuid": "d6d55a97-6637-4dc9-b5a9-a40d1951ddd2", "comment": "Malware payload (ArkeiStealer)", "value": "4196455e2a512dc66d04f1448b7b6da7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173789, "uuid": "44581f52-d444-43f3-9b3f-075cb9d7d8b0", "comment": "Malware payload (ArkeiStealer)", "value": "8ecbe3f78c01ca3ddb3cd79498d97441c9f08cc3c2d2416546aee250ff84877e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173789, "uuid": "d9dbf982-5457-48a5-9729-6c285eb248f2", "comment": "Malware payload (ArkeiStealer)", "value": "9d007337ab65a76aaae43897118932a3c1d01171", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173789, "uuid": "b8425214-d37a-4f1c-8c23-b0e8cab56f11", "comment": "Malware payload (ArkeiStealer)", "value": "b0fbb063e06d0d2a61892a453d7c6cb46890e6f329a82cc0b99b0bf7a6f9ff888a48ce3696ecc1cf6e4acf5107beb60b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173789, "uuid": "a0eec8c5-bab8-49ce-93de-3a40368475f4", "value": "T199D5593928C87032CC2CC0FE9AA6D7F7E2EDD1710F1178BE42B429195A9AA55F7271C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173789, "uuid": "3bb96c21-3258-459d-994a-2a1e3014d208", "value": "c1b701daadd766e587d26f6f95acddb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173789, "uuid": "b4bcbd72-15c5-470e-b77d-8c731e1c3d01", "value": "12288:aH8oXdQvdm4Kjun5ViI0xOVfpKrKIkF8pZolQj3tsuzLBK1TRp5gFdIe6u6sxQ3U:UZ05ViudpKeIL73quzdo4J+U5U5UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173789, "uuid": "e8c091ff-6f26-4682-9009-d76b3fca152c", "value": 2889191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173789, "uuid": "693c84e2-2b74-4596-91d3-8741414b8292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173789, "uuid": "fb81ed34-48d0-408d-aed1-4fd257cabbf7", "value": "0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966c8c30-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664190095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190095, "uuid": "17a3edc4-0e73-45ef-9fda-b52c1caa6de4", "comment": "Malware payload", "value": "ed53b73de96c0e0eff8f22986b374739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190095, "uuid": "c573d098-7791-4d0b-ab20-d16615e09cbd", "comment": "Malware payload", "value": "8fd817cad0174b9586debb2e9486cfaa502262844daf4a1c8e514dc6a4b9759b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190095, "uuid": "d34fd388-e026-4f90-a47e-d2d7fdffc5f1", "comment": "Malware payload", "value": "3ce03518ecdfd961eecac0fb352b945ff5b83d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664190095, "uuid": "28cb4128-0089-4607-ae95-be9cb2d2da68", "comment": "Malware payload", "value": "6e0df4a4db67d7849683512df05c460d9cf2e41d317d50fa8793708683db06c90b37901d4d750a9e69c458b6fd5552d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190095, "uuid": "26db23f0-bb1e-4bdd-a342-b06dc5868ffe", "value": "T18176337138F6D4BDDA5A187187290BC862F2D18D5F32842B3F55907C367AEE6E013392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190095, "uuid": "146e6626-b811-4e1d-856d-0899f4484136", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190095, "uuid": "e7ef7270-0e90-42dd-87e9-681f99eb01d3", "value": "196608:91Oqo4piWoEZ7kyq/N636jbvOQYBUDKLRXVWZ:3OR44WB58Jjbv5csQXgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664190095, "uuid": "058bb688-00a4-4494-a121-9e0dbd0bfa4f", "value": 7588336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664190095, "uuid": "654f912e-d130-4b3d-94e8-4d3a65125631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664190095, "uuid": "9ace8fcb-ad29-4353-a18c-e8af7bd07536", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5cdc0a-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213858, "uuid": "b1eda4c6-7f69-4548-9439-06e305105255", "comment": "Malware payload (IcedID)", "value": "ead051e0a45b60951aa9d9ea533f7da1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213858, "uuid": "2ebb2de5-eced-4ee9-90db-4656ed4f931e", "comment": "Malware payload (IcedID)", "value": "8fe36ce43919ed3d512c9d988fab6051be4e5ca61a1243807522374830f2792c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213858, "uuid": "e594b4d9-059b-4992-9d5c-bc6b656b5227", "comment": "Malware payload (IcedID)", "value": "48ed684356f2eb973a0bec5a35795d8ea227d150", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213858, "uuid": "cd1bb7f1-97a4-4a93-b06d-0aa28ce42969", "comment": "Malware payload (IcedID)", "value": "059efde99e437d6f175a432ab9cbb63556ce610d21352b3dd4eff77393fcfca9c75c78dfaa26f2837e69ac1e50c12b40", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213858, "uuid": "1ede1d11-6d64-4996-aa52-8eba693ef757", "value": "T14B15F105CF14646BF00B693E371369D7B8620C27708BDE1A6B86112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213858, "uuid": "ea368350-ef13-450e-9415-f17672bdb881", "value": "12288:tuVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DElYjfH2Szv4b1nsmbvDxl:tuV2jUeQRI5wPN/u0fHZzKsmJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213858, "uuid": "ce59345d-1e42-4534-8d9f-6c5e110bb065", "value": 887235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213858, "uuid": "aecc8078-a9dc-49c1-80e4-924976a8f69c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213858, "uuid": "4c221588-4e6c-43a2-ac75-8ece479ea8c1", "value": "mobiletel,invoice,09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca2309d-3d51-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1664165651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165651, "uuid": "5fd01f43-5d95-439c-8712-aa00d1d6bd3a", "comment": "Malware payload (ModiLoader)", "value": "5202df4b4093b4239a5e589df74b92e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165651, "uuid": "87e7889f-a4c3-45ae-8b70-b1f8f95122e9", "comment": "Malware payload (ModiLoader)", "value": "90db7becaf1c727f7d88193b95233c1f9813ff6f08681370c71f450e8305cb26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165651, "uuid": "ea70fd49-29c6-402f-bc17-92599d5c594f", "comment": "Malware payload (ModiLoader)", "value": "4fdbb96ad326c1ec122967c274b8f04b4bd19763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165651, "uuid": "b0b853b6-3af5-4f8a-87a9-d56435078af1", "comment": "Malware payload (ModiLoader)", "value": "49117d53cd3dac5a137faa9dded6835b50f69daaf32a59d9c5b23eb96d2b917362b6655edce9ed3f0914824889777981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165651, "uuid": "16987452-4ee0-4a9e-84bf-c7d799510dfd", "value": "T1AAE48C25DF80497EDC632538CDB6F1B9A41D7A103828E48E6FE60D4C1F772AC3629697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165651, "uuid": "0cdf0a8b-355b-4cf5-bc89-85a4b19b07ea", "value": "7086fe14c6488eab9ed0571ed55e4763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165651, "uuid": "576ed40d-123d-4c66-b1bd-ed0b03b79045", "value": "12288:Xb+ehvt30D23pDnWFFP2LC6vNE6S62avdPnjD:XSuveg4eRNXeaNnjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165651, "uuid": "9fd92240-c165-4d79-85d1-5e488c5520a0", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165651, "uuid": "3dcd9824-2d62-449b-a7d8-a4281bd956ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165651, "uuid": "279db590-004c-4045-ab0b-064c21915b84", "value": "SecuriteInfo.com.W32.Formbook.AA.tr.4360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bb9604-3de2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664227709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227709, "uuid": "e512d818-fc38-4ed4-8bb1-ee234cc7b756", "comment": "Malware payload", "value": "ee4f858730d53f8800618850c747ec04", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227709, "uuid": "f3307ced-2e87-49e0-90f9-8d50b609ba37", "comment": "Malware payload", "value": "92cb24c2fc516454bc365162479cd498f8479cdf119be1f9a21bd230f1fe1530", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227709, "uuid": "e130c0df-f83b-4958-81fd-9c7fbc497b9e", "comment": "Malware payload", "value": "e3a2dde6ba25baa6e8613a6f11f30b32544775e6", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227709, "uuid": "d8ca7c15-b050-4096-a699-aac41be38787", "comment": "Malware payload", "value": "fa8223c79f5887c2b44caf3b1d2774c3cc023dd9809400b1dcdd3d162f3ee130faa7370b545afd5bd0f95bcdfd086f9c", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227709, "uuid": "8235cdb4-c3d4-4312-b0f0-66f5ef8d9b6e", "value": "T185F08B6215C2C458191C9287F1738C03B3A4C1115A9322FE137AE3A662E6886B6D01C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227709, "uuid": "a9c5fbd3-a2e7-4f53-a101-7d27a29bb0ff", "value": "12:tY7NCCuYy8qKh7mnEwEQOd9la/F9K0hPwD8RLSWAYyVo:tYRY88EPla/XK0Bk2Roq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227709, "uuid": "68b6b882-357f-44f2-b8e2-e8e1f65f908c", "value": 558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227709, "uuid": "3ff6ca04-a8bb-42f4-b411-1004bdaa5ad8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227709, "uuid": "0840c834-8def-4e78-ac87-d1cc03d877eb", "value": "PvZvbJgQ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e780663d-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664191520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191520, "uuid": "46e7025b-6e82-4678-ab04-432488cdb00a", "comment": "Malware payload (GuLoader)", "value": "5163999d5ec35625e59c6203f39e354b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191520, "uuid": "6d86b1fb-02de-439b-abf8-44c01af2d5ef", "comment": "Malware payload (GuLoader)", "value": "930303aeada4b5c9e5bfb3013795e732c2e1bd2fa6466af51145a92fd847de30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191520, "uuid": "f50e7376-74e5-44b0-a813-b4e6a8ec8d9e", "comment": "Malware payload (GuLoader)", "value": "b403f764ad338e73d9be30659c6d688f2c8f1eb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191520, "uuid": "b03b9e9f-47e8-4348-9191-1ed424c92200", "comment": "Malware payload (GuLoader)", "value": "fdd1af95d660988b0557398826eda3da281a6a6bbd7abfd908a8db2f84d08afabd2793546b38ff45f42d8b9171379888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191520, "uuid": "7a776283-778b-45ae-838f-f0fae9d4fc34", "value": "T10BA412452AF6C446FBB28A30DD3A82F66D316E0DD0B0676B33513E0937B7241DA6674B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191520, "uuid": "1d3199d7-02ac-4002-8f29-5ce98681c5c0", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191520, "uuid": "17357afb-62e6-4ecd-a7fe-44c33b22b3c3", "value": "12288:5DG4A2yBnsXSaE7qGodpwM2B4DP3hzuhXI:w2yBns07ORhChXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191520, "uuid": "ff83717a-5480-487d-a734-727d48c4230b", "value": 485120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191520, "uuid": "4434ce0e-3d1a-4248-ad1e-029ab5e661eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191520, "uuid": "18cc3b83-a822-4cfd-a87a-8a308f2e4a78", "value": "Ormat - RFQ-IMP 90881-00 5427-92407732DO4328105678387203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67cdbe8-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200886, "uuid": "a1e0fd1b-2a58-402a-95b5-d3f2e857d365", "comment": "Malware payload (Mirai)", "value": "1767072b09525237cf3c68386d7bf91e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200886, "uuid": "97d31d93-f5e4-4b62-a9a5-87b85480cad1", "comment": "Malware payload (Mirai)", "value": "93c2522ca22089f26383d15d286fcd998444856ef8a8bfb8ff0f84875ffab138", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200886, "uuid": "8427325c-1f2a-4aed-bd1e-67a57f7adb53", "comment": "Malware payload (Mirai)", "value": "b1e453fd3a1e69991d63f4261258a6a288ad4d0b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200886, "uuid": "4a8dfed4-9793-421c-a591-267ba7e03a65", "comment": "Malware payload (Mirai)", "value": "21356c4a3765cf88b2ffda18c06280d41d0a0b74bef4a34a520421dff4ba19342d7baf1890ff8c7d909905fdeb102117", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200886, "uuid": "102d25d1-8121-47a0-bdd6-e2bdd9255483", "value": "T1BA43E681FCA18A16CBC02375F95E2A9E3321A7E9C2DEB317DC115F207A8950F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200886, "uuid": "5f11261f-ad36-47ee-8576-c0e22720aed2", "value": "768:WkOdHevTlMb4oFG5IYiXru+AfS/7To9DrEK8neKUnIKwtpdMVj8dkNzZt4zrRojN:6dH4ibpG5IYgruj6g/j5kzrTiX4Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200886, "uuid": "26fe81e1-2915-495c-9c61-fa4134cb19a6", "value": 58992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200886, "uuid": "bb70d566-4cb1-4db3-8743-800bf0aef7bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200886, "uuid": "ff4d819c-bf2f-4e71-88de-7402ad8a78fc", "value": "tamkjll.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc3c4ac-3da1-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1664199959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199959, "uuid": "a1d99e3f-2f15-4a11-8623-a325c1b5780a", "comment": "Malware payload (NanoCore)", "value": "c83f7860b0c0f1ad76d8ca65c6bad689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199959, "uuid": "c326390d-75cd-4f9a-a355-e64e659326cd", "comment": "Malware payload (NanoCore)", "value": "94bcc238e29903cc49036da98144dae0c7e10526669d6c50e3b87239f8e27262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199959, "uuid": "eb56a6d5-bfbc-44d0-a603-cdef9ae5de11", "comment": "Malware payload (NanoCore)", "value": "221ba6cf88de4c688583c69e8892ec9c3804a11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199959, "uuid": "d6c10239-a7d7-412f-8812-12cdbb57b9d7", "comment": "Malware payload (NanoCore)", "value": "333949fb420ce0b52f41f3da06c7cb755cd2841788659f2d701e6069f6644956ad4aafd9e70bdc6f815003ac18084f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199959, "uuid": "f2b5dd7f-9bb7-4e36-9add-137613e453de", "value": "T1F4F42A2425EB521CF4765FE95FC8B8FA499BFE61662AA0F628E073458B33E04CDD1035", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199959, "uuid": "45d5a6b2-9c6b-4feb-8951-4656aee3fe32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199959, "uuid": "6ac7c311-f142-42b1-8a31-018b5fb900c1", "value": "12288:PHK2xwKKFbHecmpYAf6GZPVNzBKUcY4oqwlsLhARylQ:/KvHBu1iizgUcGqwlsL+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664199959, "uuid": "5c2f762b-d0d7-417d-b0d8-504cb5df254f", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664199959, "uuid": "cbdd2183-ef60-48cc-b2c9-3a8134fadf36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199959, "uuid": "424d05ce-010b-4fbb-aef6-0c8127f32536", "value": "outstanding statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dd9668-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664215674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215674, "uuid": "6ce1efc0-5368-45e3-b82a-1e2d06ac657e", "comment": "Malware payload (RemcosRAT)", "value": "a897b81bdf131aa8241271cdc66c37cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215674, "uuid": "ffb25a9c-cad0-48a8-a6ef-0a169c78f2e1", "comment": "Malware payload (RemcosRAT)", "value": "94eda109120e0429ea3e1e3b2083b998f37b7698aefb2e7a123d584e4a6efc53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215674, "uuid": "4ee7b53e-a432-4a44-addf-2de635e10242", "comment": "Malware payload (RemcosRAT)", "value": "12cf44f921341d38f3acd2d4e3098cd900016b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215674, "uuid": "f96a5e4c-840f-4198-8125-fb5569fdbc49", "comment": "Malware payload (RemcosRAT)", "value": "15b0257ee78faafd34fe4556c21ff39e6a29a955fd2ac9368394b955521f6ecf5536d365f107b2f575b14e9d591eeadc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215674, "uuid": "80dfc993-fef7-4d76-b707-bd002286b302", "value": "T18B1512E260C8F224C25D5EFD8111E5D5F99673452FD0135EE69B2BF3BE21120688AECE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215674, "uuid": "ae43bf93-1023-44bc-a8ee-c3c2c74bb251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215674, "uuid": "2bfbd9bc-4368-4b79-86c9-1be2a70ce93f", "value": "24576:cC5FtiwdFEVVWMiGNCS79GdeDJTHUsesrmF4k2kGhVBml:ciBGd+eDFleV4hkoVBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215674, "uuid": "32d4151b-6d64-41ab-88a7-79ba96240525", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215674, "uuid": "3ebac920-8d09-4810-9ad1-fbbe120bb0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215674, "uuid": "bfdb2081-f90e-4510-b598-1f7627514e44", "value": "SecuriteInfo.com.Win32.PWSX-gen.15150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53906c46-3db2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664207163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207163, "uuid": "ff11bf41-3a47-41f8-8756-71fd9b1628b2", "comment": "Malware payload (IcedID)", "value": "96614e82986f76b12dd396a986437dc4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207163, "uuid": "2f7a86d5-8f5e-499c-926b-68d0aaf7c93d", "comment": "Malware payload (IcedID)", "value": "9536f6a25cbaf7bf71d44f6cad875561d696f129f9d62cbee7581453c6013906", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207163, "uuid": "9610f092-0e2f-490b-a56b-f4bc9fe9aaf8", "comment": "Malware payload (IcedID)", "value": "5d6afa5d20ece41f062cc22330406c83c08179b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207163, "uuid": "17a99735-7625-449d-9569-aca4054cac45", "comment": "Malware payload (IcedID)", "value": "ed3b22a439f8b802d1995a6df7612522934154df8f4ac9e05ab0f704ab0d88bff23115837f13f4a1e0650d2c45158a65", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207163, "uuid": "ec2c7b72-5442-45ab-a8a5-d481f00b5108", "value": "T1786408D9B792B0A6C3E37574403F010BE27B6E91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207163, "uuid": "cf8bf503-625c-4427-850c-79913c33fe10", "value": "591e93c0276c7f6b587ad25fb1904529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207163, "uuid": "d03e0524-4f98-445d-94ca-5be8fc6e2fa2", "value": "6144:iiaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AF+:iiaxP58X2ikP7U1Ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664207163, "uuid": "6b6690c2-7c72-42c6-9897-533f1f154223", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664207163, "uuid": "2fc6ef5c-4b2a-4580-b180-f5d6959f6195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207163, "uuid": "d050a099-3aed-40be-b69e-832b6e08ee21", "value": "96614e82986f76b12dd396a986437dc4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b965c0c-3db0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664206237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206237, "uuid": "951607d7-1824-49df-9b37-11d60cc965f8", "comment": "Malware payload (IcedID)", "value": "790274f5be09fc4e5add5c730f84e0c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206237, "uuid": "bf8d1a8d-22cd-46db-a9da-17fdbdef206e", "comment": "Malware payload (IcedID)", "value": "95431d74efcd74d9999ec750c7b1b9b7c3c33e916e98c8590a23d6bfc9059834", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206237, "uuid": "47aaefd1-17b4-4f47-a1a2-cbd8866cb6df", "comment": "Malware payload (IcedID)", "value": "5c111b3d136c8f6630a11e4b3f6e6a9c02fe62d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206237, "uuid": "1a986288-aec0-43cd-a077-727d6fb8adcf", "comment": "Malware payload (IcedID)", "value": "09896f1f85c93b571428e0653ab4894f13d0b6e96271e2f51cbff02cca870c14c3242138398987bbed2c3c3577f89470", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206237, "uuid": "9fa614bd-5e38-4ce0-81f8-1c6e15776c08", "value": "T1EC6408D8B792B0A6C3E37474443F010BF27B6E91B84ED894E145D5D06DB8A9A817BF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206237, "uuid": "31b57f91-aba5-48d3-b559-de66910d3ef6", "value": "73813c349be5287bd1e7c6f95d8eccc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206237, "uuid": "32cf8c60-675b-4b73-a5cb-6b75b3ee7144", "value": "6144:R+A2m2kP7+sOjcroyI0xwlh8boidmQp1tRdnjU8bM:Rp2/kP7yj1kuvcU8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206237, "uuid": "051b12f1-ad3e-4e5b-a7f7-a40ab71b2e6e", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206237, "uuid": "11489a64-3275-4b5d-981c-a4a54c415790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206237, "uuid": "60d2b133-a23a-4a0c-bb38-9c195a79ab2a", "value": "790274f5be09fc4e5add5c730f84e0c4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364f11c5-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1664189934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189934, "uuid": "413ff8b2-a7b7-4967-b735-1f05969597aa", "comment": "Malware payload (ModiLoader)", "value": "aee1c3cee2eb1b49fc9859e0ff7d2200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189934, "uuid": "10237eda-3ee4-413d-bff9-03a9f6bf012f", "comment": "Malware payload (ModiLoader)", "value": "96538581d475a33de24ff6e71dcf35df1c21d2d1304da1b002edfddd777b5fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189934, "uuid": "8ad5de1b-f894-4d1f-b1c5-f13094bae256", "comment": "Malware payload (ModiLoader)", "value": "9681c6ae132eff2e323045b56c8e2b4b50c8757c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189934, "uuid": "14d2ce10-7a50-424d-8c41-7ad32bce3b90", "comment": "Malware payload (ModiLoader)", "value": "020e0105e289b2444b0eba985add64b26760d7d60569271c7c3c39862d79e94fde94869b50c6ae9afd7a75d3172b3508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189934, "uuid": "22f256d9-0fcd-44f6-81cb-602b1b5948fe", "value": "T194E49D25EEC0447EDD732679DC7AF2B8D51C7A10282CF48D6ED61A880F772AC3568297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189934, "uuid": "618cf5d1-fb88-41ed-9fa5-b1a18226a4f0", "value": "7086fe14c6488eab9ed0571ed55e4763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189934, "uuid": "c2050a11-126c-416c-9613-446198213ff8", "value": "12288:Xb+ehvt30D23pDnWFFP2LCevNE6S62avdPnjD:XSuveg4eFNXeaNnjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189934, "uuid": "13b8ed9c-652b-4840-ab7c-21a981049cdf", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189934, "uuid": "413932b4-e061-4064-a0c8-f1878cac14eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189934, "uuid": "cc4356b3-8912-44ad-9a0f-9ff6a5206e2f", "value": "nova lista narudzbi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21de9516-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174438, "uuid": "86f5abda-0a73-4479-96c2-7c5b6bd1e92d", "comment": "Malware payload (SnakeKeylogger)", "value": "99578fb388d42ef0d774ccc77d2204ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174438, "uuid": "03d68554-e443-48dc-a79a-5b67ddad4b8b", "comment": "Malware payload (SnakeKeylogger)", "value": "9695ac0915eb637f2b284b0a0c602aca804f176b0e4ca97608a174bdbf9d7b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174438, "uuid": "c39016a8-667c-481c-844a-225f49d107b5", "comment": "Malware payload (SnakeKeylogger)", "value": "d3ab5a6ae43e208b205fced1a1a0a40023f1ae06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174438, "uuid": "e3378162-31f9-46a7-8488-872aaf939498", "comment": "Malware payload (SnakeKeylogger)", "value": "c4b3f6842453e63e55029e5603c321a9d7fafc924d33a0632f1a1aadf0248a610e68cf1f6e64cbf6c6dfd1a8d7a1e284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174438, "uuid": "7b0ef6a8-bd24-41e7-b4da-c995c8c69667", "value": "T1F425E1262BEB8E17D1246674C5D0D2B597F8CD02E067C28B6FCA6C8FF0467E586A0753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174438, "uuid": "bf421b2e-de18-4c21-8647-54644b04b674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174438, "uuid": "03f508e3-0bf6-459b-be61-b0a8285314fd", "value": "12288:vvcfiy2sz74MCMpLbtW3B3myD/ieNKo6WySqDVfdw2KcHk:s6xspEpTxKfSWfKwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174438, "uuid": "1d6846d0-73bd-4857-8516-e7f72fecd041", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174438, "uuid": "2e0f9c87-db85-4fcd-9523-acb6a11b356d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174438, "uuid": "e7ec7932-3e56-4d2a-85f4-eaf82a9b988c", "value": "99578fb388d42ef0d774ccc77d2204ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14dabbe-3dca-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664217682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217682, "uuid": "36521395-70d9-445c-adab-3bee7c0f5b0b", "comment": "Malware payload (IcedID)", "value": "a950f27b577e9c0ca10048248c81637a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217682, "uuid": "55bf2228-3d69-4dfc-9f44-e78a42d3812f", "comment": "Malware payload (IcedID)", "value": "96f4b5d7a36e0beb974712736292680ab6371df4c167914fe6570fbbabf19aa0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217682, "uuid": "7978513e-c13a-4153-97d4-b776737b607b", "comment": "Malware payload (IcedID)", "value": "5d53103a58c6f3de33baf24a42a9ea582e82ba9a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664217682, "uuid": "99607e3a-52e3-4b6b-8204-733dde31ef26", "comment": "Malware payload (IcedID)", "value": "6993d2d4f1efe782dbd8348949028b7f43aeb607d58712437efbec5bb14baff2d0ce71b74c0704d12f02fda3b40430fc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217682, "uuid": "3047243d-9c52-4c5e-94ed-bcc755932d7b", "value": "T16415F105CF10646BF00B693E371765D7E8661C2B308BEE1AAB86112E19C7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217682, "uuid": "69b5d60d-681d-4865-bac6-3fc33aaf9fe5", "value": "12288:zVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE1mo/az5B9c6dH:zV2jUeQRI5wPN/Bo/m5B9cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664217682, "uuid": "a5f9a95f-a371-4df3-a1f7-556f9d31124b", "value": 886918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664217682, "uuid": "fd11a979-76a5-4921-99ba-f0ec80b20891", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664217682, "uuid": "e360e8c8-2a05-4780-9a7a-c0577d1b712c", "value": "nntcinvoice09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80f6918-3da1-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664200111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200111, "uuid": "9cf6ffec-7423-4ffa-8371-06daa061f490", "comment": "Malware payload (Formbook)", "value": "9b53d976adfde8e5436e6359c9568933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200111, "uuid": "2861e588-9a87-451a-b5ee-25c5c73af97f", "comment": "Malware payload (Formbook)", "value": "96ff5bcf667a4a652f0a1c556b1d2e5a6b97a483e65ff6f87a6c62a37e587fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200111, "uuid": "87c47ff0-625c-4ef5-90d7-35045ac7b3b4", "comment": "Malware payload (Formbook)", "value": "57aebe643f9065b4c9efa4e945b0ab7a807360b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200111, "uuid": "bd01bfb7-0f48-4d23-9d9b-19618dcb545c", "comment": "Malware payload (Formbook)", "value": "63f0cb3e9eb46988baa24a716f34041db2c1df798d4ecb7cf2893220cb17ff3c74931e40b39b772e1eb6891e194baa74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200111, "uuid": "8cd443c8-e3f0-4345-8334-20601bc2b207", "value": "T1BD15AD6932A56A8FC017DD7689E4DDB0A7656C23A217C247A2C71C2FF84D6D6CB103E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200111, "uuid": "c59fa2cd-7002-4ae8-a5cc-3b80c8eb577d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200111, "uuid": "ff67371c-7c51-4e9d-87b3-3b41649c0879", "value": "12288:cXpiOwQg19RlriehWAiO7icDj3eHl0ryNM3mvxs4KXGl1KiNObKf:cXmQgD+cWpO7icDj8lvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200111, "uuid": "19b3c0b5-d590-47c7-9ff4-55da0264aa4d", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200111, "uuid": "45f4a9eb-0bd9-4132-b763-a95c6547d0af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200111, "uuid": "8001c2ee-2195-44f1-803d-9a1a49c29e81", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33337180-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1664173178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173178, "uuid": "297a638c-4ccb-444a-8947-93c17371b4c2", "comment": "Malware payload (NetSupport)", "value": "7abe74adabd2994774b86fcb9ccd7a82", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173178, "uuid": "23711958-9537-4b34-8283-1556a1cdb8dc", "comment": "Malware payload (NetSupport)", "value": "9703d6d48c3f7a589f126f0218c59616899ad52b59b6b27d59370c57d218a854", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173178, "uuid": "c84e07b9-5210-44d3-8b51-87ff735ccef2", "comment": "Malware payload (NetSupport)", "value": "bf3799b5562fab0cbc7bac94ab056c4eaaeaac05", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173178, "uuid": "8535e623-5d89-4f34-9336-9827682e7e71", "comment": "Malware payload (NetSupport)", "value": "b5de02737e37b9a181de562753e0b8e06e6f5341a1089897fe8e80df95591932a49dc8c3309b46c2e66036d05fb5651d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173178, "uuid": "730cd70b-aaf8-4d44-9408-aaa3c59e7a43", "value": "T114B533A8E233AC120A63352FB68C0F47C79E566F02A8F7DDE58796414F30999330A757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173178, "uuid": "01ff4b84-5af6-4f23-aaf3-54fe3f4f401f", "value": "49152:AZ7l+q5abRvPGicdPxUOX6v9lEPyqg8sCM5/do8v7zo4FIi14lTy:AZ7Iq5Cpbc6v9SPm85M5lFzz0+6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173178, "uuid": "256e87d7-f1a5-4529-8d52-1fb16bcca60b", "value": 2373492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173178, "uuid": "b8d18f6d-7a24-4573-aa49-f14152a7cf64", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173178, "uuid": "06fdae83-b35a-49d7-ac37-8f5d3fb07b7b", "value": "indicative_exchange_rates_dtd_26_09_2022_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826a6bf1-3dde-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664226139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664226139, "uuid": "141d93ea-40b2-41cc-a647-20c3bde04646", "comment": "Malware payload", "value": "ec35db0e02bd0e18a017a52441ec54cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664226139, "uuid": "3b050b67-612d-49bc-9462-a80c82036d8a", "comment": "Malware payload", "value": "984f3960c7a02abafb1bb502406a2e053bba3d5ec1ad1a432e1dbd728a36efcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664226139, "uuid": "d7bc8691-cc5a-4510-9601-c928ed38390b", "comment": "Malware payload", "value": "d4d01571c105471d3709eeb3f189fef85bbaf34c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664226139, "uuid": "7653a3f8-9d66-4714-bee6-57e1918fea1a", "comment": "Malware payload", "value": "48bd928e0b6ac09cc629a5ae0292cad05b7b96804c1e1e7cfc3b727c1688563a7656569d611db385c2b24043ed2c83a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664226139, "uuid": "46bb8f13-84c6-41d6-9a36-18d81e8cb1c2", "value": "T1D8763340B4E94277C7E8D43FC6181FA0F7EAE0B07A1E6513AB4B16381E2EA5CCD51679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664226139, "uuid": "74c0316c-6468-4122-87e8-fec018d8e1d3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664226139, "uuid": "bf2c057b-1ba1-4274-84ca-d6b6c58c8771", "value": "196608:91OYDOuTSfePzjgvuriRwpgaV6fyAYTpSHCPiTEqbDu62WWjYh:3ODuTEOjgvuO2B6qyyWEqoWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664226139, "uuid": "8409c243-d24e-442a-b53c-3d69020e57a8", "value": 7631118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664226139, "uuid": "7f478dc3-67fe-45fe-a082-39813ca65c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664226139, "uuid": "3b341d22-632d-4fe3-b5d6-0c3441db66eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7ce1e7-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227309, "uuid": "a42b9cc1-5846-4af9-b58b-cdf009644e6d", "comment": "Malware payload (Mirai)", "value": "a63d284c717db4ba13c2553795ee93fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227309, "uuid": "6be0383f-e9de-441f-a98e-b99b3560f2d6", "comment": "Malware payload (Mirai)", "value": "9868c2a746a7453a7479287fae4e4cad3301a0fbd90c64a7f2807cd7df255d5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227309, "uuid": "565ebb73-1b37-483e-8f2f-a0d76bfa1512", "comment": "Malware payload (Mirai)", "value": "e9bcd3dde9b7ed7e26a84ea1f0f009486e4dbb9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227309, "uuid": "833f685f-e439-4a1c-8669-562965b345f7", "comment": "Malware payload (Mirai)", "value": "ee7719fd0dc6606248fac5ba870ea99526490f439effc7e703328e6abf22aa3ef5def7c7a7cc96e3eb6238b166cc3802", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227309, "uuid": "5d71358f-5341-4aca-8f17-1d70eb6714c1", "value": "T1C6635BA6B800DDBDF896D73B44130A06B130B3540B921B37B767FD93BDB21A49466F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227309, "uuid": "857428e9-af19-464b-b324-94e32e32a683", "value": "1536:rfXqlMuQycsLbSUQD3j2vpF668fjSPiQvF4Qr8fQpmchP3Cw:rfXql7c4bSJiRF67Qd4Q44P3Cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227309, "uuid": "55213deb-66a0-4cb7-bce7-d9877670678c", "value": 72956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227309, "uuid": "bf4197c0-f5f1-4aa4-8d03-d3570d2e36b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227309, "uuid": "07acc6d3-3419-4881-bae8-ee5ee140c735", "value": "a63d284c717db4ba13c2553795ee93fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951219e8-3d62-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664172913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172913, "uuid": "f03fb533-8db3-41e9-b3ec-a25d6b4c78ac", "comment": "Malware payload (GCleaner)", "value": "1c2b14d6c2b1301ae124ac4f9c826adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172913, "uuid": "0eb37099-55bb-48c4-a426-79ac379d6f36", "comment": "Malware payload (GCleaner)", "value": "98fdb1bdf4abd4ab8b97161087e6e32c27b9fdee4bb499d0656073a56f0f56d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172913, "uuid": "a0b423d0-53c7-4f6a-8d45-48ebd4959edc", "comment": "Malware payload (GCleaner)", "value": "d098dcd0640a6021930f5c3138eb94df3d697b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172913, "uuid": "acdd2e7f-c8e1-467b-b985-25e6539843a7", "comment": "Malware payload (GCleaner)", "value": "972565af7a2098951828b3d9d73bf4fb03f42f39ef24b044cf9ad87dd036229899c2a633ea95f379f978799e419e54b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172913, "uuid": "a7d758ee-1c2d-4161-99c5-36c9f1f2eaa0", "value": "T1BF340252BD91ED72D4487430D936D9A425FEAC111A2652463BB83B2FBF733812AB43D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172913, "uuid": "474cb2b0-bb62-421f-88b0-2ba24ad0383f", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172913, "uuid": "ca7dc69f-32ab-40e8-80ac-2e033ab18e3c", "value": "6144:C20v1+BLUFjbFowE2gFTdo3d3uhG/edAP:d01+mb6nJo3d3uUee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664172913, "uuid": "9ed35780-7526-4916-96a5-e151a4a74999", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664172913, "uuid": "60b5515e-fe3c-44d6-aca0-3e5c617878c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172913, "uuid": "dc0a77c3-93d5-4433-8d5e-81834f47b111", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df436054-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664214699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214699, "uuid": "0c589007-9447-4e7c-b904-1d84e7b8650e", "comment": "Malware payload (Smoke Loader)", "value": "94afd0e14c8e3004adfff589f11869ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214699, "uuid": "8470319e-34f9-4f49-bede-f0050527158c", "comment": "Malware payload (Smoke Loader)", "value": "9938cd36c4ba702ce2b134f842c69b71cb56e11bb2dcbfd479074cda88403994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214699, "uuid": "e55d5807-592f-4f24-9c37-137271ca1a28", "comment": "Malware payload (Smoke Loader)", "value": "dadbe9c013b04665e97fd24e1d7ac61807f57f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214699, "uuid": "7a2bd663-9de7-46d7-b004-316635c544bd", "comment": "Malware payload (Smoke Loader)", "value": "db81b1a90e5df63ab69305063932ff217709aa1bc2aba8cea3b93fe5c4b2fbd318fcb5d737d1845fdf02b6024a1ed735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214699, "uuid": "f6076973-4624-48a9-9b7f-756e4d9943e2", "value": "T192D3E03079A2D473D04346746835D681AE3F79112ABA8A477F886ABE4F313C25F72347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214699, "uuid": "eec4c2a0-bd1c-4d0a-abc6-2129eecefe91", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214699, "uuid": "4bb477a4-2a91-4b7a-8dbc-bd332c07c24a", "value": "3072:0syHTc5PRlazy93OVPzUYQmCYEoH3G1/mYjB5B:JIz9V7eY61/mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214699, "uuid": "8ef99b14-9e15-4d11-bbb9-dc763b532257", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214699, "uuid": "73447b94-35e5-4a11-8a8c-930b7a8bd829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214699, "uuid": "c78bb86d-f1e1-4a50-ac15-2e36aa0a170e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377ae874-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215276, "uuid": "6499aff3-5701-4ee6-ac82-ebc58d9ff414", "comment": "Malware payload (IcedID)", "value": "ad46c3a3740500f1725120c865fb23ef", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215276, "uuid": "c9ace64c-c1a2-4381-b1a6-21fd827be74f", "comment": "Malware payload (IcedID)", "value": "994afac3be849124810bf5eac058baf805cee4fb17d9f1d74f48d645f456911e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215276, "uuid": "6b9c8ba7-faba-4f25-9d3d-e961b358807e", "comment": "Malware payload (IcedID)", "value": "2928070f0b1b84749fdd07f61f04f906fdf25807", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215276, "uuid": "8d0a042d-23fd-4284-ae09-675f0c41a758", "comment": "Malware payload (IcedID)", "value": "160d999076c76369c3cc995316d6267945b10fa57dcabd1a147160f56ea3a2f14da833acd22869f816482cdc49d0c724", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215276, "uuid": "c72a2ef0-6cfb-4d7b-ad19-09a02223e20b", "value": "T1C915F101CF50616BF00B693E371765D3A8A61C27308BDE1E6B86512E2AC7F60FD35D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215276, "uuid": "777f18b0-6091-42bb-b122-441bede0a034", "value": "12288:IVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DElZIYn73jx2xbibdOgv:IV2jUeQRI5wPN/CZIW3t2xOROgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215276, "uuid": "13ce43dd-1391-467c-8c47-c2b41421289a", "value": 886833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215276, "uuid": "16cca53c-eccb-4484-901c-96c5f219b939", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215276, "uuid": "e7c42a9e-3530-4e8c-ba7a-b3791ace952d", "value": "infowest,doc,09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36e9eb1-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213874, "uuid": "0bec9ab8-2116-4c83-82a5-f0b3ae4d71cd", "comment": "Malware payload (IcedID)", "value": "540aaf13231279eba7c56729793ad582", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213874, "uuid": "3adcd6cc-36c8-4209-ab31-64b3510e248d", "comment": "Malware payload (IcedID)", "value": "99626203a5826631059ea9a59dbe297771e30edf523f4f636b1374ffdfaf3eb5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213874, "uuid": "744db51b-7469-483e-aaf7-a02e4511715e", "comment": "Malware payload (IcedID)", "value": "cf4fe3e98fd08ba3932cb07e38697a8ba7857540", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213874, "uuid": "fab94d37-3dcb-44cd-8af7-812811cbb309", "comment": "Malware payload (IcedID)", "value": "9dd418a699278ee8183dbaf80aae87778e7bfb6cec368a47c9cbb9606acb9aaf9d568df52c9c7985cc2db979b11d25ef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213874, "uuid": "4588603a-babe-438a-b856-ed6d3920abdb", "value": "T18B15F101DF54616FF00B693E331365D7A8661C2B708BDE0A6B86112E2AD7FA0FC36D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213874, "uuid": "73fe58aa-bf53-40bb-9fc7-1bc43a9bcb73", "value": "12288:FVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEzZesyUmuVOkGnC9e1GIaqeE:FV2jUeQRI5wPN/l0mZDt1wsNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213874, "uuid": "45448806-616b-4c0e-9d8c-ab753006dc0b", "value": 888060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213874, "uuid": "7acb60f6-8b4f-4e34-b5b3-54e643593f77", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213874, "uuid": "f2b787c8-a991-4866-862a-e1259a0a0216", "value": "marketbroiler,invoice,09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1253805-3d9a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664197066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197066, "uuid": "44796b1f-468f-40bd-8c0c-817936d119bd", "comment": "Malware payload", "value": "b5a1d999a5852dd4b160d37633b7d3a5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197066, "uuid": "75c78fe9-73ab-4fef-9755-46ee9898d98a", "comment": "Malware payload", "value": "99c95ed1a1192492b4f73a54381f02e927ce26dcae0489b63be67401e015cc78", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197066, "uuid": "7f9049c2-fb3a-4b5b-8d41-fa1c42d2c692", "comment": "Malware payload", "value": "1f1a064d9b34ff48f07ebead8bbea5161a3b66f6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197066, "uuid": "557d0d85-1835-4dd1-82dd-10ea007f4127", "comment": "Malware payload", "value": "eae61ec1266355ece8a60889c72abd929dc0f1f296f5a5dfc67e9a2dd7dcac9c953e6ff65b4334d239d14220b8ee6981", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197066, "uuid": "df9cf9fa-f1f7-476a-a5ca-90ccdfab0ecb", "value": "T1959533F718BC962C63C2D438F2947A285314B7A91AF1736D3A74D71280DC68BD0BB957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197066, "uuid": "0675fcce-857d-4585-8afc-4b92a4b8eb12", "value": "49152:D2/zscfvo5kUJlRthr0k1DJOrB6JH5zvRrLm:6/zVIp5hdXOrB6JH5trC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664197066, "uuid": "9d173032-964e-44c4-bda2-1e30054fe829", "value": 1959337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664197066, "uuid": "ec420339-00bf-402b-8981-61842c94cb5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197066, "uuid": "71d8dd26-668c-4e70-9751-2f937940fa2c", "value": "Policy_Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7b589d-3d9d-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664198289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198289, "uuid": "073f899a-9958-4927-9974-c89d7cf8dd40", "comment": "Malware payload (SnakeKeylogger)", "value": "0776d127b84fb380d6b55f87030a7cfe", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198289, "uuid": "e8044d12-fa6f-4c62-8c89-5596706c1760", "comment": "Malware payload (SnakeKeylogger)", "value": "99ca59fa203daa48793d933f40ccee3bdee5d55b1738f537334292001d17b9ab", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198289, "uuid": "41aadb26-cf8b-4232-a53e-ffdb8187caa4", "comment": "Malware payload (SnakeKeylogger)", "value": "e85caa1eb9d7d7f61b2878f5da26fd9f23468a48", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198289, "uuid": "cc74a49d-882e-455b-b48c-0023ab94239f", "comment": "Malware payload (SnakeKeylogger)", "value": "ef234a2f11c59fe87e795f149f7650c5d014092b5b7020126874f61b0f5dac0410f8505391d8cd221abab47f43d8252b", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198289, "uuid": "679d93dd-68f4-4f76-bfa7-59543761dab0", "value": "T1E3732D00924D0176E03546F45AF58EA016B7A5121DFEBB1F39FE55373B93E12B8813E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198289, "uuid": "c78a4cca-54d7-4518-94ae-e0be7549cd14", "value": "96:5RLQDvg21F5NIJrroWWnC16WSFDO+z+A2GZ4EJfpz9p0H8S6JusztakMOmvXGt1P:Sg2irADxCk4KZCcS6Jus2OB77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198289, "uuid": "105a717c-bd1e-4f5e-9841-53a20a1120f1", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198289, "uuid": "bac10bb7-dc62-4d04-a243-072fe63e1e54", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198289, "uuid": "88f99aa2-3035-4250-9620-cac3c6afd05a", "value": "PO60133107.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52917d2-3de7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664230170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230170, "uuid": "4a999394-693f-46f7-a7fb-b9ed54c52a16", "comment": "Malware payload", "value": "0acfb97e8f0c84076bb40532ea85f9d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230170, "uuid": "03a086ba-9cd4-4b9f-a16a-b7088a49698a", "comment": "Malware payload", "value": "9a19eaa7e98bca844ffef1a470baea4f88d289aff25d0515185f7c70c8510bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230170, "uuid": "a43bd6b8-2aa4-4757-8c3e-45bf7585c47e", "comment": "Malware payload", "value": "d647b03b482f391b61919061ae57d74b401108ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230170, "uuid": "bb1e51f6-f260-4c61-8c1a-efbdaa94bf80", "comment": "Malware payload", "value": "5445931457e34b42be91f7eeefd29329a0a129051a07f914e474f7d80e11927f165f520ad5d31eef20ccf0bd52030141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230170, "uuid": "a0b663d4-5ef7-458c-a1fa-c07b84be0706", "value": "T11ED3D011B894C5B3C41289341474D6427A7B3DB04ABE47977B987BAF1F702E2AB3A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230170, "uuid": "0eb2df7d-0a97-4d1f-9f93-b66bc90ae9ab", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230170, "uuid": "617e85c8-1ff3-450e-aabe-aa6c613cb443", "value": "1536:O1veYs7abX6PhihT55MtSRvx45qBkeeouIrfp/fTi3+4vrX4gFEfk9JaWsQzS8CZ:O12GhT55pRzBMWcLSWuYxR85B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664230170, "uuid": "fe7975f9-4077-4eda-bcd0-56c6eb4d644f", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664230170, "uuid": "b075c46a-0f58-4a1e-9cc8-7b10b92f70a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230170, "uuid": "23e06ea1-ef61-4aa0-b472-ee5493dcfc88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc25d6e6-3dab-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664204439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204439, "uuid": "d6bf543a-0c5f-4edf-ad56-37545960399e", "comment": "Malware payload", "value": "043257cf27d67d96b686f9deb10b5ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204439, "uuid": "4c8b8dc6-cb0a-4ec8-8adc-e71e4983e404", "comment": "Malware payload", "value": "9b5f27ad8f67638edaf4cac139ea6081ec0dd7b40535916fed8f8dc5adcda946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204439, "uuid": "24361c31-79f2-4a4d-b727-e5141c63b735", "comment": "Malware payload", "value": "6f49b5e95fc0a59249ea96bd1ed4d26264c8e001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204439, "uuid": "67e1dc23-09fc-48f2-95f9-602e88b4b62e", "comment": "Malware payload", "value": "31aa3ed2885fcb44899d9f46f454940a11837ddbdf5f9d35676c629f632de52ae34313a9b783f4da4b20f340215131b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204439, "uuid": "b7796de3-0f6b-453e-8f70-34d56079dfc8", "value": "T1DB7633113AAE8AF6D6011C7248D67FD9F398D88107A50DB7A7C9038E8A7D504F909FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204439, "uuid": "818ceb1b-a3ee-41b1-b00e-5a49f3baf050", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204439, "uuid": "197c093f-2acc-4741-a9e9-4dbb29a4771e", "value": "196608:91OOZLmK3PC2wh3+zGtR2MrMHyGJWe3kk9Rn0EJ6JenP46r:3O6mCPxM+zGtl99wkkL0M6JenPjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204439, "uuid": "418e5636-b8e6-434f-b855-dc47b8b63d8c", "value": 7604153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204439, "uuid": "df4a8ec4-addc-4cbc-aa3f-c473ddd6471f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204439, "uuid": "1ff417a8-854e-407d-8e0d-22e47f4f67d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f9a4ad-3d76-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664181256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181256, "uuid": "74570ede-0be6-4a36-84da-2042cb6e338f", "comment": "Malware payload", "value": "95d33595783ede50bd428a18823ca0a9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181256, "uuid": "256362c4-1709-4504-a7c8-51b2463491cf", "comment": "Malware payload", "value": "9b8a806dc3bf50984944140c502c02f87d5661927e8172da60b506e9b41ec2b5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181256, "uuid": "cb04b092-a175-4841-83a1-fa6451782174", "comment": "Malware payload", "value": "eb32d6ae8ef6d4f5c8c408d5b1556d9b89b8b514", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181256, "uuid": "464d2012-4a04-4244-8573-0852fd4d7927", "comment": "Malware payload", "value": "02423b026119435461a9f09b26efb148fc7e94513937ff9700633108653dfa86fcb4cc2270911acd9274c3f29268c6e1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181256, "uuid": "1f8999ba-5003-4c91-aaf0-4bec686d6d83", "value": "T108B62352EB1D902FCDBB10325EA6537606920D8584C3BB5B3954B25C0EB7AC45FAEFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181256, "uuid": "cc94a4a6-3b8d-4260-adb4-0c6a382ec556", "value": "196608:pZ4RtWm3kOv65fqHSszeoo8tpQxOFASCQBCFqbhyTPAETI4TD2jyNt4hrT:p3ujv65SHS+ev83zASsFWhyTPA4D2jyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181256, "uuid": "18604ce9-192c-448f-a2d1-7433ec3cedfc", "value": 11064094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181256, "uuid": "2eed6ab9-fafb-4aab-88c3-27b2cd8750a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181256, "uuid": "3e017fcf-3e6b-4f03-90a3-fe07d1faf70a", "value": "piste.security.path.vf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004af736-3d85-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664187696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187696, "uuid": "57b86c9b-4f3e-47f2-a408-cd49a97ae8a3", "comment": "Malware payload (Stop)", "value": "79df4998ec5df3f2eef6ecb9ac73af7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187696, "uuid": "bc8f39dc-0bcd-4385-91da-bd6d72757365", "comment": "Malware payload (Stop)", "value": "9c711dad2a2363a5cd8b58421ad2cdd7228a31ca0d85f4516be3c4d2ec55b316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187696, "uuid": "570f538b-f775-4602-b795-05a45e0232f9", "comment": "Malware payload (Stop)", "value": "4b443e54cfe6e92ba1aed66ec896521981a5aad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187696, "uuid": "5f52d316-dbfe-4584-80cd-9894967da89b", "comment": "Malware payload (Stop)", "value": "6e83105b368e326d3200f06e4c8d08289a314cf23b1515a954a46a723ec976db8aa6a779fa39b7162a2df4a69670b8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187696, "uuid": "08ee8000-6518-4b0f-8b90-e84e777225cf", "value": "T14CE42321F790F471C90518FA8D35C6C1693C7C23516A967B7B153FAFAE32390A87E688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187696, "uuid": "deed1235-6639-44c1-908a-077c5658d1a1", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187696, "uuid": "6041db06-252a-4f4d-92a5-d8c9c40a9731", "value": "12288:lAcvIBUT+QqoiPvnFmYZfXFX8E9kkeLzm+CKrN34kXmnjL9X6QG:Kcv0MD3aFmYf0Lzm+X34Znj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664187696, "uuid": "a614cc7e-93e1-4aa4-bf38-7435ffe9a0fd", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664187696, "uuid": "7ad4f60d-2434-41f9-bb9c-8ee2b3593c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187696, "uuid": "7d9e7715-59f7-4375-abb5-1e863d4d4062", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175a9074-3d7c-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664183869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183869, "uuid": "db4c0a15-bd72-42d8-b059-508d71d302cf", "comment": "Malware payload (RecordBreaker)", "value": "f3be15e87c00f23212cf9d35ee75c2d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183869, "uuid": "c3988a87-41b5-4479-8d62-f0063d2d38ad", "comment": "Malware payload (RecordBreaker)", "value": "9d0ed29da9c72921ceac602504df0abe90d6c17a9f7dfa14a81c86dabcfb9c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183869, "uuid": "5040491c-e5d2-4286-8b28-211da3e18255", "comment": "Malware payload (RecordBreaker)", "value": "15000eada216d5d108c88d35b2e02e22c17be884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183869, "uuid": "c2bd7c4e-fe6a-4586-a8d5-c101ab141399", "comment": "Malware payload (RecordBreaker)", "value": "39e60ce93232f026b05caf816d03856103c59d7e6a6d5537954aaa0f4beaa888ba9297a9d20fdb043996127c01685cd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183869, "uuid": "5a3a32dc-7537-458b-8377-d78f8b868931", "value": "T180E3E102BB80D872C41585B04C34E7F0AE7E7C12466A9A033F992E6FAF713D16676367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183869, "uuid": "4ed1a836-68bc-4622-bbbb-23dd6c129b23", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183869, "uuid": "b413325d-9c74-4779-ae6e-a693baa0d080", "value": "3072:FwNJjwz5iX3qHhsEz0soRYCdUX7X2dM0wYM0EVBJh3g46J8+5B:Ausa1iwJYMjxhw46a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664183869, "uuid": "7e6a4572-cb05-49c0-80bc-cfeebea662eb", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664183869, "uuid": "df312e5d-b7c1-4b3f-bf10-818f27ed75ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183869, "uuid": "4365b5ac-e95f-4842-a4bf-b56a39cd6127", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0ba21a-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215611, "uuid": "a45d27b2-be06-49c9-8102-cb4251c9f351", "comment": "Malware payload (Mirai)", "value": "0a377a2c8ade037bef3a790a4fc3059e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215611, "uuid": "22d76f7b-09d8-482f-889d-84e2672bc489", "comment": "Malware payload (Mirai)", "value": "9d1e98c8cc352062a0230f7596daa1336fa400035e730f1bf50d3b94d1af6677", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215611, "uuid": "1c435dc2-75e5-4a5f-9e88-c1e7cca91151", "comment": "Malware payload (Mirai)", "value": "f64e946963644b1cf75c039fe82e0f16ecf598d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215611, "uuid": "8f05dea2-2793-476f-8832-ca9b54de6fc4", "comment": "Malware payload (Mirai)", "value": "d6f1f3c94fcaa71ad2c0fb0bd529e877e642fdf460cf0e6b5ac2cc1da2aeebea2e6de101a76ade68e22824c7758feccb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215611, "uuid": "80107945-c0c6-452a-aacb-2179b5fbeaa2", "value": "T1E423D892FC919E06CBC05275B95F6A9E3321ABD8D2CEB347DC202B2479D940B1D77E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215611, "uuid": "583834fd-4b6b-4610-a7db-8fc8f898bbd4", "value": "768:6h1I72hiVMG5lPgvhJTCQrxje5T97N0rcMe9lTE0CvG1wXhnpp3lkeaT//oZooif:YiWG5JoJT5rOxcXeg9vZSB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215611, "uuid": "63b6b4ed-041d-4e76-b498-f7586960a18e", "value": 46348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215611, "uuid": "9c9dc3c9-773b-4785-b50c-927b3e51de38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215611, "uuid": "f1094421-820c-4316-9c6a-c3115ddf163d", "value": "skidv2.arm5-20220926-1806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdaddc04-3d92-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664193624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193624, "uuid": "c74c99b9-c95f-4b57-ab7f-95daa8254abd", "comment": "Malware payload", "value": "6ffbecd028e465b70ea1e79a3a837415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193624, "uuid": "4ab66a3d-f8e7-40fa-84ef-df4757b517fb", "comment": "Malware payload", "value": "9d5cfa085a466d53042156dee2da2d23f7a6406c81e297fd26e96ae1f2f9c7bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193624, "uuid": "abb45eeb-b584-4606-b487-eb9f444c0eed", "comment": "Malware payload", "value": "5df0d42167e24f9358af12ed419162b0c286fdd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193624, "uuid": "2f5e4ddd-9a7b-4981-a741-1df2adcfbd63", "comment": "Malware payload", "value": "b01feb327143113ab2ebaae8673dda626d0c3584d2a7d05ddcae6e9c4fa3a75a33cc94fc65ba67e55f718d82d0aca6f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193624, "uuid": "2fdcece6-2ec5-43c8-9660-278aa94b45b9", "value": "T16A763371B4E4CCFACB466032FC552ED1F1A8CCD89EB21557A79F460D8DA9A03E02A71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193624, "uuid": "8d947b38-c51e-4d4a-a338-8bbae211f93e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193624, "uuid": "cf2057ce-17b0-4b86-af2a-f9fc5fdf4c51", "value": "196608:91O21jWkOglYdsV3K8FMK3RDsChCgTDy333Q7/iHgjj6BC+Yv:3O+jzlYSMK3RDvhCSs3QLf6BYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664193624, "uuid": "6182a8db-47bf-4494-bcd4-5aa03d5769e3", "value": 7644348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664193624, "uuid": "f479aada-a38d-43fc-8a11-081f8af76c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193624, "uuid": "1b4abc05-5dc7-4df9-a851-74bf2016ae07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff189652-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213893, "uuid": "06502773-31e3-4c29-a673-86c8680fe21e", "comment": "Malware payload (IcedID)", "value": "4b06f43a6ea373c819427a22e0ce3c61", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213893, "uuid": "03736084-6286-4fff-929e-6c66729c0f8e", "comment": "Malware payload (IcedID)", "value": "9ec7d14c58d34a094e55bfe20b7dc40c9391d53de9b7c0b6aac2fc7518748330", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213893, "uuid": "d6fa2770-5e85-4875-b174-0aa9559988d0", "comment": "Malware payload (IcedID)", "value": "4271539484964bb36011eff1f6a29440e05ade95", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213893, "uuid": "4b15c812-06fa-4f18-b066-7c507a768bc4", "comment": "Malware payload (IcedID)", "value": "eef267dc3ea9c5da3fb627b17b64064888602e0f8342207e0f481a37b46e2dca0bc05cb952d69e5d8d89aac9c4200259", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213893, "uuid": "a9dc235b-dad4-44e8-883f-70aa5d5909af", "value": "T1CF15F105CF54606BF00B697E371365D7F8A61C2B708BDE0A6B82112E2AD7F60EC35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213893, "uuid": "5bfe923c-b493-4560-a018-3496e019ca59", "value": "12288:YVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE5Orlj0HfzPnunP5Gur:YV2jUeQRI5wPN/EOrloHLuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213893, "uuid": "51189503-5f4a-46fb-a857-a6f6caed0fb9", "value": 888404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213893, "uuid": "15cd431b-c3eb-434c-8a15-65fc95eb14d2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213893, "uuid": "7bc7cfe1-e292-450d-b606-3453810f0e5e", "value": "meaccountingdoc09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4eae08-3d3f-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664157681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157681, "uuid": "c7e292cb-ec16-45da-943d-48edd528612a", "comment": "Malware payload (GCleaner)", "value": "d167c0bc09924231ed0f3bd6b00172d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157681, "uuid": "10c80def-e822-45a1-8587-d81f5ec34fa6", "comment": "Malware payload (GCleaner)", "value": "9f9b9a200438f06bf84313f2b500aa0efeb6aa4ce81c1a8996f72f0204f36ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157681, "uuid": "9924dad0-67b8-48c6-8cde-d8a7c3e76602", "comment": "Malware payload (GCleaner)", "value": "d186549a74185305356bf24132f44ae80f89e2ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664157681, "uuid": "58c97897-aa5a-4d31-ae95-eabc8371ad2d", "comment": "Malware payload (GCleaner)", "value": "3362d2e5e3792eb8ba74c2ecf8e6b03ff40c5f2e4d7adf19ae87137c8d3f877a147432583f9ceafc4b1dda2b8bba0b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157681, "uuid": "ee1fb521-7a8c-49a7-8243-ca2106c3d6b8", "value": "T1A04402117E909871D8AA7A748572CBF12BFEF401016655467BF43B7EBE326E08A703C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157681, "uuid": "f0ed27b3-1b21-4912-8005-5441b2e36dfe", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157681, "uuid": "b9e1481d-f2b7-436b-81ac-4d3853b339b7", "value": "3072:Glu0ekm4YkR357xDwmzjSc2jdN/Y7kxXHg81z8S0Ct+PFsf7CAThBG5x:lzOwmf2dV4kxXHgEzD0zsfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664157681, "uuid": "7e1a5af0-07ae-47b1-857b-7fd267a14a5a", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664157681, "uuid": "eeb22e66-b87e-4229-a466-b6b9ab9d960c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664157681, "uuid": "e03dcdba-8660-4e3b-8140-31ea7ad000a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426239d4-3d76-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664181364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181364, "uuid": "ba62e1f1-8d70-4001-975c-a9673786a3b1", "comment": "Malware payload (Smoke Loader)", "value": "0ec69e8290b3305f396400e5c828c8d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181364, "uuid": "762d8c8e-8dbf-4943-ba29-089a0725c4b1", "comment": "Malware payload (Smoke Loader)", "value": "9fc190ce067cd99437b4373ae0b26a5882e4ad1716fb077ca7286484a7d16521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181364, "uuid": "6ba6965e-c55e-4331-9397-086d65459027", "comment": "Malware payload (Smoke Loader)", "value": "26a9eb44eec8caf9f5f5fea95187624fb8e7004d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181364, "uuid": "d2e6052b-fddb-443d-a65b-14da22ad9dd5", "comment": "Malware payload (Smoke Loader)", "value": "f061a699c8c06fbe5d7935a18c4a0906305849b8edf1570e0e9e9b99adc2787b775aa6311b294fc212da0c8c7ea9f794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181364, "uuid": "4691dab9-26bd-40fb-9d15-53765fd8cb81", "value": "T1A4E3E0017A90D873C415C9B01831D7E05E7FBD115A3A1A8B37887F6F2F722D256BA366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181364, "uuid": "6764964d-a7b1-4b22-9088-25d11a60e076", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181364, "uuid": "87a20920-2a1f-4a43-8e18-a32261460257", "value": "3072:ABFXG5RuYrz2/YBmRUZiQApqODrMkdwoq9oB6agZfZmRp85x:Fu1/WZiQoqO1VKfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181364, "uuid": "6790c423-5237-4dab-88c6-974381a0e3b7", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181364, "uuid": "77fb1241-a763-41c9-892f-9c014ceab85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181364, "uuid": "98c550ae-8c56-4445-a659-52b2851ecd88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24b6243-3d43-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664159755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159755, "uuid": "edd836ea-41e8-476b-aee5-3dfb89de04c1", "comment": "Malware payload (Loki)", "value": "4c743f027a2c730fb9d2ddc1c8d56327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159755, "uuid": "12db03c1-d886-42ef-9a37-cde231130f18", "comment": "Malware payload (Loki)", "value": "9fd17bb86920c52db8ddcbd18efb3725f5570db182676fa678756cc3d3e11c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159755, "uuid": "e97e94ae-a19e-45da-8c20-eba922e3f76e", "comment": "Malware payload (Loki)", "value": "7017a737674cc5eaeaffe90c8df1fda151992259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664159755, "uuid": "e4ef9310-f3df-40a2-bc78-cc83dacee032", "comment": "Malware payload (Loki)", "value": "54b5ebb746e4a01a84e695b3c1008b7621c6e6ac66fb1fa1f5ec266c578c8db4ff8d9779f8f8d87cc931497dd9424aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159755, "uuid": "93327dff-825f-4a6a-88bc-c06e9c0e1d72", "value": "T1DF15F0331BEA8B0BD11175B895C1D2F6A7ADCD50E437C297ABDA6C1FF08A4619B70360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159755, "uuid": "759d3c24-dde9-418c-ba38-61cf94e24350", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159755, "uuid": "e25df5eb-cbba-45e5-acc8-77f7627a42f8", "value": "12288:e1vdkD7wb2ivkB6nkc5I6c8EKCsL5BBwImZP02iBAXq6yutBnN:kiLqkcuIEhsPcGjBAX2uBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664159755, "uuid": "512f1285-af19-454a-9460-3dbad4922137", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664159755, "uuid": "37519c1f-833b-481b-bc38-286ce23ff446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664159755, "uuid": "341c2001-26c1-41e9-aaf9-d16a0d39c059", "value": "DHL Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16707c12-3d6a-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664176137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176137, "uuid": "bcbe4237-2d7e-4589-b3bc-2ed1d0225ce6", "comment": "Malware payload (SnakeKeylogger)", "value": "65c1d91c76706750e757d8113f4cb4ac", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176137, "uuid": "9c6b541e-5ad3-446a-a76d-44aec7b64c7f", "comment": "Malware payload (SnakeKeylogger)", "value": "a01cb8eeed80074678d18b9569b5e7de6289421fa3211c3d4d51e4fabffa5023", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176137, "uuid": "fb5593f8-5c21-4161-8b8b-739343d387f8", "comment": "Malware payload (SnakeKeylogger)", "value": "5167d8e07ac7e69ca17092311ea81690009a0150", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176137, "uuid": "730918b6-0be6-4014-b641-af6431669813", "comment": "Malware payload (SnakeKeylogger)", "value": "7681c6f541442b22356a01ba9a77979ff996376384d6d250bf80fe941e46a9b4d325397ac595c88593815423cf421384", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176137, "uuid": "ad35e844-2493-4fd2-826b-a91e03bb272a", "value": "T12FF433C185277376E1F8E553ECCA3A7FED1335204EE6261E8233664112A58C65DF1BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176137, "uuid": "05db5ae3-a00f-4fe4-a2f7-8e7e2982b5a1", "value": "12288:8N+Bk4YGCHFTa/nTa3OxyiGL560yq5bPaQmVxYNoQ8LKR7rcnPh4qFjoXUjLS66v:8M5YzGWxhL40tza7gene7rcnPhL6ErS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664176137, "uuid": "21e5c258-9da3-4e10-bfa0-615a7b23cd23", "value": 733245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664176137, "uuid": "310a5f33-3def-481a-915e-a5b04075b80f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176137, "uuid": "f06775d5-a96e-4066-95cd-83f49ab1aa9f", "value": "PAYMENT SWIFT USD 315,017.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dd0d0d-3d47-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664161340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161340, "uuid": "c0e698e3-fd39-4ca1-9a09-d7b87cdd13af", "comment": "Malware payload", "value": "20704fc92ed49100e2963e7690e4cc95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161340, "uuid": "02bba96f-11a7-4486-988f-d568a5acea3d", "comment": "Malware payload", "value": "a07f93b63123cdf3cbcb146daf61069b7137e1a297346fb2f4c5fdcd30d4acaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161340, "uuid": "b505049b-96dd-4d0c-a850-813ff2122a7a", "comment": "Malware payload", "value": "d9d9c124c95fbc4749ef8ab8b2eb8c7acd329cdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161340, "uuid": "4b3c0df1-a252-4741-90e6-43eee83bd09f", "comment": "Malware payload", "value": "b430ee4ab591a887551984325bddc4784e6c124e880052765688ec739b631a02152d647cc39937767ed7807ee3c95ae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161340, "uuid": "9156c7b3-9075-4639-8365-b07e5834c56f", "value": "T1457633A03EEA9873D13325B5155E06CE747FEAA2862A00137317C76CC9399541BFBEE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161340, "uuid": "e3cf1264-2821-47b6-96b0-c1b3f6a11290", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161340, "uuid": "12fa274b-e4f8-4fa8-ba08-6d5f6df36305", "value": "196608:91OC2MisUkla+i6k9OP8EeQDPesNZZY9X:3Or1Hkla+MOEJsnCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664161340, "uuid": "b72c991d-04ce-4833-acf8-afa94390b2e6", "value": 7598706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664161340, "uuid": "ab26f397-333a-4c64-9fff-22bde7ad60e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161340, "uuid": "4258d469-32fc-4ff2-9166-50c40f8aab3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1620f136-3da9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664203194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203194, "uuid": "250563b5-7aa6-41fd-a2fb-3c52b0aa9ada", "comment": "Malware payload", "value": "eff38b7ac4b98063876fb590b37d1fa3", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203194, "uuid": "0bd14ac0-9bda-49d3-9a5e-46cd3a2d03f3", "comment": "Malware payload", "value": "a0ea6fe05b78d97ff6a4c8ae543bd024cbc1cfc79bf72cb72d1e32760b6a0d0a", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203194, "uuid": "ad6f7ea0-2b60-4f94-b1c5-a59ca40edec5", "comment": "Malware payload", "value": "6af6f3ecb43fad003192e2bd96e9b035a04a8a98", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203194, "uuid": "46c3caab-d7e2-4e69-b72d-847355aa2e3f", "comment": "Malware payload", "value": "c85099c2edf587998106c5546fe31ce0c5687871ff3fdbc095f433e698428b8035469e93a96317fbd5dad45291c607bf", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203194, "uuid": "71b642d5-b0b7-44ab-aa65-495eecf855c3", "value": "T1AA836C7EAD332F8C4717984FE4DC66C8DDACEF07E09554C4A0D819829FE8A15C8EB199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203194, "uuid": "af66305f-f013-4f31-8712-94f4cd29872d", "value": "768:Y8dudIqiYdp+wReNfyC76nHm24jsgOvUB+HH34893Tm1okpRFXvN/64NJzn:VWIqiXoDS6wwvuKH73S1o2/N/jJzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203194, "uuid": "365e6cb4-aa56-4e52-9440-40378a9ce05b", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203194, "uuid": "e8de40fe-516f-40f9-9cff-637b12bda2d1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203194, "uuid": "e71b2369-3df1-4de6-acc5-a2c02e751de8", "value": "Payment Advice-pdf.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac653ca-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214342, "uuid": "2b42b359-cdf1-46ef-a5e1-a023cbe1634a", "comment": "Malware payload (IcedID)", "value": "c8d6bc54b3188ba091c447ecc4561e01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214342, "uuid": "53612544-cde6-4b31-aa75-b93553e5b471", "comment": "Malware payload (IcedID)", "value": "a104706b5e5afbafb3ba39ef5dc4e86391be98ac6d8328464375701bd91a7373", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214342, "uuid": "ce708890-d784-4e1e-97ea-767c42c0b4b7", "comment": "Malware payload (IcedID)", "value": "13641366d1d1e10420bb5733c26feb8fbfac2423", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214342, "uuid": "5314d673-128f-4e67-8dfe-ce38bea4f136", "comment": "Malware payload (IcedID)", "value": "54cba6f4a7629955ff73ca5da40f2882a7202b2c6a755df82102397cc6116c2d1edeae0e3250bb55680a8368faca5e0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214342, "uuid": "c847738f-9395-4f7e-a733-6ae1b95afe97", "value": "T1E36419D8B792B0A6C3E37474443F010BF27B6E91B84ED894E145D5D06DB8A9A817BF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214342, "uuid": "b75ebda7-7447-4018-a1d4-7850c9aec0fd", "value": "73813c349be5287bd1e7c6f95d8eccc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214342, "uuid": "782d6b30-9724-4df3-b34d-92e895d1d967", "value": "6144:1OA2m2kP7+sOjcroyI0xwlh8boidmQp1tRdnjU8bN:152/kP7yj1kuvcU8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214342, "uuid": "ea54d3b9-ba7b-4399-9bb6-8d7ceac5d539", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214342, "uuid": "bca40824-7f12-451e-8f56-a02236b811ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214342, "uuid": "3083caa4-cf24-485e-a437-3721826fa739", "value": "c8d6bc54b3188ba091c447ecc4561e01.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad241e43-3d33-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664152767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152767, "uuid": "4b94d0e7-3e9b-40dd-8042-16c63e0137c3", "comment": "Malware payload (Smoke Loader)", "value": "7c2e7ae612b923ea9b71c3534be22164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152767, "uuid": "dcc6eb32-bc16-481c-987e-6debe0b9fc36", "comment": "Malware payload (Smoke Loader)", "value": "a10effb712bf4b033ead87ef98c28c37746d529f00034ab3546d00578311cd93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152767, "uuid": "a45e8a0d-906d-46c6-9df9-306cc9eee07d", "comment": "Malware payload (Smoke Loader)", "value": "ca2d0077887a578dc62ff224f18ebdd39464d49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152767, "uuid": "aaa35a4e-d992-4774-8e12-000dbb73c51e", "comment": "Malware payload (Smoke Loader)", "value": "3face506527dd6e68b165b31149597a1e9c922e552de70693d5c4d5c258e5634f9d1c951607ba3c2fd0045ece17277d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152767, "uuid": "d5dac487-6968-4823-a1e5-a565e593cd71", "value": "T1E504D0217780F832C4955A745874DBE02EBB7C514629254B3BA82F6F9F313D287B339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152767, "uuid": "c64d1e30-85c3-4b7e-a68e-fbc91b8157d3", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152767, "uuid": "7f051061-04ca-4bcd-930b-0f8729514273", "value": "3072:SCvt7cer18z5B9w/AJ7VRaQXABpxv55x:tKw/AJRYQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664152767, "uuid": "8c013212-6de8-4092-9291-14340f3d6313", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664152767, "uuid": "7fc47c01-9829-40ee-941a-93c62689f54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152767, "uuid": "80a61ea0-b359-418b-8215-61316844a972", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b3c9f2-3dac-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664204720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204720, "uuid": "1a5b06d1-2078-4c3b-9118-32efa83d0bcd", "comment": "Malware payload (RedLineStealer)", "value": "001f70241720a1985bb2e825ae235113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204720, "uuid": "f454011b-b135-4aef-bac8-ab1e71585bfe", "comment": "Malware payload (RedLineStealer)", "value": "a1668f4b671e72fda01c78b60d66c9fe626e4c40d89bb49581764b0dd516200c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204720, "uuid": "3b97f920-4631-459a-908c-bb69e1df3a99", "comment": "Malware payload (RedLineStealer)", "value": "d420441b4490cd5864ab2e44066290f24fa1b1d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204720, "uuid": "afd301ec-872c-4865-bea5-a0572c8177f0", "comment": "Malware payload (RedLineStealer)", "value": "91c7c13b8c3579ddce66c8ba4540cd7c7d550a683a1faa68c5ea0015189d974dd5ac2aa918ee0751bff13915184b26bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204720, "uuid": "e58babe9-ed41-4ae0-908b-19e0ce6eecc0", "value": "T1F615CF27B1D188B7E2B707385C0BD2B5582E7F212A24B8467BF61D0C8F756953C2E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204720, "uuid": "28e35b12-0271-4867-91aa-fd598c78a5cb", "value": "b9539c41d9f4c4007eedc7eed7176750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204720, "uuid": "5b1f003f-4c31-455e-8709-5ae5142f5c14", "value": "12288:5QzxgEpETmc3kne6pX+D/7OldnJtPkIjAGzgFdy9+AdNGh/3Doowe9Prq9:5OxOTmb0rEJBAGzqI9+AdNGhboje9u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204720, "uuid": "2349e16b-3c5d-4cc7-9196-61fe7ec1000e", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204720, "uuid": "734b1f34-8b2b-44e7-97de-304e4e845733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204720, "uuid": "45baf3ea-6b1f-4611-bc10-65511f899e64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011a52c8-3dc9-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1664216903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216903, "uuid": "b84f2717-1308-416a-8f1c-17fe25a9da80", "comment": "Malware payload (Vjw0rm)", "value": "130fe2e5e4dfbd03e161a332ce14cebe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216903, "uuid": "afbd34e5-234e-4fe7-999f-a0883955663f", "comment": "Malware payload (Vjw0rm)", "value": "a1aa91a1ae489d8be807999d3b7a8bc8b10794063d763d06667384ae6152e720", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216903, "uuid": "a7db5eb1-1cb0-49a1-9de8-3b0830301f43", "comment": "Malware payload (Vjw0rm)", "value": "89a0f599416dd6f9b75058e32ac542edbc7ff108", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216903, "uuid": "6855b7f4-630f-4c5f-a383-17e2b584eb87", "comment": "Malware payload (Vjw0rm)", "value": "eca13f87c29dcc46be48447f12e2a78bd097e5a3c7c3ba875b326dadec6b84e71356da8d0796aa09f982fd4190728b64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216903, "uuid": "3f774b90-0ee9-444d-8817-933ea633e207", "value": "T1A7C3CF213DCC2ABDC7A4962643FDC4910ABCC3DA71C5244756DAEBF43A93D9A24370E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216903, "uuid": "a3234fc5-b5ff-4c2b-af90-dcc5856e5327", "value": "1536:NG347n0iT37jLbtB+3NABd7+2rCSmKO+e5JZTDRc+cMw4xl5hY6/QO7STboOhGrW:yiT3fj+38XeTP5Wuj/97m0INcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216903, "uuid": "c7fbeb38-09f6-4193-a362-f9547eb252da", "value": 119961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216903, "uuid": "06567cda-a928-490d-af10-5117c1956dc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216903, "uuid": "d13654ae-68a5-4e22-92b4-aef1af53d38f", "value": "Purchase Order____________pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c37614-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664184264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184264, "uuid": "907d7d5a-4802-4a82-aaa7-9037d1a0adab", "comment": "Malware payload (AgentTesla)", "value": "17e2572b78e4b8540158dcffd5e34153", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184264, "uuid": "24225e16-bebb-4352-94b7-4592aa5d4d7e", "comment": "Malware payload (AgentTesla)", "value": "a1b7fae88ade1706c6830c4328c4e908d76f617e8491468043eb9da3572bf22f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184264, "uuid": "da95591f-c4eb-4c35-8dbc-cb5cf2446b59", "comment": "Malware payload (AgentTesla)", "value": "51203c661339bd1784140e97894a67e3f32f8afb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184264, "uuid": "fb0c39e6-8d56-4582-8f3d-4c204b1153c5", "comment": "Malware payload (AgentTesla)", "value": "a76e69f5ce45dbadf55335d2c9ad4f1d00533b5cd3beab3a08aa9eac3e87e84b75e7b20016f9c04ba002293d04a7eae4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184264, "uuid": "a504f23a-6615-44c3-b63e-51f06604a537", "value": "T17C119B16B45EF555D71772715CC7C909C174078382D4F9C53E60EA50A5ED8EC4BF54B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184264, "uuid": "1e00a6e8-2178-490c-92a9-411476e25879", "value": "24:jh4qPp6z51nA0WO6FrNIyIkTDuQjjipOFdAZMguZcdFLg:jhvQz80w1NIyJDuQHKg0M7cvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184264, "uuid": "c5b4685c-54f2-44cc-90bf-65b9f28b9879", "value": 875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184264, "uuid": "bb60d401-4e91-4ce6-a784-008225772480", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184264, "uuid": "367909b6-d413-4c1c-87a6-e99f40bb5ec6", "value": "YTO T80T100TS100T120 bulldozer main clutch.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e276a47-3d7c-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664183907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183907, "uuid": "7620b6c5-d1ae-4db4-8402-73fea99527d0", "comment": "Malware payload (AgentTesla)", "value": "d2e4b37c4c263ae673f24fc9213cc0a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183907, "uuid": "7c453e6a-e48e-436d-a6a2-4ff6b44be3e3", "comment": "Malware payload (AgentTesla)", "value": "a1e588f2de58c53344c0113ee21acfad0312b4dacd0a13a4cf98ed2b45c3134d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183907, "uuid": "2a4426f6-8163-43ea-a25c-eabc5674d465", "comment": "Malware payload (AgentTesla)", "value": "716ef4338459c0d521d65ad65d36becbb4a0e362", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183907, "uuid": "35ca995a-f518-44f9-aca2-3faeee00baff", "comment": "Malware payload (AgentTesla)", "value": "8b3af6f6eba07ece04b4e21b8322f1eef842a08abafcec40968cfbdee3047bb97014cf322788bc3231797e5ec4799a75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183907, "uuid": "3b954ff4-d34e-4791-98fa-da605a5e4f9e", "value": "T1A2159D693695768FC017DD3A89E0DDB0AB656C639217C28752C70C5FF84EAE6CF103A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183907, "uuid": "e1385b0e-5b36-4981-aba1-d408430b9c14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183907, "uuid": "263224f7-6b76-4dec-9c9c-006e232b6685", "value": "12288:KepX8uZ3r7+KsSs0pBr1Z3p/xTAQ76SJJIEyJMSkcZNetnpmq11g67atHUVTENAy:XfZr7GB0pjZfTPNJcWSkcZ8tpm0g67m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664183907, "uuid": "a66ef762-d246-423d-997c-8a938b3f1c0e", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664183907, "uuid": "bfdb8792-54c4-4277-855e-6906bad3b91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183907, "uuid": "f432a594-6d24-424f-b3de-c228a6a368f7", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a883f22b-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (a310Logger)", "timestamp": 1664171228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171228, "uuid": "057f05eb-38e2-496f-b7a1-c28af3b9dce2", "comment": "Malware payload (a310Logger)", "value": "23425ae1ae3c3daf49f96396ef2032be", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171228, "uuid": "246086f6-af19-4d4b-8180-0817c45efd89", "comment": "Malware payload (a310Logger)", "value": "a2e65c98bed9b341d0abc1ab3fe49e5aceb7705689143bce87bb0b45b213935a", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171228, "uuid": "b0d93eb5-5bd8-4f89-8b26-4d4caaba759c", "comment": "Malware payload (a310Logger)", "value": "5d14fe99c1f0d0f495c61d21667c11f428f9d367", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171228, "uuid": "a4e36b16-3ee5-48e6-aa07-7859790bf2df", "comment": "Malware payload (a310Logger)", "value": "6e9c59f6331f355642ac08e48f3a8340272306665cfb9b638d08802bf707471a1d381344060b650da4cf74bd76cd3be9", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171228, "uuid": "fe015fa5-7c67-49b8-a3de-53bc0edc4e5c", "value": "T16CF4F136B9F8A86FC1E6FB38BEDB5424279E9C083C5DB84025DD9666E471C041E82F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171228, "uuid": "77c46a3f-c0d2-4121-a00f-215ce800ad52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171228, "uuid": "ab7d2bab-b945-4fcb-a38d-b172cec670de", "value": "12288:poKYjeTEWpQwSzxesgwgnYv8iRMcobbE/fGrBxXtR4b57bukxPgs8jnRI:RPEiQwSzENwPfKM/fGVx4NJxIs8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171228, "uuid": "47fae356-1102-4a0d-bb06-f7ae4d73dbc9", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171228, "uuid": "0258ecf0-0f52-4c86-ad87-b2792d91ef3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171228, "uuid": "3064e6dc-9ac8-4df8-bc89-597cf975d306", "value": "SecuriteInfo.com.Win32.DropperX-gen.12084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb60941e-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215095, "uuid": "f7ad1025-af6d-484d-9b81-f0ba87dd68fa", "comment": "Malware payload (IcedID)", "value": "27a45e1df35258afd013d765d0786a32", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215095, "uuid": "c37e900d-8b13-418f-aafd-ca63aa12737c", "comment": "Malware payload (IcedID)", "value": "a36f793145c7a775fca887e5ada691ec71137678da479a476bfe70fc1e30e57f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215095, "uuid": "488310a6-60e1-46c2-936c-78bd47766eee", "comment": "Malware payload (IcedID)", "value": "91394622f15cab0e27aa589039fbee5d57c5281d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215095, "uuid": "aff03773-56e9-43a0-9d42-84e7e598a5a8", "comment": "Malware payload (IcedID)", "value": "fa7bb2b491ab1c9af19680d0aad416e182d379819acb1aa82e096919d2d44eca51731220f6cbbc33931e13ce92330d70", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215095, "uuid": "60b3d317-8965-4f10-ac4d-90e333500ead", "value": "T18415F105DF50616BF00B693B371365C7F8A61C27304BDE0AAB86112E2AD7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215095, "uuid": "f04f9f71-96b0-4361-97a8-c6d4a1522517", "value": "12288:FVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEwpcxJWVprVMmM:FV2jUeQRI5wPN/Jcx45MmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215095, "uuid": "6516cd02-d5d1-4685-ba27-60644c505e71", "value": 886827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215095, "uuid": "c65e9ada-0488-4b5e-9bdc-f6c315acfc52", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215095, "uuid": "039d4397-a968-4943-b542-ea9df6d0fa5f", "value": "morandostores file 09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b29b640-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180493, "uuid": "4463ef56-462e-43a7-93c4-11fc30749114", "comment": "Malware payload (GuLoader)", "value": "6917fc2f74362f2a0f5f2c48ec56305d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180493, "uuid": "f78d3ab4-49bd-47d0-abf7-d128c8e4bb99", "comment": "Malware payload (GuLoader)", "value": "a37e1048aeda0bc82224d74b2fdaf7a93fc85e7b57e6b9d55e108442f0806878", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180493, "uuid": "45c98eb5-d209-473c-99c6-ffb99b0f38f7", "comment": "Malware payload (GuLoader)", "value": "4ad50631fcf48ed560111274c48326bc89e7572d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180493, "uuid": "b5c42ba0-0da7-4e65-82d1-0795b36306f9", "comment": "Malware payload (GuLoader)", "value": "55a9da246ae81b2242abd55e13a436f8bd2e2d6607a53d74f50eef79a5bd027e1ad8607d186a6d93049e5d8c653bf54e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180493, "uuid": "df6df8ce-a2b6-4535-8a3d-ec7a4bb4954e", "value": "T1F0148120C927DEE0333C313EEB0C4A1C544ED916C3A2955DF93915E5B6D1BE887AB1EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180493, "uuid": "d11315d1-34d6-42c5-995b-e53304b2a500", "value": "3072:Fr5guwqyNvqc/TfyY/X/WZwUvwK3HVto1XgOevM8K4Ec5C4M:Fpr2vqWuY/mwU4K31to1Xhe3Ecwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180493, "uuid": "597d96e1-a248-4cff-95a3-508bee8b63af", "value": 195813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180493, "uuid": "11f0f699-ee29-44ff-befc-ac0128b5e40b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180493, "uuid": "8f3a3b52-1d2a-4940-a7c9-1eb2c3665c2d", "value": "195727592-042128-sanlccjavap0004-4150.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63083e20-3d99-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664196451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196451, "uuid": "89a2b4eb-7a63-463a-b75c-525eade0857a", "comment": "Malware payload (Mirai)", "value": "0954e7fdb566b26a1dd342752eae4d88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196451, "uuid": "8dc5e4fd-31e7-4b25-99ed-a442c88a23a7", "comment": "Malware payload (Mirai)", "value": "a381256c47ee0a1ed358661289789a3333588cbece5d66e66df00a9822357408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196451, "uuid": "f2b33336-b02d-4b9b-a6af-ca1bfbe4cc1a", "comment": "Malware payload (Mirai)", "value": "c7feea183e76f76785d2538b436d9ffc1e505c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196451, "uuid": "47c36040-0cd5-4514-b138-7704c75a0ac7", "comment": "Malware payload (Mirai)", "value": "c11dc7f5a4199409b5bbc4821f278a583ac71270adbf05eb06c2d6a7ef6811c2a8fef2ec21914a4ccd49a633ce099765", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196451, "uuid": "7f127b1d-c016-4194-9650-6236dbc25e06", "value": "T120831946B8828E11C9C513BBFA2E118D331767A8E3DF72269D106F1077CA92F0E77956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196451, "uuid": "abeaf7bf-be13-4e62-b544-5bc7d88b333c", "value": "1536:UwniVGDWY4nBm2mKmbccUesVYuydwkpmOF110AGarEgVQnM5innQOre50Y:qGyZmxbc/fW1dwgPvvGaMnQOre50Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196451, "uuid": "1f6ad705-abf9-4dc0-943f-dc508fc689b5", "value": 83480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196451, "uuid": "1d19d1c6-2bd6-4cc4-b512-c6c3bb902e4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196451, "uuid": "3e25a2ad-2160-4cc3-8621-63cf32aadf4d", "value": "0954e7fdb566b26a1dd342752eae4d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799eef0a-3db0-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1664206368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206368, "uuid": "a2f93069-ed32-49a8-8ba0-8f626fa29d66", "comment": "Malware payload (GootLoader)", "value": "37cc5b3e3b1d41b517ed5d3afccde9f3", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206368, "uuid": "6b6c1ce5-0be5-4a32-8ba8-93de50ffea07", "comment": "Malware payload (GootLoader)", "value": "a3a0e7bea2365c2ab8349cdf68d1f7b21d039d1f4f9cb1e5da8da89ff2260511", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206368, "uuid": "084930c2-a1fe-4df6-9f79-3259ea764cb4", "comment": "Malware payload (GootLoader)", "value": "a4122f73a1ac35bf37e5cf445deb623515129969", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206368, "uuid": "37cd86da-d1c1-4a76-8c7c-70d7bd9353df", "comment": "Malware payload (GootLoader)", "value": "0dbec16d69abde89fc50e80a5562c29b6258c0eb6af14ef009ad4581e63eaeb5ed813b83fea7ecdc798324bac31d0c30", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206368, "uuid": "8233a300-847a-4524-b6b6-aade21dbf676", "value": "T1EBB4A40EABEB3326C52371799F5F9004A535840B661AEC1D7D4C93880F5863D9ABBFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206368, "uuid": "fb18d1f7-fd5d-431b-b636-edb262188349", "value": "6144:iQSfSzulaxl4khEfDLxAtWiagmd4iLAmW667SF:xBhEfDLxviagmd4iLAmW66Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206368, "uuid": "3e07a2b3-8357-4b99-893d-15df3be48421", "value": 495527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206368, "uuid": "b76499f7-f32b-4cf7-9e29-f13583c9c892", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206368, "uuid": "2a87e566-c432-40b5-abfe-699e0b47f5bf", "value": "loader_zip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e31051-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173270, "uuid": "1d25c66b-c83e-445b-b602-89d7551bf193", "comment": "Malware payload (Mirai)", "value": "8ccc8666fbe8e0047cae75055ac98008", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173270, "uuid": "d0751c6b-8eea-4db2-a652-64fb21c6aa88", "comment": "Malware payload (Mirai)", "value": "a433378bd515940d7f4c013d5feeda5e83611ac9bc783875c59760edca683efc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173270, "uuid": "fb072ce6-a1d7-4be8-88b3-6cc6e3fe553d", "comment": "Malware payload (Mirai)", "value": "fee85fc22931e94def245d819f0879adca7559aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173270, "uuid": "2e9a38b8-3556-4581-8e8b-37a8d551d02f", "comment": "Malware payload (Mirai)", "value": "1b2c71cc8a8440fe372d8edc8c23c9dd787599e042ab9c69b091a76c2c616dff445fc8aa7c31ce12a93b6d6433c52313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173270, "uuid": "058cd509-af74-46e5-8ffe-fc6f5c3e3d4d", "value": "T1676302D76A39ADF1D0E2947DEF064C07E7EA23D896A2F0A2165894317CF200473B25C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173270, "uuid": "6993887d-687f-4c2d-9ec9-18754f2e413c", "value": "1536:AGC3U33+9QzdOrHteg/XSE4Hf1s2VHMR98LKas00b9qf3sTgoGInevEC:A0cHtTXv4O2J898LGa3scKeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173270, "uuid": "cf8dbb02-d48d-467c-b4bc-6af7162ed60b", "value": 68704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173270, "uuid": "57eba6d6-2c95-485f-9d07-a19b47af5d8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173270, "uuid": "4422fdad-c05f-46eb-a3e8-e59f448846ba", "value": "8ccc8666fbe8e0047cae75055ac98008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc7da77-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213191, "uuid": "f1e9845a-1a26-4adb-872f-608b881f0071", "comment": "Malware payload (IcedID)", "value": "3a885f1ec285d39dec2265905553a794", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213191, "uuid": "95a1a326-9651-40cd-bd67-c66ec024960e", "comment": "Malware payload (IcedID)", "value": "a586f7e99af6232f33d3b7971f4c3107c9f45d086e18a29314c082b84d332d34", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213191, "uuid": "46a4d70d-a297-4dc9-8ac1-c94578b6a274", "comment": "Malware payload (IcedID)", "value": "b2a3efe01e29b0156e195266cb8c156c234fee7f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213191, "uuid": "d81d5f67-40d2-4e3e-9037-8f0147aca670", "comment": "Malware payload (IcedID)", "value": "ea03cc16da6684582dc14c15a6292a7fe05b517b3e3841e88cf9835e3a56cfba91fe99855f523bc4adffaeec886f9195", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213191, "uuid": "ade22584-1a66-4b3f-97aa-5129c7cc2a91", "value": "T1E615F105CF44216BF00B297A371365D7F8A61C2B308BDE1A6B96112E29C7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213191, "uuid": "9cae7dbf-d415-4ce1-926a-e3001133baa3", "value": "12288:e7D1QZVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEnJASz5I9f8h6dw:CD1IV2jUeQRI5wPN/g2e5W8h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213191, "uuid": "69d8d26c-0669-4517-b1e9-daf76230a68f", "value": 886776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213191, "uuid": "a6d5e81d-cb06-41cd-af22-cc3a6a13bfbd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213191, "uuid": "79787616-4ef5-41f2-bef3-d2acce2113fd", "value": "nckcn-document-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cd69d6-3d46-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664160914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160914, "uuid": "b8a1a04a-1ff0-45e7-ac44-05b20b2a3e9a", "comment": "Malware payload", "value": "a1bf4d93e6d844e9924c7e6e00f85550", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160914, "uuid": "bf1168ba-ad80-4898-9308-036a279d6be7", "comment": "Malware payload", "value": "a5b504fced6daf4f58989e7451441a2281d5e494dcf973ce19308da5e07514cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160914, "uuid": "1d68e8d4-21a4-4f53-8e0c-598f8e40a80c", "comment": "Malware payload", "value": "4b2c60d77915c5695ec9d3c4364e6cd6946bd33c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160914, "uuid": "0d3c13d4-292c-4b34-aa4d-9975d3701747", "comment": "Malware payload", "value": "63c30899d71c3b6257c9d16e5943edab57c796af0f8a975b16575c47a970f753d6ffbe1e8f1acd39eabf5402b015af37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160914, "uuid": "1de538cd-f981-4e48-8a66-4780d9ef217e", "value": "T10F935A12B6E190B0D5FF467844B98A12077F7D31EAB18D877B94128D5E742C0AF3AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160914, "uuid": "1064b054-c5ab-4eb8-bf68-674383433951", "value": "9d2aad0a79681247385b43b501598997", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160914, "uuid": "130801ac-66e7-4cf5-8dbd-ae03826f7023", "value": "1536:S52zYBbsJSO6YeV+gBfe3MaznCklzoc8ZDllsWjcdRDg5mZalm:S5ElhAffjgWZhKpEmZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664160914, "uuid": "8b2966ce-62eb-4e8e-a2ce-36a27e1a722f", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664160914, "uuid": "3c2fe67a-d577-4578-8a2e-9dd878259283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160914, "uuid": "c826d753-6a46-48c9-8309-5e9cfabbf672", "value": "a5b504fced6daf4f58989e7451441a2281d5e494dcf973ce19308da5e07514cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc49c96e-3db1-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664206963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206963, "uuid": "c61d809c-f25c-4f9b-81b8-41638bea10fd", "comment": "Malware payload (Smoke Loader)", "value": "1094a2d4316d48394aa67097384945cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206963, "uuid": "10e3d1a6-7a6c-4d01-a21c-60a1f3696c7b", "comment": "Malware payload (Smoke Loader)", "value": "a711f944a260e0bbc12c287681296965da7c55253c9c9a92eec3bbe106263474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206963, "uuid": "16cd9796-e0ca-4de0-b724-66ce97389015", "comment": "Malware payload (Smoke Loader)", "value": "eaaa66053c3f96aaff8ad60dcc127f1e3978cc56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206963, "uuid": "5d8d32a5-1652-42cb-8d41-dcb926b55efa", "comment": "Malware payload (Smoke Loader)", "value": "13dda82ca4dfcde6c6d97e7a63cb49cd5225aab56411b5f66596fb2968b8af1252854d43c888cd53c552e1d5ff9627f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206963, "uuid": "55334006-567c-4522-ad14-89a708ba3cfb", "value": "T14AE3F101BBC1E432C155A5718C31E2B1AE7EBC11063A5A073B986F6F6E312D1B7B9396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206963, "uuid": "8a297fa8-a9cc-421a-a32f-4ab32160612a", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206963, "uuid": "a9a720fa-30e0-432d-9414-517e7931e85a", "value": "3072:tLKj6Tc51avosE5cnqnye4xqbZBXQBSWFVdw5B:wwoRe6yeD0zFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206963, "uuid": "c972738d-e506-45ac-9126-ac2b04333d22", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206963, "uuid": "4574e46d-bab7-47c3-9456-0791099803d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206963, "uuid": "5a7fb8be-a654-4f7e-a094-a7a73fe74411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fd7d12-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227212, "uuid": "a6fdcb7a-1edb-4ddb-a48b-8c7a094c3c11", "comment": "Malware payload (Mirai)", "value": "6d6fc2a0003652dc4906d49cd804939d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227212, "uuid": "0b115f49-e4d5-4ad0-af7d-be4d1d61213a", "comment": "Malware payload (Mirai)", "value": "a8529f886af2ca324f20a065c208e61ba66cd72e603544db60527f81b639fcf0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227212, "uuid": "ae748d15-6bd8-4fc0-9eee-4f2647ad74f7", "comment": "Malware payload (Mirai)", "value": "61f248de2f5a45209a4293046da4c5005a1fc0d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227212, "uuid": "0964de19-b150-46b7-9993-96ba58ee2763", "comment": "Malware payload (Mirai)", "value": "53977d53689266f98b1555b6f20433302e0c15dc8dfe56e3261cdedeb4cb30968a5accabbcc50eaa1c23a57f8882b024", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227212, "uuid": "c60bfea9-2f48-4996-b8fb-da1b53cc3ac8", "value": "T15BD2D076D1F4AB24C1AED2B0447F3A594016B719F4D0C4F323E0A97B945EFE92B14687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227212, "uuid": "dcdff287-9162-45b6-92cb-7e5d8d2e0809", "value": "768:887ZwYyHiMwqE6C3qdzNzyU5svnw6tR+HnbcuyD7URQRjE:8IZICfqjkseU5sZ+Hnouy8Ryo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227212, "uuid": "58474a93-12d7-46b2-9ccc-d29422e77b9e", "value": 28756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227212, "uuid": "3d5e3d76-3df0-44f8-88e6-450c49743179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227212, "uuid": "22c73d28-8654-43dd-a462-5115825661eb", "value": "bk.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4538d02-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664201795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201795, "uuid": "723bee17-2106-4477-a21c-f394fe1fb5bb", "comment": "Malware payload (Smoke Loader)", "value": "e76782424eec65609faa37012ab94e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201795, "uuid": "c6890988-8a9f-4624-acec-23b00d3e5cdf", "comment": "Malware payload (Smoke Loader)", "value": "aa052b9f9248df32c316df1025d6dac36cca734ab7fd9edeb1fe5d9ac3833a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201795, "uuid": "72cb1ec9-8b71-4d88-9fe0-be8648979c5b", "comment": "Malware payload (Smoke Loader)", "value": "080eb5f7f2b3bcf4a281d05711e1b962a163bc44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201795, "uuid": "8dcfa723-a45a-4859-90a4-5818d2dec454", "comment": "Malware payload (Smoke Loader)", "value": "c9910685b94dec93d7669b9cc44ad365073ed59d9ba25deca8f7b3dd5cd6e98946b899e1963dad0499988b2acd9d37fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201795, "uuid": "d8f5442e-04be-48ee-adcd-5d5a1f33555b", "value": "T1C6E3E0017640D973C41596741824A7A2BB7F7861213E4A8B3BA83F6FBF323D26B35356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201795, "uuid": "d4acbec8-6fc7-4115-999e-014ec96b103d", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201795, "uuid": "083d9692-9064-4826-a5df-db0441793c6d", "value": "3072:jAZZqhTF5u61utrkSwFsJ90SGx2IBzBBg5B:CyEro+J90ZNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201795, "uuid": "69fb4035-1e64-450c-8dba-d5450f49c08f", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201795, "uuid": "d0512b60-fc09-467f-9745-78990ad95e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201795, "uuid": "3192301f-f82c-41cb-8568-bc354a035380", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275d8ab7-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174447, "uuid": "5db66b14-1628-4ce8-82e6-28db13a87a76", "comment": "Malware payload (SnakeKeylogger)", "value": "a43e2644771c259899e063ee16be6e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174447, "uuid": "e82f5c9b-1e32-4b06-bd00-613c24b69fa1", "comment": "Malware payload (SnakeKeylogger)", "value": "aa4555c13f27ea8f1a7eb7c54c276ba74cbda6137af7ea34c654442891414268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174447, "uuid": "87106eca-bba6-4e4c-ba98-847349db8c9d", "comment": "Malware payload (SnakeKeylogger)", "value": "640e9bef98cc96a6e599100ef34272d76777f0a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174447, "uuid": "7f175af1-5b37-4ffd-a0df-229db7a45a2d", "comment": "Malware payload (SnakeKeylogger)", "value": "130841641dbe5eb3c13e9ad345852045bf11b5fc9c3a6146315540370ea5551c3071aff178c73e8e49978d649f22d040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174447, "uuid": "e6d96393-9927-4af3-bdf3-10d354dc6520", "value": "T15DF4E17168D39F89D83915B19863C998116B1DEDEDC08C6971E13E2FB63736336A330A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174447, "uuid": "ec5072b6-a03c-4524-9cda-04d3772c292a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174447, "uuid": "a0a127ae-154a-419c-93b5-81130d80edb0", "value": "12288:BUate3XMQGjNZP7rvTZP/DepJGzNXEfkBJ0uk8EHCOuzsZff1OijzANBd/w4CEAS:rt+qrvTZP/D8a5EcT5qiXslf1lsNH44C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174447, "uuid": "b2d8063d-8b01-4202-a79e-5d3c951f7a11", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174447, "uuid": "8abb1d6b-0075-41db-9db8-a54b987208ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174447, "uuid": "db8155cd-4291-4547-b064-5036eeb91f26", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348686bd-3db7-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1664209258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209258, "uuid": "fc816729-59c3-42f5-8224-a392ce7b8227", "comment": "Malware payload (ModiLoader)", "value": "00a3d3bc04f7243afd1f83213ff10417", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209258, "uuid": "e7a9ad7e-40c3-4541-8f01-1ffb47326643", "comment": "Malware payload (ModiLoader)", "value": "aac435197fd741ec3a3d37a32ecd926f1662e77d46485859bfd1cb43e2288a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209258, "uuid": "53f32b54-6c01-41b6-a39d-e6ae0a438854", "comment": "Malware payload (ModiLoader)", "value": "4fb67fc4a59d27df39aa2d51780d760b8524f9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209258, "uuid": "eb0ee56c-2fb8-423b-aa3a-6264043868b5", "comment": "Malware payload (ModiLoader)", "value": "7edaec254718daaff9d0dca129ce9394d270032886775cd9d9645d4fe5884ca7f40885be3abf0c9d4cf616fa6085fe08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209258, "uuid": "f4dee3b0-4f04-4cbe-9c01-52de97920527", "value": "T193257D22AE92483FCD331678CD3AF2A9941E7E102938AC4A7FE55D8C4F3764C7964197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209258, "uuid": "d8b354ae-2eab-4cb6-9cd9-ff7c9130abd2", "value": "bb071efdd9e5c0f4b6a51f23cc10db13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209258, "uuid": "64589eaa-ac2d-4f48-91b2-bbb3a3be6011", "value": "24576:VkUwSu91iUJodQ/UbMV2i4rNNXeaqnjD:Vw9tyiwNXeaqnjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209258, "uuid": "7ef241e5-3a61-4d3a-90e8-d593f9ca9a32", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209258, "uuid": "ec340978-1ad1-4bef-a078-8258f1769470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209258, "uuid": "7dc5ff64-517e-44d5-a30c-7165486619ed", "value": "SecuriteInfo.com.W32.DelfInject.EJ.gen.Eldorado.31044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e8903c-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214062, "uuid": "663c75be-5e3d-4454-aba5-c07f5a46b5ab", "comment": "Malware payload (IcedID)", "value": "4f5a56eae80efdce9cf465e8754cee49", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214062, "uuid": "34b18f92-1a12-4440-be65-40e8881416de", "comment": "Malware payload (IcedID)", "value": "ab820915d00cf32c67fbaa79b4ee3ce7bf9d9d3357bea3a53b54f429e03a3c63", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214062, "uuid": "068602f0-49e7-4bd4-ae52-b321eb080f94", "comment": "Malware payload (IcedID)", "value": "c71b6c871b793c2005d250dc03fa2917247bb1d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214062, "uuid": "bf1a4c70-96fd-4fdb-bdf4-f4586fce1f66", "comment": "Malware payload (IcedID)", "value": "af4c64fdda17034a611591fe001e51888da02c19039c25b7d17361cd99ca0fcb045c565a423758cc10d97bc48cdba30e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214062, "uuid": "14d42734-6a8e-4b8f-8d98-ec800e8f3065", "value": "T17315F005DF50216BF00B693E371365C7B8661C2B308BEE1A6B86112E2AD7F60FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214062, "uuid": "458b946b-9e76-476c-b1a5-944190bd28fc", "value": "12288:sVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE7qesy5MD6d1AZVwb8:sV2jUeQRI5wPN/kBZMhi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214062, "uuid": "d02616bd-a3d0-4d2d-bdd8-ce2f87994a99", "value": 888292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214062, "uuid": "87640c5e-8215-46ce-96ba-f7d39e7d815a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214062, "uuid": "b84e7ed9-356d-4785-bed4-afacb1b9e2b8", "value": "leonflam-file-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9a8215-3dd0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664219927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219927, "uuid": "7bbe23d7-3873-49e6-a158-cf8e8256a75b", "comment": "Malware payload (IcedID)", "value": "908846527f104b1f0aa5d4856716b682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219927, "uuid": "fc8b78db-c673-4f4a-946b-07933db6803f", "comment": "Malware payload (IcedID)", "value": "abc0382a20c86144086e39ccf107bb7702bde07dcc66a06967a01bc15f6a1432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219927, "uuid": "47a30057-4f31-4550-b15a-d66979122135", "comment": "Malware payload (IcedID)", "value": "877c816a605450a86b6a24fce3977a693f60b4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219927, "uuid": "f166196e-40d2-4ec8-aed2-9d54f176e68d", "comment": "Malware payload (IcedID)", "value": "782a20a78dcabe3b197dc5fe8fe93f24f163271779cc6eb9c509153e85be015f7441bf1aa3b3bee981a53c0a53454231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219927, "uuid": "7f979acf-ffc7-4fbc-bbcb-37651026d00d", "value": "T19BC46CA5B5C13026F27392B9A0AB6546B2369913F00689E4F17EE5E0DF749CE0133F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219927, "uuid": "f17b36b3-daf7-4688-b58d-b9b56ec64925", "value": "57e15b09d7603d6198c3216f60001fb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219927, "uuid": "38a3a475-e957-46ad-b2e4-4b8eee25e141", "value": "6144:sEJT/WWRn8SwytzDTvCrQEgPL601iSvfkAierdcLh3lT:sEIypvCsbt1lvcFLvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664219927, "uuid": "bd5f39a1-d784-4361-b612-5016fc0b8ee0", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664219927, "uuid": "9f662061-8cbd-4818-9a01-09389ac0e4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219927, "uuid": "832581a4-401a-42c7-9f8b-8c92062aa6fd", "value": "stenciling.db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2037c2-3dc7-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664216175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216175, "uuid": "3ba48f73-a3b8-4c8e-a08a-ce2270362505", "comment": "Malware payload (IcedID)", "value": "cd8286c6f0e799f84263776de34428ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216175, "uuid": "499b243b-704c-4397-864b-a83f3887eb09", "comment": "Malware payload (IcedID)", "value": "ac814b4b41b44ffda71d75579117464c3fb105f226b40b767ef14255a55f2eb7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216175, "uuid": "11c75031-99bc-422d-8ed3-1897251fb69a", "comment": "Malware payload (IcedID)", "value": "41b6a644081fbf74182b8e16eda4ce614fe2cff8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216175, "uuid": "bd681eb0-6bad-48f1-8d96-19b6dfdfed84", "comment": "Malware payload (IcedID)", "value": "3140f33e291550f3964d1be64311592c5994968402f45184d5108bc904edc537c1845555497fe94f3d51bea457a90c26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216175, "uuid": "d09c97b0-d5a3-4832-9ba9-a65adf1abcf3", "value": "T1FD6408D9B7D2B0A6C3A3B474403F110BE27B6D91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216175, "uuid": "d805d4d1-7fb8-455e-88d7-f2f251a15ad4", "value": "43477103f62b5dfd408bf7b94c0e3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216175, "uuid": "9d5d6841-9607-4234-bd43-9cb7f1d98810", "value": "6144:sJIId9kP7+sYAdo9ZvHsJge7lfh+mQVri2VrpgEhBvp:A9kP7I/sm2lfv29pgEhhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216175, "uuid": "28f7728c-af58-4fc0-8318-ec1eca422455", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216175, "uuid": "a17d8f83-08a7-4269-a5ba-c13d0275be2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216175, "uuid": "76e6d628-418f-4471-9300-98d0deb8eca6", "value": "cd8286c6f0e799f84263776de34428ca.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e91622b-3df6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664236387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236387, "uuid": "91ac01fb-fc16-49fa-bd17-7124842d8cd4", "comment": "Malware payload (Mirai)", "value": "5abc0f1f7e164f20014ab3af710d1f3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236387, "uuid": "f7cb1beb-601c-4527-9b54-59abf4882f46", "comment": "Malware payload (Mirai)", "value": "ad355c9e44fc074431a6da96339bbe8ae7b957db08280d3d243a3db025e926ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236387, "uuid": "11d717b8-53c2-41cd-b4e4-37ee6082b785", "comment": "Malware payload (Mirai)", "value": "fb686c90d3678d036c61dbd3f504e98449fa6943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236387, "uuid": "509431ea-e9f7-4412-a099-cce7836a7cb5", "comment": "Malware payload (Mirai)", "value": "c443e01c2540efb53c1db4214d388d508effa49266022f47dc5656af1ea6ee2c0678a2e22baadc1188b43a5a2344ad44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236387, "uuid": "8d15edf1-8701-4ffc-bd4b-0d55509973f3", "value": "T18A3329C0F54B84F5C407893090A7F23FCB71D4394175E6AEEF8AAF75DA67642821728A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236387, "uuid": "0d61e632-4838-4307-bcb4-029b0c9ff722", "value": "1536:POlbI6OiMuOGJIDmVyMu5Dz2oUw0fkIFn3SG:POlk6Oi1OGJIDBTl6otg3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664236387, "uuid": "7b9042e1-2df5-4f16-b682-03d183461d1e", "value": 51632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664236387, "uuid": "6e7987a3-479a-4be8-ae54-2e481d47cf85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236387, "uuid": "fc9f5e9d-6bf6-47e4-86df-058aced0d98e", "value": "5abc0f1f7e164f20014ab3af710d1f3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f993a03-3def-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664233248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233248, "uuid": "221f0fe6-8a4c-43d3-a57f-f88ca1d5f0ea", "comment": "Malware payload", "value": "d7a7367a872ea8f4e5e1d868ef644b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233248, "uuid": "6f674c62-6d8b-4c56-a8ee-d7ebb6f8a232", "comment": "Malware payload", "value": "adf8610d4a9a3bf3039508f2229a04e6caad4c5d50530e01fea54754cc72ba59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233248, "uuid": "ea7b9fdd-08be-4a6c-b217-cdeff8dd1e38", "comment": "Malware payload", "value": "32143c1c72edaef9d8254df670b3190fa11d39c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233248, "uuid": "679f0a6b-4611-4b78-93c4-aace5d142298", "comment": "Malware payload", "value": "3f24b0e03950702e84da9200c97f77f554964c2a10a6c67c43df7cdb3ab5085eb0bd9790b023ef0c0c1eab9fbe03305d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233248, "uuid": "a74dd798-a4f4-42f6-b08a-61a5404b3407", "value": "T1D3D3E12039A19433C17B497C1C76C551AA7BB8901679DAC7378412AF5F607E36F3A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233248, "uuid": "ab98b5c5-0bee-4487-8edb-f10fdf1d80a4", "value": "d7d5eb29f8cc9aa72be1b48a07c02672", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233248, "uuid": "ec7b0bf0-4dfe-4d8a-bb14-c63e6f20fb10", "value": "3072:2W1geT85u1udiWuy5bn1RT6kprnfzVxNl35B:2YgKudhn5bf6kprfzll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664233248, "uuid": "ab78ffba-492e-45b0-8f49-3a4d18829de8", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664233248, "uuid": "026c2f3f-acf7-4259-bbdc-1e5fa1b3f146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233248, "uuid": "23bbc175-07e8-4af2-be57-b1349f9fae42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f993dd0a-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213884, "uuid": "a8d49f85-6236-46e6-9742-3765e36b8acc", "comment": "Malware payload (IcedID)", "value": "7d8eff6842d13c696056af3d6944701e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213884, "uuid": "558f71ed-b12c-4443-87a7-6d19dacdc7f6", "comment": "Malware payload (IcedID)", "value": "ae2a13c849149cc0f614e48476d56d18048d716fa2fba3fd1def3445ba4ef1f2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213884, "uuid": "3e638613-2083-4b20-841f-970a8d59c6e1", "comment": "Malware payload (IcedID)", "value": "4428435c1f81f451d2293b40a92a0cdae3563ed6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213884, "uuid": "d949b490-fa11-4a09-a8ec-7e9e2f653316", "comment": "Malware payload (IcedID)", "value": "27da0d354909fbbae7524a0bd8513d74047fa2fd0a13d6234a604e7002b78f757f8aee4f37babb75037e87b9a49ef387", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213884, "uuid": "1d1862aa-c81e-4c3f-b424-cdf5448d4d67", "value": "T1DC15F005CF50246BF00B693E371365D7E9961C27308BEE0AAB86512E1AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213884, "uuid": "c768d35b-c6a7-4f99-9ef8-c0b156340c35", "value": "12288:7qIkeVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DElFYjfHGlvYH9q6dYM:WIkeV2jUeQRI5wPN/MF0fHjH9qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213884, "uuid": "7d95be2d-cc84-4462-b641-ff34b3b276b3", "value": 887057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213884, "uuid": "756075c9-134c-4964-97f6-8f18d22af94d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213884, "uuid": "45249f68-4114-4248-8a79-4333d2d23631", "value": "mtrosecogicfile09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2654823c-3d90-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664192484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192484, "uuid": "6bac37ea-2b45-4a0e-b9a2-91c05cecc703", "comment": "Malware payload (Gozi)", "value": "c5d5bbe7532ee239898246a31f110224", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192484, "uuid": "31cfcf0d-efa4-45d7-9eb1-35fe57cce827", "comment": "Malware payload (Gozi)", "value": "ae6a6bd412bef8f0baeddb6871bf61e0e14c15a29d6947e5dd21a2c8c3c0fd10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192484, "uuid": "2e6361b8-c455-46a0-ba23-72a84c2b5688", "comment": "Malware payload (Gozi)", "value": "bebf6d50a0ddc048efb4e6da7eb0cf42ff21680f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192484, "uuid": "fde861b7-f8be-4c07-b59b-5c9d2f71c36a", "comment": "Malware payload (Gozi)", "value": "515a50fbe971f74e88e4de40d2f1f21b883dda35eee977ad83c69e64310d1f2b9c9077e54e013fbac3c3d5f017ebdaa3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192484, "uuid": "416b9f58-94c2-4cdb-bd83-b5c3199c59d8", "value": "T101139F11F6F94CF2C7A29E702610FAB567FE863022385095EB1759D91E74923E63D30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192484, "uuid": "9d79e60f-6184-4c0d-a5db-f5439d4d4b52", "value": "768:JibfzHdW3Q0Jfb7cY4ig5sfCQygT8bf1OTNFDMu+AFWHuA:e7HdgfncFig5sfCQyXz1OTbDMyYHuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664192484, "uuid": "e4334874-d55d-4064-a830-819528250b75", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664192484, "uuid": "649c57df-998d-41c1-a721-4e91ed426a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192484, "uuid": "cd909156-005c-4b19-8293-d90f69be736d", "value": "1f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b261e7-3da1-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664199838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199838, "uuid": "62c75634-ea50-4494-b47b-88d472d2aed2", "comment": "Malware payload (AgentTesla)", "value": "ee73909d6645263c67c3c080e727c82f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199838, "uuid": "2ad7b1fd-409b-4925-9078-3f6f9c3f4518", "comment": "Malware payload (AgentTesla)", "value": "aeb4ebf4e9b4980308456427a1397793d2220c57edd4f3b42268152fac6ae106", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199838, "uuid": "6fdbb35a-e492-45e5-b19a-688653f8853f", "comment": "Malware payload (AgentTesla)", "value": "f1e9b3ea2510517886740983ed1a76b9e92b29a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199838, "uuid": "742aa8d1-4da0-4bb8-9afe-6848c31f99ba", "comment": "Malware payload (AgentTesla)", "value": "bb9b0aad88aef299617920a4bf5a45985a42bef1167488e2637cdeefbaec90e90d9b2329ea8aa2f09c996679405d5e83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199838, "uuid": "842d4263-67a8-47d2-900b-e73610c8f6de", "value": "T19E05D0262AE94F0BD02167F881D0C2B6A3EADD11E436C2875FC66CEFF056B618760757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199838, "uuid": "c02ddf67-8025-4d93-8ce4-d838f526229b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199838, "uuid": "35f2e53b-c410-4ea3-abb9-b66a483bbfd5", "value": "12288:zc9kz9NmCbr13CW6gOIj0E/lC22xiB4a7LaZVoeeW466ZKE:lJAKr13zT0Ett2c7LaZq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664199838, "uuid": "9216fbdd-7108-4861-8b8b-fb4877baed5d", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664199838, "uuid": "8666577d-887f-41a0-baf3-d70fe77ea87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199838, "uuid": "806cd3ac-2673-4f89-8297-f4c9b089f8ea", "value": "KSF-23-S002-TSKI-0043pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65e32a3-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664171224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171224, "uuid": "9dfea1d7-d043-4997-886d-5ee750debd7d", "comment": "Malware payload (AgentTesla)", "value": "6092984d1f3b8ede0c5c23e49fd2b7b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171224, "uuid": "d90689e7-2266-41fc-b8b6-ae39aabe6e2c", "comment": "Malware payload (AgentTesla)", "value": "aed8cb47946bd1b2b3a76b5e7c0c8817a22f234bcd5882435ee500dc8fcaef5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171224, "uuid": "9081188c-dd4d-4c1c-b8e9-26f23383b57f", "comment": "Malware payload (AgentTesla)", "value": "cf667f04168008002b57bcb47f71b1db569d384f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171224, "uuid": "b94bef1d-4bc9-4d57-991c-a14f4dd52bd6", "comment": "Malware payload (AgentTesla)", "value": "e851b9c5da8a943e17f4ae04e1036490dc7220ce2fa958ae0d55ef9a483d88d71721ec5d050210c8f8f7682ef67488ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171224, "uuid": "c0a64b40-8a04-41aa-8691-2d0683687eee", "value": "T11F153A2035EA562CF47B9BB95FD8B8F649AAF721162DA1FA24B013464733E41CCD1C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171224, "uuid": "67a6dae3-1613-40e5-83b6-7a61574203f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171224, "uuid": "5190342a-3de9-409d-ac64-5d9f2e9e18eb", "value": "12288:zcs6A1VFfx09+fHdv5tElmzw4dOFCZSZQw5nADqjJ5nxR:h6CVF79UUzwoqCczPjr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171224, "uuid": "fd7a9085-8305-4388-9edf-b433af06d859", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171224, "uuid": "5b0e94ae-dc4a-4ea3-8013-b7ac523f4f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171224, "uuid": "676413cc-3486-4390-ad92-dcc3e061974d", "value": "SecuriteInfo.com.Win32.RATX-gen.28956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d246db1b-3da2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200504, "uuid": "5a7df153-7d77-41c0-af09-c6c54d23b425", "comment": "Malware payload", "value": "c963a25159a2f124e5972f5fcce3493c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200504, "uuid": "4fe0d37b-b2bb-4f1f-a197-54d3b6123492", "comment": "Malware payload", "value": "af02eeeb462e8da0e04a99742d5f2f6fda378254e7ea180cf41f5a84eace135f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200504, "uuid": "1c131202-b336-4afa-a995-83a10c9f5b2b", "comment": "Malware payload", "value": "f39c6a6a76277a5da687428737914fb7789f6124", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200504, "uuid": "5a2aa08c-3f74-4e0f-9e07-c718536d3207", "comment": "Malware payload", "value": "296fab3853b72c63e7c3ddabf0e1e3a08d1334f7af37c58a28eeb26c102e91f2b1776fe0e353bbe24f54308a13f1103e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200504, "uuid": "e3d96076-6bcd-4239-a784-2ca37a0e133b", "value": "T1B1E2D021CC5D6048D24F63F4429E168F5B3DB1B9A152178F1F1AB1E89E4B2BD0E0AE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200504, "uuid": "6a0288cd-a500-4722-9e6e-d97f682a53fb", "value": "768:Mlef3lvrkGY/IQdz/BPQSRmYsGkH3y3UMK1A:Mlef3KGkBrnmcQj1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200504, "uuid": "6d1bd268-8623-4d00-8882-ab1104099750", "value": 31245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200504, "uuid": "4bc3c452-0e7e-432b-8c16-a37b79150aa2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200504, "uuid": "d1783b91-17aa-4092-b79c-8d64fa7d2155", "value": "Untitled attachment 00014.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4056c6cd-3da2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200259, "uuid": "c5c60600-1c22-402a-a020-133b92a95260", "comment": "Malware payload", "value": "b4e69947d3f753bc88bee2641c68e24c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200259, "uuid": "19af41fe-983e-42bd-9688-9ad763924f76", "comment": "Malware payload", "value": "af38770bb622df0b3875d1758586d441911cf6e265596bcc486c186001ab13b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200259, "uuid": "23334c82-d6ae-41d0-ad4a-beb6e73d2605", "comment": "Malware payload", "value": "e6faad5c4e93ea3c1b6d38960c2923146ac2e924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200259, "uuid": "b8c1b2fe-f948-4332-8a19-49d323cd92c7", "comment": "Malware payload", "value": "09ce46975a03cacc96709c32752208d75888a828e3d35449b4379053d727259432a36cdee8a1a660b2f8927488d9d2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200259, "uuid": "9f860851-d125-4011-85fa-722876f59638", "value": "T1B2159D693695668FC017DD3589D4DDB1A7A4AC63A21BC24362C70C5FF84DAE6CB203B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200259, "uuid": "22adfd69-a180-42bc-9d65-7ae0dec329d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200259, "uuid": "1cdb9295-8c4d-41d1-9ad3-c8bb416d52b5", "value": "12288:kxGFSH/tkMwRgRW8GpbpFEyYfoHDY+I0KPWxyZ1riA6Edhc4CveUtEWFGXvrHv5A:JIVkDgRWXFmHfoHDS0KOxM1riJEEZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200259, "uuid": "103f6efa-284b-4ec0-a36c-59d1d2e730b3", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200259, "uuid": "88da426f-41b8-47c0-8a67-5e7c000814fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200259, "uuid": "e0b4444e-a02f-4a2f-973f-c5ea779b9e7f", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbd4837-3d8f-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664192124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192124, "uuid": "6197f9d8-ab95-4e3d-81eb-d8e41654f60d", "comment": "Malware payload (ArkeiStealer)", "value": "dc31dd18ff73547678378541a5d8f6e8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192124, "uuid": "b77d9215-fa14-46f4-8921-d318b7aec636", "comment": "Malware payload (ArkeiStealer)", "value": "af60abc8f32a47fe154e7f5a9e6910200f944524f437f45686f53ad4c49b0098", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192124, "uuid": "120f26bc-5aeb-47bc-bd5a-781f09e174eb", "comment": "Malware payload (ArkeiStealer)", "value": "8b918dfce983cf699ace47d3daec43cef8c800a1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192124, "uuid": "a9ddf581-a2ea-4949-a074-73ce3743c6ef", "comment": "Malware payload (ArkeiStealer)", "value": "9e59024bf13d782ca8dba98656047df1f70d1fc34489e3ccfa365287b9f14db70636b68670dc7b86eff1197d96d6e273", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192124, "uuid": "a792a3e5-c83a-4e90-9cdc-ec600f93070f", "value": "T1DCD4393A0D6FAE6AF3C650B10DE1D4FB85578D8776A3911CF41EE0C31FA8E5921C46A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192124, "uuid": "998802e4-eae9-4d45-98ee-c2ad09be8d3d", "value": "889d6e9adaf602123d02717fe501fa0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192124, "uuid": "be3a5414-87cc-430d-a7f2-cd5c3bd4d632", "value": "6144:9yBjzrLQCokvmTcVDBIdmDazpvuFKvXd/ccjuJSfP:ifuoVDBIdmmV+iXRaJCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664192124, "uuid": "8d56bd2d-7253-4195-83b6-c3ef3aae06bc", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664192124, "uuid": "f9d3dae3-9549-45ed-a4ee-9e4a0ad703a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192124, "uuid": "79d1e43d-80f8-4884-9f33-f4539f29e70d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e251c26e-3dac-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664204825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204825, "uuid": "1c0d5af2-cec5-43dd-a416-1921ab2cb3af", "comment": "Malware payload (RedLineStealer)", "value": "02c08edd2f432e82b86813b6887aa3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204825, "uuid": "dcb282d3-2733-4804-b7e2-97582cbb11f8", "comment": "Malware payload (RedLineStealer)", "value": "af69bc23d309a81d8ad7221c8e7e261f4e237df0409f42e3eab60cf1662db352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204825, "uuid": "ace77969-9a88-494e-b86a-1f03c506aae3", "comment": "Malware payload (RedLineStealer)", "value": "85d05a64693e1474c2a5fbfbb81d73349f918767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204825, "uuid": "43fda0ca-9d80-4827-b45f-6b97853b44a3", "comment": "Malware payload (RedLineStealer)", "value": "f05ae4eb933378ed41234d901340ddf93bae852347b9cb5dcb3fcaf9fba72978800c29653f9f0e626cfcc6888eb81598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204825, "uuid": "972e8705-8c94-4955-9ecd-eea802708c97", "value": "T17AD34A1827DDEE11E5BE8B79A470A0505BF0E553F552F33F4ED1A0D91E22B80CE256B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204825, "uuid": "cb749a89-5812-4c1f-ae48-88c8074a4658", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204825, "uuid": "504b5d0f-2995-41f9-91ee-33fb5753dba3", "value": "3072:bYO/ZMTF9R4vIwr0TpMscjrrrrCyMVtDFVyRXFth7SS8q:bYMZMB9R4vIrdMsctWKBbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204825, "uuid": "39051165-a061-47d7-9a94-fcc094d84abd", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204825, "uuid": "68da30f9-388c-4178-84c8-a03b11559616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204825, "uuid": "5731089a-bea1-4bac-8cc4-c1067fa2368d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fed588f-3d68-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664175455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175455, "uuid": "50c50556-7c3d-4f01-aab3-eb3202959abf", "comment": "Malware payload", "value": "544ac8f9a729bd48a0af8bd3f010006e", "object_relation": "md5", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175455, "uuid": "873ed6ee-5bf2-4209-a0e6-2ae5180ccd89", "comment": "Malware payload", "value": "b04e8b5a88d3fc7c380fa15b8db1d0e593807314a57f73517ec2075e046d52cd", "object_relation": "sha256", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175455, "uuid": "ea2579eb-9ebc-45e8-8d95-5ed9ad35154e", "comment": "Malware payload", "value": "6a84a816251aa6f7a62b461480a11e61429b792f", "object_relation": "sha1", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175455, "uuid": "324c9c6b-4302-4947-bebc-5d668f04bf3d", "comment": "Malware payload", "value": "191941c222c2d06d87486810539b1e94f1a8cbe8e8a909882ef534b138b5da90f0fc45cbf7d40c65a997ee20a814aa5c", "object_relation": "sha3-384", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175455, "uuid": "3ad1a4d0-287e-4da4-8e8c-8a05aa1ceab3", "value": "T17A2412A39945C588D4F7117E85EF61302F04BE3C4D68420D3295225A8E82BDBEF67B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175455, "uuid": "a5c3cbe1-897a-47b2-9351-31f9f75cb9e7", "value": "4f86edc0e62523f015163ed411dbe21e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175455, "uuid": "fd91a555-4b9f-41b7-877c-3a6f0c006a33", "value": "6144:p4qnNksO6jfdTZV7Qca7FQcY1vOZKE4QSkvpYoAxoSgF:tk16jfdVCc4Wc20K9n6YVxoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175455, "uuid": "622fb811-4b71-41e0-8997-e655564a5976", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175455, "uuid": "ad6c9c87-f776-4932-ba12-a145d437726f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175455, "uuid": "b9cd2379-0405-488f-8b0d-7af0b3dd5bf7", "value": "xkey.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7467c50c-3d47-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664161262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161262, "uuid": "20bfaa6c-ec7c-4639-b245-74ae2fd4bfac", "comment": "Malware payload (Stop)", "value": "0729829341fb36fff7bf5b2f8bfbdca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161262, "uuid": "97c45341-c1eb-4b13-ab68-ab6e9f842e4f", "comment": "Malware payload (Stop)", "value": "b0dee47e5d3e2230263e7d7d05205b979ab26a06a3a1bee26c3e792a367bcea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161262, "uuid": "ea0090d9-c3f9-4352-b42f-bacc79fa6936", "comment": "Malware payload (Stop)", "value": "5b6d6f659c6ed941bfcb65fc7fde460dd17fd2f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161262, "uuid": "a6a3ab27-e900-4377-80fb-c80e6894275e", "comment": "Malware payload (Stop)", "value": "31c0f72fffb8c3d09fc0763e52c25ade84d8659d73174352dc1a4c4955c894918563bf90a04a8f16bb455a37d5e949f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161262, "uuid": "5cdd69c1-2dec-41db-8d6e-974fc1d6045c", "value": "T103E423127280CC73C0924A75AC7893658F7EF96152315D8737A178AF2F743A297FA34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161262, "uuid": "8dd02321-3c9f-457e-9a3a-ffbcb2512d63", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161262, "uuid": "e8672875-6647-4fa7-adb8-029fb1634e42", "value": "12288:lq3RMe8knikuHX0QZF1E4Eyp1D5iE6Ut3fnGw:lq3RMeHniH1XOGD52UtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664161262, "uuid": "ffe5e32f-613f-4443-ba46-8035f1f0d41d", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664161262, "uuid": "53bb1d30-9612-4e74-b22b-0183e8ad4f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161262, "uuid": "1a0b24d3-0d32-4dd1-87fa-01438e9d8495", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e38a41e-3d7f-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664185169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185169, "uuid": "db9302ed-a8ba-4ec6-8e23-b5fba0113d4b", "comment": "Malware payload (AgentTesla)", "value": "375906e69e47aae8a52c645c4db40be2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185169, "uuid": "22c6a2f5-d578-4b37-8b71-5c7f886b5f35", "comment": "Malware payload (AgentTesla)", "value": "b0e90cc57bf7d5f8815547bd7b44e556d9f23ed8fa26485d960e57e5327c04f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185169, "uuid": "1c17ce7b-0e96-4f93-8890-9be30384d3b3", "comment": "Malware payload (AgentTesla)", "value": "d4d0d71f4771a42723516160ec36c91497c60369", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185169, "uuid": "06800a89-6fca-4d1a-a685-74ce11452182", "comment": "Malware payload (AgentTesla)", "value": "0a4d34f3b6677b035b1a763dc795d5ced692e496e7e17c22196a69ccd95a4a0d0d22e9c79fe731bce8a4d9a457f0493a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185169, "uuid": "7b001a55-3feb-4e41-bf46-2411cb403724", "value": "T175F4330BDCAF5E5DD4EB3A86486280FF25383DA361875EBC4F2596BC5F132911F1A10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185169, "uuid": "0cf97292-1054-4909-8951-9657b28b5a1e", "value": "12288:XXPpXkZFXdBzlBwkaWtCt9L9L18GTe1++uDdWJjuZliSPGZ2uSfzRVKmaAWMjVz4:hGjxmRj61++uDdWRaK4uKRVAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664185169, "uuid": "3d25a7db-d83f-4819-94fd-284369a04193", "value": 782442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664185169, "uuid": "ccbb56a1-7d60-47c5-ab14-6e0515de90e3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185169, "uuid": "a3138d5d-5ccb-46cc-98d4-d731b15376b7", "value": "Samples & Specifications.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcda73fe-3da2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200521, "uuid": "ea4e33ae-dccb-4302-8471-905cd529c709", "comment": "Malware payload", "value": "72f30df26246af397ece9a3adf7ef705", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200521, "uuid": "488c0d0e-d2c3-48c6-9a55-be339ee68390", "comment": "Malware payload", "value": "b0f7a2b4183ee663c8175a7971c60e087e61a8d2a3f92b1d07d00409fe4f041d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200521, "uuid": "d12349ab-ddb6-4025-81ff-e8d24bb5f3d7", "comment": "Malware payload", "value": "b84aa28483fc4536a2f4f102ec01a63aea07d9fe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200521, "uuid": "d81708a4-4be9-4487-ba96-c44b181ad20e", "comment": "Malware payload", "value": "e8fb49ff1fcfbe47d2fbdee007c632a7e72b1b59f6007b144d8f61b6b3957280d41e7d2ddc2b036c2e5ee13d6e664ac2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200521, "uuid": "80f43073-0a6b-4568-84ef-8568629e8eb7", "value": "T108C2CF71C61E44F9D4756BB893D013AFF26969CB53E383216C1AE4C95A00DBD0F72A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200521, "uuid": "0d6cfd67-7a7b-4d3e-8c37-823d3efa9bf5", "value": "768:aDVf0v901pajFvE+xYM6Ga7CeHzR9+mYJxl4278c6G0T:lG1Yv3k7CeTR9ydRV6G0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200521, "uuid": "de03c60c-c987-4717-b66d-c6b349324fc3", "value": 26427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200521, "uuid": "56935b52-484d-4e02-bfc9-452316744cc3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200521, "uuid": "ef9736dd-b9f9-4252-9824-6bca54a21c6a", "value": "Untitled attachment 00020.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1bb77e-3ddc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664225246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664225246, "uuid": "fac40d52-1418-4d09-ac1a-ca645a2d10fd", "comment": "Malware payload", "value": "3220b345f69edb4ae4ca43e86475aeb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664225246, "uuid": "7b379500-988e-41d4-9faf-87c32d9d9c1c", "comment": "Malware payload", "value": "b0fc7df95ebf67b43de43481b79ad65d9b4900f8415046ee7ce1b255a8157c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664225246, "uuid": "52958dc9-db0f-4206-8662-8c37fc6be3a2", "comment": "Malware payload", "value": "771e8847cf58f74389f687d61c5a7fdb68775b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664225246, "uuid": "f5bbd6e6-88e5-4cd4-8cb1-9bd5139567ba", "comment": "Malware payload", "value": "3136fa25d68b939811876f016211cf914f5e217d9108f50a420688f4d6b0c1f480d52a2776c8219df2e528314c4877a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664225246, "uuid": "5e5f4ab8-6c58-4915-9c3c-67848e0ef3aa", "value": "T1FF2401627CD05472D99972B48832E7506EBB74510E2A9E02F7B862AF5F716C01B3C3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664225246, "uuid": "52373c56-488d-498f-b896-bc80c1f6a008", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664225246, "uuid": "e21fe72f-7b18-41d1-9629-31d9c5bed8c2", "value": "3072:KWsEWT55aXecn7nIrukDzKI5klMxLrxBWOz/dhGJMYAd8XMdGdzc2uluFDM5B:FJeikDzKIAKHPWgh5Fdw/40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664225246, "uuid": "90659d46-83a1-4596-abf5-7dd5e1959a88", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664225246, "uuid": "120d14b0-85aa-444a-9445-5973ae75a2e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664225246, "uuid": "2212bea4-fdcd-4ae8-9ddd-8e46eab1b666", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ffb76c-3d4c-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1664163325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163325, "uuid": "99e4f2ea-caec-4883-a4ed-60ee5755bed9", "comment": "Malware payload (AveMariaRAT)", "value": "a0051542b368c80fd48cfa502673a74d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163325, "uuid": "39bb3d3f-70d3-42b1-9f79-d9d3e8c3840f", "comment": "Malware payload (AveMariaRAT)", "value": "b1b06e53d93013185e22e2ae9a387a31d48f10ab1f8ae6bd8c59d17f81954ba5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163325, "uuid": "26e08317-5a4c-4e92-b648-3f4d73c6c07f", "comment": "Malware payload (AveMariaRAT)", "value": "05d12b6d6fd99dad22c493c6768c64015a194947", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163325, "uuid": "10391789-1455-4969-a90d-6420d7af8e7d", "comment": "Malware payload (AveMariaRAT)", "value": "fe5f5f1b22491f05281801d143667f3c4a45e4632d817e19b8c057085260decf277cdf6f5d52ea58123bda624691010d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163325, "uuid": "f1edf375-ae0e-4584-a7e7-2003373ee5a6", "value": "T16525F1361BDA8B0BD02176B8D4D1C7F6A7AACC11E577C2976BCA6C1FF08A0759B60350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163325, "uuid": "31fa404d-4822-4efa-870b-7e0a7739d16f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163325, "uuid": "dc99061a-1dd6-4192-9647-faba67ddc4cf", "value": "12288:f6+iwz13Y1kFrZoN69/MSTTwZfSq367k4g6TswRESiHThLLGn:FtrP9lTD7dg6TsU2Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664163325, "uuid": "1b66ea6f-c21e-4182-9a8e-0015f3a28463", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664163325, "uuid": "7ee31550-f31a-449e-a4af-e0a3f8cd8311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163325, "uuid": "34871683-c0ee-48b4-bb21-33adce16d7d7", "value": "PO00987HGSpraying Systems Middle East FZE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36caf6fc-3de2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664227730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227730, "uuid": "038d7338-6864-4145-ac9a-8c3e004b1e4f", "comment": "Malware payload", "value": "cc42fda5f394200293491715d84bc782", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227730, "uuid": "d7ea6cac-bb9c-4fbc-8b29-cbd7fec64bdb", "comment": "Malware payload", "value": "b291374a316bffe4bc4b304935a6b8ca0ace1edf855783bdf75c83146c804d35", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227730, "uuid": "a5d2c92e-dc51-407c-8460-2d6ec8f5dbf6", "comment": "Malware payload", "value": "2f8a8d5ed64fb3c51983334f665563d8877c361c", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227730, "uuid": "a64004ad-d474-4d43-9d86-14d5a39415a4", "comment": "Malware payload", "value": "b234403b9f664ea27c5bebc7bb85ca648b5afaa9d5713c5e19685f3eabc8ed9eafbdad83cedbc9b1fe5b643b3d1a885d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227730, "uuid": "53ceeda4-504f-4b7a-a5ef-cd0b88359de1", "value": "T10151A71AF947D14C9BB6232BEC978962FF1B411B9DA3104C71ECC2455F20809A67CF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227730, "uuid": "e94b9935-0d13-476c-bda6-d764a23b31ca", "value": "48:AU+4+iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:8GhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227730, "uuid": "41bb00eb-4e69-4f65-aa59-858fce700dfd", "value": 3137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227730, "uuid": "d7cea575-ff28-406d-a20c-37cea8a4ee7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227730, "uuid": "ffdab131-5bf4-4352-9666-d55e99110f1a", "value": "UxX060Uf.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a1aa6b-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200880, "uuid": "8ce54bef-5565-4a6a-9920-0269a7aaefac", "comment": "Malware payload (Mirai)", "value": "d28469f9f831db93db9c4a0e82fa2c10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200880, "uuid": "ebc0afae-4896-4606-8080-ed63ae85029e", "comment": "Malware payload (Mirai)", "value": "b2b64efd8cf3f7fea63b2a58b11bd6f6935d6177644cd8b382db4799ee800008", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200880, "uuid": "344a151e-236b-4894-867b-3cd8fe6f6cac", "comment": "Malware payload (Mirai)", "value": "8b88cabce4c80fb5e32082eaef05fc01cd41b71a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200880, "uuid": "8109c705-a89b-443a-92b1-888c0b4ed479", "comment": "Malware payload (Mirai)", "value": "ceb13ba34e7379278099f64718c80bbf0392d16343232bca83f3e7abbc542a75a2bcb9c1a17fbda6154fc6474882dea8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200880, "uuid": "1e481b0b-b8f0-4ba8-944a-691e242bd7ed", "value": "T126B3B65E3E218F7DFBAD823587B75E22964833C627E1C585D16CE6011E7034A342FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200880, "uuid": "4a79fdf9-d98d-463f-a68c-88df8b8bef87", "value": "1536:FZbuKiR7jR5nHVuXoT3VWTTOcYyhfz0s8VEfercOZWY:FoKa7j/Hg23VWTTOcYyhfzhMaOZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200880, "uuid": "82c32832-2c86-45d0-8716-b573451263fa", "value": 109352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200880, "uuid": "404fe1c6-0755-4a2a-adcc-770beff3732c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200880, "uuid": "39aee833-9bf0-49b5-933f-3ef324c3f2c5", "value": "tamkjll.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd5ad48-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214505, "uuid": "86688d99-c1aa-48c1-948c-1d0b84812fc5", "comment": "Malware payload (IcedID)", "value": "7d29833baf3cf0db6ab6cc26373c1c76", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214505, "uuid": "e2f454e5-b7e8-44ae-966f-e978939cc4fe", "comment": "Malware payload (IcedID)", "value": "b2b88327ebf5d1cdada40abb354b17c0b6963f60b06726bd61c1b8b38a0f5291", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214505, "uuid": "088c09c0-b302-4a67-b8f3-2bd4827b089a", "comment": "Malware payload (IcedID)", "value": "387c7e3918b052496d5e23df85188fe8f303a939", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214505, "uuid": "404a27b6-8c50-45fe-adcc-64c39b925178", "comment": "Malware payload (IcedID)", "value": "b5ced6d007af6779d2d4987beb1e0106e65bb29c14ae2601d47b0c3e3fd02b82c8bedd2935130056655c9504a91673d9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214505, "uuid": "ffe0cd51-d533-4f27-941e-2aa50206ed74", "value": "T13E15F105DF50246BF007693E371365D7A9561C2B308BEE0EAB86112E2AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214505, "uuid": "d0959e35-5c4d-4ee5-b1ed-91c369dd93eb", "value": "12288:lYcVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEgYjfHGlvYH9q6d8:lYcV2jUeQRI5wPN/L0fHjH9qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214505, "uuid": "4cbc0a14-c629-4412-a236-6442e34d8fcd", "value": 886999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214505, "uuid": "cd4a17ae-f892-487f-b9b8-ca5d16cebd96", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214505, "uuid": "92cb00f4-cfc0-4622-ada8-403fdda8023b", "value": "myersforac-invoice-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff44e70-3dab-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664204285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204285, "uuid": "9912981a-f5a3-4cbc-ab45-d78f57735498", "comment": "Malware payload (RedLineStealer)", "value": "0b8a9f9d4e99624f4b6b90cf62681d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204285, "uuid": "73fa0f71-78bb-4b63-9771-7223540d2b8c", "comment": "Malware payload (RedLineStealer)", "value": "b2fca983a96d73154e9807ed55a953ac1afe1d1ea56357c51c0bd62b67b75c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204285, "uuid": "a5388ae2-04ab-4bf0-b3af-2288f8530ad7", "comment": "Malware payload (RedLineStealer)", "value": "1e4cc19a94abac7271c99b09c6790c7c485f3172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204285, "uuid": "0480b87f-9923-48d4-9a51-f613bb457b7e", "comment": "Malware payload (RedLineStealer)", "value": "d1da9952f19baf279e5006b727d0c033a9483ca569c1d38731f13170a256b76b83c7fa1abe624bf697545dfdf5744529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204285, "uuid": "ebe4c690-cf71-4343-87be-3609288d52d2", "value": "T1473612271B611081E9E58C36C527FDE872F60B6B4B83E8B869D6BDD129324D4F303997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204285, "uuid": "67213fcd-0475-4150-882d-936b5be46295", "value": "7abb176ad21a44738064842015cc0154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204285, "uuid": "819f6d81-9eab-415c-9b2b-671f787c84a9", "value": "98304:bv6zM/mdqdWOvxDML3bjXf6XJbSYRWvkb7zze1+miT+VX7KaUYC9ius:b+2Xd9xwL3HEJpaiTqX7KrYKiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204285, "uuid": "6c7b27b2-3269-4514-b0fc-b5a93f431030", "value": 5312000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204285, "uuid": "93505c2c-23c2-4955-ab96-00cc44c1b75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204285, "uuid": "1b76dc7e-ec3d-49ba-90d9-5077d932d465", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672a0e82-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214068, "uuid": "f7d61dc4-a24e-4727-9524-39255465ea1d", "comment": "Malware payload (IcedID)", "value": "99f42f4ad6f0d67f57513577ba998bc2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214068, "uuid": "5153e280-8420-4528-9eb4-f05876847fe5", "comment": "Malware payload (IcedID)", "value": "b3ed2de0e147060a7d2cd7def624976d606e7937e7b2e22e805a9961430d4fb6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214068, "uuid": "6fc582e8-3e41-4275-8d95-c9cf5ddb53af", "comment": "Malware payload (IcedID)", "value": "de7532f0a44d4ab0f950ec2b96ff80e08e5de46c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214068, "uuid": "98b34271-c1b6-4890-8fe9-4eff52937120", "comment": "Malware payload (IcedID)", "value": "17a01fad50910f69f3143b288e0f8b8e796dfac1802d3e6202777aa9f874e0b305be8b3949955d471105498406cad350", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214068, "uuid": "dd0f132c-77ce-42d3-a895-04538860ea52", "value": "T15015F105DF50216BF00B693F370365C7B8661C2B708BDE1A6B86512D2AC7FA0ED36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214068, "uuid": "dc98ab2d-afd6-4aee-ad47-93914a26f2ad", "value": "12288:CVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEeJYALU9gnDueS/:CV2jUeQRI5wPN/bJZLZnq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214068, "uuid": "2d02b921-8cf6-4744-a27b-10b7d4de1e7a", "value": 887056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214068, "uuid": "7aeeb592-566d-4031-b1aa-b9426b2825f3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214068, "uuid": "071a4a0c-37e5-4beb-b1a0-36d2afcb1e8d", "value": "nckcninvoice09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403911c5-3d76-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1664181361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181361, "uuid": "2f2b1f4b-4fb2-401b-aad4-519aa593fa4c", "comment": "Malware payload (Vjw0rm)", "value": "f51bcaf49d52f48c86d18755858a6023", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181361, "uuid": "4784da32-6d71-4a6b-98e5-fe2d68785bd0", "comment": "Malware payload (Vjw0rm)", "value": "b40f827a730121715761a49dd8366ff7db1a2d54d5912d91f1eaf67abfc94ca5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181361, "uuid": "849f49c9-2adb-489c-b0d5-a2d9e468a304", "comment": "Malware payload (Vjw0rm)", "value": "70d34ffc5a9414809112400163d7fc1432cac68e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181361, "uuid": "8c4e193e-17ba-412c-ba98-acecb098b767", "comment": "Malware payload (Vjw0rm)", "value": "0372ed32ed59c2c56c9b562db4eb3bce0aa3124b30de850dcfdfdb91cf4071449fc92e5cc6e0e0cfb65341bbde67f054", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181361, "uuid": "d16191f9-f3cb-443f-ae11-7a9985bca0ff", "value": "T1BB15F1208B893F91DB54F91C717A942BB39058C8D44628975FBFEE0A9FDF898C14B760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181361, "uuid": "c84752d0-1aee-4f19-b411-332a823f1a36", "value": "12288:oPEl4WrpcRTqd9CSC6YzW9BJpoYmAwYIYffXSdzQQ36vWE89DIA:Ws43RUzBJPmAwYd+3Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181361, "uuid": "9695d939-6f15-4ae7-a74e-3f95e0559c0c", "value": 914657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181361, "uuid": "0166f6f8-ea79-4887-890d-44b7a1db5568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181361, "uuid": "4bcba687-c8d5-4460-94f1-92315b94e722", "value": "IMG2022926.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c5f106-3db1-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664206734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206734, "uuid": "b09751a7-2d0a-4250-ac9c-0ce05abf74c3", "comment": "Malware payload (AgentTesla)", "value": "0a6504e47ce9ad6b3d57a1686f36c3a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206734, "uuid": "76884af4-841a-467c-a255-db8c413e5233", "comment": "Malware payload (AgentTesla)", "value": "b490abe8789b8787648636cf7ada8dac0cb86bd7f17e12f8d52ffde7386793d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206734, "uuid": "1d0730be-3277-4322-b81f-20b6e8d9d91c", "comment": "Malware payload (AgentTesla)", "value": "f81fbf45b9881d1f226e4f10b4230f1d78646bc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206734, "uuid": "e650c481-0ee7-42e5-9812-c44a440713b9", "comment": "Malware payload (AgentTesla)", "value": "d9101b344abd6e688f98bfae7d47540c1c3ed9cbec21c49c0d700c116ab7df800d32c469cfe77e0a7a9e752bd778330d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206734, "uuid": "7aa2b485-554a-4ca1-9b39-4f19de27dbeb", "value": "T13C35E0141765C906C8AEA574ECD2E2705FA86ED4835FC74F08DC3CBBB63A358AD913A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206734, "uuid": "8a91d443-8a31-431b-9e76-a2a9657b3493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206734, "uuid": "ad0cf9b2-83ed-4fdd-aa52-7988129ab931", "value": "24576:QBJUxGCCvinKShiFoHe/7pD1vAHc/JiUY:QB2rCbShiFF/vBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206734, "uuid": "d0dca5c8-f7f9-4888-afba-e450860001a3", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206734, "uuid": "cec556a5-eb57-489a-89e9-d974c23e5b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206734, "uuid": "9c821581-4ad4-4937-80b8-61875a84a28a", "value": "EGYPT ORDER.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435ff164-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664184372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184372, "uuid": "84906ab3-0c91-4212-baca-7fb501c20f26", "comment": "Malware payload (RedLineStealer)", "value": "28279700ea94d813966f59c22789c85b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184372, "uuid": "76ea9e20-1e9d-4842-a1aa-82e4db963d8a", "comment": "Malware payload (RedLineStealer)", "value": "b4b3e1a2ac1fc40f877c13268abdcc295f043c8bf8ce2886cf9cdab16fb81edd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184372, "uuid": "17500809-de37-434e-bbd1-7ff396f5a2a6", "comment": "Malware payload (RedLineStealer)", "value": "93e05da209fb86c4bfa261e2d901730ec045130d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184372, "uuid": "eaee440f-8567-4354-a15f-13244373fea0", "comment": "Malware payload (RedLineStealer)", "value": "db47ed2a37f62d84e42ef4ad49a8c46330da2f1f9b4f1f5cb9559f2afb867c66d8d2ae26ac486bdf0efc9fd19e358505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184372, "uuid": "ec3375da-4ce8-4b2c-8733-6cf743cadbce", "value": "T139E3F100BB90E8B1C51195B46422C3F16A7FBC2119766D4337686FBF6F723C2A6B6316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184372, "uuid": "841ccd7b-7784-40ae-aad8-93629813aaa5", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184372, "uuid": "ba7613d3-f199-44cb-8743-37a872b392a7", "value": "3072:zfErG58pPwxe0MMRrDc8jsBxGBJjMS4B45x:APwcMtVsBxMOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184372, "uuid": "9f2c08a7-e260-4fed-b960-a33d40cf5ece", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184372, "uuid": "5db7f3c2-c279-4403-9214-8186e3adc7d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184372, "uuid": "dc613771-e9ea-4d85-ba76-4340a9722968", "value": "28279700ea94d813966f59c22789c85b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a5af8e-3d8a-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664189938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189938, "uuid": "8d0b532c-88a0-4922-91e3-4bc9b3706a16", "comment": "Malware payload (AgentTesla)", "value": "b98d1750ff4bf4be622e058b6991d4b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189938, "uuid": "924576b8-e94f-4a13-a070-b38a94dfdc7f", "comment": "Malware payload (AgentTesla)", "value": "b4c01e72bd51f7cfe3cbf6db31e9ba4ba6c225473b713bc7463967f9afcddd6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189938, "uuid": "a260c68a-551d-407c-9a4c-9db41d1a583d", "comment": "Malware payload (AgentTesla)", "value": "1c998052090824c5b878d0959e819446108ac5b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189938, "uuid": "e35c67d6-863f-4e38-b5ab-463e3d552473", "comment": "Malware payload (AgentTesla)", "value": "853d6a586e3811d27704dc2730fb98b86cabf2c7c1317cbc79f91057f8b2fdea66699a9dba7574534df1b6cbd46e6c41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189938, "uuid": "840412d9-e81e-4ce9-883e-44cae180d65c", "value": "T1DE9423D9D7764059EA97A19162813FCB470D9C0355AFFEF203423895CAA8BA6E3342D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189938, "uuid": "34d471b5-2d3e-4301-afc1-97950394a75a", "value": "12288:EodKTjYIov1TF95sG8M4YuQd+qRDVHHW2iOy1hMPv1:jKAV1n5sG8MVlDVH9iOEhMPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189938, "uuid": "9e53a0a8-3466-4114-af01-1c156e5e6761", "value": 428239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189938, "uuid": "a501ae64-9403-48f7-b51c-3438e8b53e9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189938, "uuid": "e456c223-11d4-453c-b7fd-60060ec7099b", "value": "WAYBILL BXEF673 PX SHIP 87327438239_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f10431-3d7d-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664184491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184491, "uuid": "6f446658-acd8-4a95-b350-61cf3e3bb3d1", "comment": "Malware payload (GuLoader)", "value": "c6a94af246308a67f18bf5760f1eaba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184491, "uuid": "f1ac8d43-a52c-49fb-a2e9-3134b14f90b8", "comment": "Malware payload (GuLoader)", "value": "b52def88e2fc65a2ca17420fbdb79a044fa67d93f974c95fe815234e7f69cd75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184491, "uuid": "5575b012-3438-4842-b873-badb884cbfeb", "comment": "Malware payload (GuLoader)", "value": "13a043570d2cb941e9223920df9d73e141a1b275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664184491, "uuid": "5d8acec8-8499-4fc2-b0a8-fc857a00f32e", "comment": "Malware payload (GuLoader)", "value": "1029f43f742bda3f982c59e63ec4a300cfd1d0420d56ae06c8285e2ed7ba1b2b91256e5624ebfe81326da9376e83b34b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184491, "uuid": "f5fe1448-eaf8-4a3f-957c-a6981c5f15e9", "value": "T11494E005E4C1C3B2CC3199319313C9623AF56DF9DAC35B4EB2C8774924725D2ABAEE19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184491, "uuid": "2a08042e-26da-4a30-9435-6a581c626422", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184491, "uuid": "f9512a7b-5214-45f5-a16f-bb5c54de00d9", "value": "6144:smOP8vxPGEVr/0J/J1L8NV3YaYC3HPGYDKO7/XuFlx17i/963CECfOYcQkg:JvxlVr/0J/n8rNvGWA7uQ3CECXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664184491, "uuid": "a7ce0608-8d7a-4bcd-9151-9df260212ca3", "value": 426232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664184491, "uuid": "fc2a3ba1-88e9-4c55-80e5-42b8090a2787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664184491, "uuid": "da883772-c49e-4dfb-8792-c2bbfbcd6de2", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.11135.25690.15295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab226b2-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213188, "uuid": "81998db1-c8a5-4f56-b5e0-c296b8cda580", "comment": "Malware payload (IcedID)", "value": "6cd073362222caa889f3489c86281319", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213188, "uuid": "f19db545-b40d-4400-88b0-2e9640ce9f92", "comment": "Malware payload (IcedID)", "value": "b63410aee1ea13f6175d41c6e980606cca09a12069f68e49b330d01f3e75a777", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213188, "uuid": "64664f06-401c-48f4-bd44-d7471d384878", "comment": "Malware payload (IcedID)", "value": "8ec1e49183949c2151a4f347a30eb7b9618a55de", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213188, "uuid": "66cb9cd2-07f3-4ddb-b415-893867a4ff88", "comment": "Malware payload (IcedID)", "value": "4e1b4108d8429b4d4305dbb6a5ca152f9b327a47376185838558f0c91604107ea827e268143202079bfa21c856911c10", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213188, "uuid": "90b79145-ed27-4a1f-ac92-d0a48daf3333", "value": "T1BA15F101DF50616BF00B693E371365D7A8660C2B308BDE0A6B96112E2ED7FA0FD36D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213188, "uuid": "be750e75-7ba9-4f9c-882a-a903d34c4cb9", "value": "12288:Na+VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEs9d/+CfDDK2HiFl6htlPJ:Na+V2jUeQRI5wPN/AwDKiZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213188, "uuid": "3f3f0c89-749e-4525-9309-8670432e67ff", "value": 887104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213188, "uuid": "65e5284b-b1c0-4849-a8ab-8ffdeb0a3d44", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213188, "uuid": "a58d5637-7215-4ac9-8109-22cf95be69d3", "value": "nabankco,invoice,09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1d685b-3dbd-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664212095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212095, "uuid": "9922645c-1556-4e7f-8ba1-ec943c258136", "comment": "Malware payload (AgentTesla)", "value": "855dff27f2cd23b189fa98d09e37cfc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212095, "uuid": "5a169775-c759-4348-9b11-b31c845453bb", "comment": "Malware payload (AgentTesla)", "value": "b72768ff300290ea68d252d182c7e2a9923edd7d6baa89695bca274a05eec1f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212095, "uuid": "7b93a39a-d487-4165-91f2-c5f186cacb90", "comment": "Malware payload (AgentTesla)", "value": "ba007304bc907c57e22fb1f58cb76bb1b0162e90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212095, "uuid": "1d0e93a1-4575-42b4-a3f6-d0c8a13993e3", "comment": "Malware payload (AgentTesla)", "value": "6cfd6dce9cb9b3465f42147c9f61636b098a4edb078148de58d8defb5de90808b8df018be850417610dc3ed19ac1c5ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212095, "uuid": "4d08f78c-0ddf-45d3-be18-a7b309ae1d03", "value": "T16B35E1141776C907CCAAA574DD92F2701EA89DD5835EC34B08EC3CBBF27B39869913A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212095, "uuid": "24e3dcde-44c6-4355-b436-2ae3d721e662", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212095, "uuid": "ccab5598-28f8-4179-8c92-73d0e7b09d5d", "value": "24576:i54Cj7VmlHymluvtQfMSnKflsK+rm9vz0:z47Vm4zQ0UKflWkvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212095, "uuid": "3bda5370-007a-4bcf-9ec4-c74ec738538b", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212095, "uuid": "dd741662-4f77-42e2-9e8b-0d323382fd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212095, "uuid": "a0ed9938-c52e-424f-a63b-f0f50e524dbe", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9079c7f6-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212849, "uuid": "6af3c052-d89a-4ec2-b0ed-a7870004c9d3", "comment": "Malware payload (IcedID)", "value": "c50d50d58e3806e5ce9bb75965a78c95", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212849, "uuid": "f34683e5-260c-44a5-a422-8cd6a5e032fc", "comment": "Malware payload (IcedID)", "value": "b7c2b49bc0c9fc9ce0668e24229d18f21b18b8bf7c78bc45ffb1293e833cc0ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212849, "uuid": "22b915dd-43d8-4653-85fc-96b6456119b6", "comment": "Malware payload (IcedID)", "value": "e26cae6402e732bb781cf06edd02829031255e09", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212849, "uuid": "190e0fdf-7b5a-4ca8-b27c-0c093533f3d3", "comment": "Malware payload (IcedID)", "value": "41582d6ca549fd2040ffe6d941a106833e75d24b3292757abeca701ad04c8d0f3f04dbe1ec1a9c7a498c4c93412ad101", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212849, "uuid": "9e09ea35-734e-462b-9fec-7d233aa95c3e", "value": "T10E15F105DF50616BF00B693B371369C7E8661C27308BDE0A6B96112E2AD7FA0FD35C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212849, "uuid": "490da09d-f401-44d4-95d4-2ec80f87c032", "value": "12288:5VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DERpcAJWRprEDe:5V2jUeQRI5wPN/ycAc2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212849, "uuid": "0e101b7f-dbe2-4760-8cac-06fd663b92b4", "value": 886842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212849, "uuid": "075792cb-b307-4cfe-a622-411619e4dfb2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212849, "uuid": "9d6b55c9-aece-4dbb-83ef-99e5e8e3706e", "value": "ncidata-document-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f911691b-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213454, "uuid": "796b8a12-cb3d-4e35-9c5b-33c904fbc253", "comment": "Malware payload (IcedID)", "value": "7729d35e6eb8247a2196425c04168292", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213454, "uuid": "370ea003-4ccf-4293-a764-665a2c582f09", "comment": "Malware payload (IcedID)", "value": "b7d4e61a508f579f9758fbb34a24822f1a7882cda5437626b7fea130b8a4abf6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213454, "uuid": "86b20529-de0b-4e23-b070-3836aa8cf58c", "comment": "Malware payload (IcedID)", "value": "2cfd8924523464bb81d82befd0c5fff07419cea5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213454, "uuid": "9ab5c6b5-2afb-44f6-96da-fa556108258f", "comment": "Malware payload (IcedID)", "value": "7344a29d44179281d8b28798acbf6896b71c1d0ce813a58163a618346fe76dce9ec4ac1973c65e5656f1b47814ff6d54", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213454, "uuid": "542bee03-364c-41e6-a78c-66777e5122ec", "value": "T1E615F105CF50646BF00B693E371765D6F8661C2B308BDE0AAB86112E2AC7F60FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213454, "uuid": "6bb5ee61-58d8-4b7e-9fee-2c386d001b84", "value": "12288:MInVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEsRYmu5GY6lDl+lmqrunPh:tnV2jUeQRI5wPN/9ymu5BluJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213454, "uuid": "36408c21-0285-4f4b-afca-61be3d8a313b", "value": 887905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213454, "uuid": "911e6bbf-4fb2-460b-b590-c2ace57e479a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213454, "uuid": "77b924ab-21ea-4808-b048-84ed5e0e2f11", "value": "lcpartnersforyouth.file.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe563d9-3d33-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664152637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152637, "uuid": "82d8a62a-3ee5-431a-9546-478eaeb0da2b", "comment": "Malware payload (Smoke Loader)", "value": "8c6a6039de848f2734d168ade0cf6b18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152637, "uuid": "c1c04515-271e-46f1-a5c0-d5bd0432d58a", "comment": "Malware payload (Smoke Loader)", "value": "b8198893cc3ec3a5114a3cc2ea190149b53270e30d5137c63377532bd7a13cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152637, "uuid": "07657172-c02a-4d80-8915-e321c79accfe", "comment": "Malware payload (Smoke Loader)", "value": "5e26004000d6c3207b914089df1e72db2c0ea976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152637, "uuid": "d2803b09-77d3-4f8c-955c-66f718eee95d", "comment": "Malware payload (Smoke Loader)", "value": "55c618c6e72dc7b48d482c80ce7ab58ccd4096c58348c2cbf424907125809a8c7c00afcc26b0db5bb418aa3810b65cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152637, "uuid": "b69577a2-b3aa-400a-890e-d139a0c514f2", "value": "T11404C0017B80E833D41569755830C7E02A7ABC92986A56CB3B983EBFAF313D15776387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152637, "uuid": "946b3d90-0411-4579-8d40-6fb9890a3e56", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152637, "uuid": "ced2649e-53d3-4370-8c6e-90e655e3a818", "value": "3072:7AKIi6ctZ8z5SsInBMYy0pmdQlslkt6jBuJI65x:D1pnG/0pmdi7fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664152637, "uuid": "e0ea7979-0dec-45af-90e9-d4f2b146bb97", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664152637, "uuid": "5d856415-b6b8-41fd-8be5-8a5999ab31ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152637, "uuid": "441eb44f-4e31-43ac-a78f-d793a292120e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de345e1-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214482, "uuid": "e3488203-bfa8-47b7-8be2-4e2a24ccb342", "comment": "Malware payload (IcedID)", "value": "9e2ae5327c396e8458993a61203803e8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214482, "uuid": "4dd04bac-c645-4340-a8e8-186845b6f1b2", "comment": "Malware payload (IcedID)", "value": "b86f5a1bfb1b69c4b4137d98a5c4ef46d9da5d75ea8748f52cd22758781d7369", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214482, "uuid": "1f66faab-0655-40e4-96f5-c05db831a71d", "comment": "Malware payload (IcedID)", "value": "a08881c570937a1267cc4ad0d8784ce9582b2353", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214482, "uuid": "1ee6d96d-9749-46e9-8e95-bd279c9f13c2", "comment": "Malware payload (IcedID)", "value": "61838c37e571f10246685ff51e4b7fcfae705868b641a25a0519a7095299cb2a3b5dfccb712bd55f1a6f6abc099d939c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214482, "uuid": "350db2ea-4332-4bc4-9add-c9788448252f", "value": "T1FC15F101CF50206BF00B693E36176997F8A61C1B308BDE1A6B86512E2ED7F60FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214482, "uuid": "c35d5017-7b68-4e16-bf25-601c9ca9f794", "value": "12288:144VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEkFhhhJ3sJAib6Gv:i4V2jUeQRI5wPN/p1hJy/fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214482, "uuid": "4691cefe-f37c-4361-9628-d561e7590c1e", "value": 886521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214482, "uuid": "05652bfa-fbf8-40e4-87d7-568eccec7df2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214482, "uuid": "bcd22104-1efd-491d-882f-fcdaad16350a", "value": "inil,doc,09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668e4dec-3db4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664208054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208054, "uuid": "0da0bcc1-afed-4759-bf99-3f46a0238798", "comment": "Malware payload", "value": "94ba6aabf3be96b853bdd7521bb626ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208054, "uuid": "34798c5c-30aa-4295-90d8-5b9d480880a4", "comment": "Malware payload", "value": "b9554ffb97dc203be99b432b660c390b5012acebe227f573f827158dfefece43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208054, "uuid": "50e137d8-d651-47b5-9938-349dbf3646d3", "comment": "Malware payload", "value": "86e2dbcf7708cf84ba2d87721d7b22bb8791c89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208054, "uuid": "dbeb414f-2ec6-47bb-ae36-153f2a1fe77a", "comment": "Malware payload", "value": "7a1ff8ac73e76ae82108566f4ae5449a32a1534c5d19030677d0f7a7946a4d71673c4d84c9f470702119c272cc4d7682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208054, "uuid": "ce580f07-bcac-4e3f-ad2f-9c5e7e6a9f19", "value": "T1ED763381BCE4C977C65600B35FA47F03E6ECE565502409E706DA1B0B2FBEFD092D29A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208054, "uuid": "9a9a244a-f721-4d58-8793-05aa2fd0e007", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208054, "uuid": "281800b4-c66b-4e57-a0f0-b98d519011c0", "value": "196608:91OTJ17bsLFd5Q43RormyCAyNK1EbYpdIRzUmThNW/dwB3:3OTJ1MLFdRhoSyCjsSedejTi1wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664208054, "uuid": "7f632897-571a-4ffd-b33c-cad7a6918e09", "value": 7602221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664208054, "uuid": "cdcda8b9-b1de-4e50-a8d9-dfe7a71b3d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208054, "uuid": "9af91d07-6288-49dc-a2cf-3463dd182268", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d27c935-3d34-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664153036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664153036, "uuid": "cfa8a024-519f-417b-88d6-b7652c2208bf", "comment": "Malware payload (GuLoader)", "value": "1dc1e3fac59009cabd8defae7615ccc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664153036, "uuid": "8b56c771-61c3-4f43-9ad2-45ff6b35673d", "comment": "Malware payload (GuLoader)", "value": "b98d60109c9ccfaac33c719992c026b59e3bc54bbe9fe24bc0fecaa016a02959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664153036, "uuid": "6d0e9655-ce12-4f93-b6ab-5b3627d49f57", "comment": "Malware payload (GuLoader)", "value": "d25f5e2303142d1e8baf601fa8c178c3765ca553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664153036, "uuid": "25af18af-e361-4bf6-a28a-999b0b1fd945", "comment": "Malware payload (GuLoader)", "value": "08dcc3d4bb3d4683f28686006dc77aee05d34a10aebd86ba8054ead1208a32a54866b26b37dc1fd12de0ba7016165ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664153036, "uuid": "6fccf591-3aa1-4e7a-afb5-d3f8745bbf02", "value": "T1E3D459916D4887BBED9D8C3752DF76204D0F5F7E4AF013122E8476DA2D33D2399A608A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664153036, "uuid": "144856c2-d242-412d-b9a5-093178b06ef7", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664153036, "uuid": "4341c08f-3256-4104-95e6-c5d79ce668f8", "value": "6144:pMrudbcDdn2cHWOgP2DSUPcJMngw1aRQGhy6DWCt2uj0+7eX+WaPYz/76H3/NUEO:pfLc2jODXP2Nw1fayE2IeXVQHvNUEDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664153036, "uuid": "099f7610-907d-4ea7-afd3-74ec43a33f61", "value": 617040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664153036, "uuid": "08560497-86c3-4017-84e1-ce6172fc5818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664153036, "uuid": "7ae48a1c-9161-4996-b59c-f68c3181ec06", "value": "RFQ852352-006420025_rev001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03627105-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1664180400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180400, "uuid": "49e92856-db51-4746-949c-2e90fe0e3b25", "comment": "Malware payload (Vjw0rm)", "value": "0689e4e89cc239978a0fd64e6d7562c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180400, "uuid": "019c38bb-2491-497d-85c7-467934c6109d", "comment": "Malware payload (Vjw0rm)", "value": "b9b4fc0d7e86072d0bccd0a50fbe65fb407f3f713dc6841fe708f5675e10f3fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180400, "uuid": "de9d0302-32f0-419e-80a0-d428dc46618e", "comment": "Malware payload (Vjw0rm)", "value": "c4d44aa767b00e4df3e167e663d53efbb38e65cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180400, "uuid": "6962edae-c023-4f00-b5db-947323cc5d54", "comment": "Malware payload (Vjw0rm)", "value": "01a46a3f63cc0559c503b73ebaeea5619edd43b1c9c30ff3a79b3e7d56da06d1acfe78d320729157c50c0eb0edb75b6c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180400, "uuid": "f744634c-4bc9-4fa8-a66b-04dfced546b8", "value": "T192C3C031C854DBA58BACB63B78DA150F4BF04638D0C17DA416298B62E5C3F78B6D867C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180400, "uuid": "8de80a56-bed0-4362-84bc-86c3e2e58b33", "value": "1536:xutYJwehB1pUB+x6sgo7XQ526va9X9zqhnG+QMkOucOLv1lWm7ezwhcPQO:weTvUULw2VtOosux1I6ePQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180400, "uuid": "3e07f288-5604-4ee0-b42d-a42bdb90f92e", "value": 119934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180400, "uuid": "c5ff389c-e85b-46b9-9048-60f2e264d6c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180400, "uuid": "cc990c8c-8a8d-4ae5-91b9-0ee29863cb4d", "value": "Payments Pending July2022.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d5c3e1-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174439, "uuid": "c5dd989c-7db9-41c1-8687-460bd12c1469", "comment": "Malware payload (SnakeKeylogger)", "value": "eae85ae434cfebbc889857292a00d7ce", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174439, "uuid": "f022543f-7a67-479c-ae14-2f925ca7d5c4", "comment": "Malware payload (SnakeKeylogger)", "value": "ba357be7f8b30e5ffbd88531d2c775280ac102ad0965e56bd5fc2d89dfac0f2f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174439, "uuid": "65c798f1-d6c3-4463-bd43-2c3eec8060d8", "comment": "Malware payload (SnakeKeylogger)", "value": "b110906db7a747f84148d3f72649fd9de2c8b1fc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174439, "uuid": "79d905f7-cf58-4da7-8944-edd5a37819d2", "comment": "Malware payload (SnakeKeylogger)", "value": "fabe9257c759e3701e07fd46b6c8229a0962625c5cb7b7c6beee3d197ddfb9c503d9e19a394298002b3e3423565f5056", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174439, "uuid": "a4441cb3-b2c8-403d-9912-a5a34aa0fe9c", "value": "T15DF2F6E2CA041660F96A0F785132BE34016F7FB97D58E68EAC8470A33A736C3657190B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174439, "uuid": "544c72e4-6561-4f18-b3cc-95835f15d807", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174439, "uuid": "bb3214d2-061f-4d62-a045-0530cdc21b70", "value": "384:SlzZPyLdtekEWPjpeecDzlelVI3fiKIulCISzg3Sojg+XY5Za4MKCISmnsZyJNK9:Sum2jpvc6Qfau8lojJbKCIS3s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174439, "uuid": "58a3b75f-b708-464f-9bed-40d7e1066a58", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174439, "uuid": "45a8b1b9-aadd-46e8-b804-30fdbd2169f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174439, "uuid": "657e60a8-da2c-41fd-9bc3-7f30f0e08d8f", "value": "DHL 92622DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fda4e0-3da6-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664202036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202036, "uuid": "6fc39f6d-18d2-486b-981d-a2f48329fa69", "comment": "Malware payload (AgentTesla)", "value": "6392bdf51ccdac8bb946d8e3decab162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202036, "uuid": "20f3f891-9930-4059-b425-9ed2a7168e3f", "comment": "Malware payload (AgentTesla)", "value": "babe35b649059226647c2b9eeb203a97d50e416173a070a71bfc5b48a5003521", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202036, "uuid": "ce2aca09-7895-4fca-855f-031d8d51c165", "comment": "Malware payload (AgentTesla)", "value": "f82aa99e6cb600c86296fa0e76419fe710cf0092", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664202036, "uuid": "2ddce09c-c6ad-4cee-a801-fa1ca2737ef6", "comment": "Malware payload (AgentTesla)", "value": "788108d05d104ae96b6a0fe5693aa8788614622bdad2083027997aa824637b6a0dba7b696e732ee00bb92daba406a808", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202036, "uuid": "ce6d7c5a-6304-45da-b1b3-a7b7078e7b2d", "value": "T130F42309CCB5B37C96EA58F722C7F527D41068D37132F9223A4A05BDA72966CEB0853D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202036, "uuid": "4267e5a9-f0d2-43f2-a914-3b917e82b740", "value": "12288:rTN1KzzLVtelUwX1mylU9ZW8wjGaatphidyB4Ulvd00GjJRzzDKVtT1PiNjNGx6H:fGzzptHyJaDaatz4UlvdDqwvi9yG97KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664202036, "uuid": "76d387f6-d297-461e-81d9-530c2fd9425b", "value": 751840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664202036, "uuid": "90c31bf4-68fa-46ec-927e-617286d3bbd5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664202036, "uuid": "351c04be-e88a-41fe-bebd-48ffc39c20e0", "value": "ZEBA NASIM FISH.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a2acf2-3d64-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664173818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173818, "uuid": "364d9916-3b91-4d9f-a9b0-ad65852e4866", "comment": "Malware payload (ArkeiStealer)", "value": "5532eb31a0dfcf10114a9861d828c7b5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173818, "uuid": "3f1f945d-9083-409d-8f63-6a8e9bda9eee", "comment": "Malware payload (ArkeiStealer)", "value": "bb5938ca20203ecde3fc65a31025801a1c136b90c76d7816edcb58db733ca3ed", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173818, "uuid": "4693d622-804e-48ae-8672-2e6d754c20a6", "comment": "Malware payload (ArkeiStealer)", "value": "dab4b60feea4a9a06154a55cd260f7f2476e8df9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173818, "uuid": "59e8ce36-a135-4a4a-a5b6-c9f58b04c722", "comment": "Malware payload (ArkeiStealer)", "value": "03cbf245061d3c00a67c6de7d7e9eab12d8d14202073d5c068c585f07dcc37653099007aa5934a1bdcd0396b99eafc0f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173818, "uuid": "41dde25f-6ec9-4b2e-9009-6005aa1b9e3e", "value": "T1BA468E23B349643EC06B193A492BD6D89C3F7F61791ACC4A7BF4194CCF361416A3A61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173818, "uuid": "1af2134c-f0e5-4b1a-859f-e5a0c749b147", "value": "6c9b62aae6117060f9867b92d139b95e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173818, "uuid": "5700e2c2-d461-4c17-b81c-4cba25f3b7d0", "value": "49152:HBI6nrEmvRmaNtqp6S0QGHHStTITGaRQXLKp8fm3ileWPH5Hxk:HaURnsjfaRQbKp8fm3iMGHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173818, "uuid": "96139d31-bdc3-4887-84af-5d75cb81155b", "value": 5580927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173818, "uuid": "0f65fb05-6a30-40af-9ba7-6d112b0363a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173818, "uuid": "1d3310bb-076e-4fb4-ba00-d28c9f393ff0", "value": "library_2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01053a2b-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215614, "uuid": "b45bff29-0578-4fd7-83eb-c000f9227181", "comment": "Malware payload (Mirai)", "value": "b58ded87602e74de315c4595c2be23cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215614, "uuid": "15ac368a-4892-4377-b1c5-e4dd8337a5fd", "comment": "Malware payload (Mirai)", "value": "bbcf15c17d04ee7649fefaf8b1c5fe07e70876ed71b46cd99b05843649e46e35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215614, "uuid": "25e6a093-4c17-4611-9e6d-3b588a67fdbc", "comment": "Malware payload (Mirai)", "value": "d81e62ac22a52468375f1999073bf1091f8bd53b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215614, "uuid": "03e0e44e-6c76-4f7c-91ab-dc60fd233563", "comment": "Malware payload (Mirai)", "value": "b71bd14f05edd9d22d4f958469825c48847f15d210d28bd3b5a2645dbd796d746174fb1fec6fed3c4284ff4a2a25c84c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215614, "uuid": "223f0c49-2902-4aa4-be70-7dba9fd4978b", "value": "T12BE32A56EA408F03C4D61775BADF42493323A7A4E7DB73069D28BBB43F8269E4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215614, "uuid": "4fa3004b-5d7d-43c6-89d6-d45b09292831", "value": "3072:Wd137X9wFFeDE9xlkr5MdGL8J3KHpi5Qnug1WbsZC70hivo9AO9aTxpqco5jDx3t:Wd137NwFFeDE9xlkr5MdGL8J3KHpi5Qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215614, "uuid": "99bf1a4c-30ae-4b1b-8ed0-0b2b4b31998b", "value": 157241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215614, "uuid": "63dd6fbb-5232-4aa6-be91-7e4031cb1612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215614, "uuid": "d61d07a0-10cd-444c-a3e2-d978e054d5a7", "value": "skidv2.arm7-20220926-1806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51d3602-3db2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664207434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207434, "uuid": "798a4495-cd13-4849-82c1-3fd4a0c3db6e", "comment": "Malware payload (IcedID)", "value": "94efbbb48b1d3703e1055160db06e65f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207434, "uuid": "d9f43627-fc67-4398-b567-b5bf8a7284c2", "comment": "Malware payload (IcedID)", "value": "bbe6b63e43398a3d4b36a5b669d5fd5b2e480b38ef31e6d6b2553374055d9187", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207434, "uuid": "27142097-715b-4557-9a55-edb836004077", "comment": "Malware payload (IcedID)", "value": "516e2bb96abfe1f91cd00b0d67b596228536ddeb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207434, "uuid": "416a2a55-b3ed-4619-bfb1-9adbb0df1058", "comment": "Malware payload (IcedID)", "value": "49e3a5baa973b7d26dd492a0a188f77108d49a97a0555a8a41998af64637e118c9d6486e0487a5b0f1e8060cf86c91b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207434, "uuid": "b2d3a72b-bb51-4a92-a950-afaa6d793e49", "value": "T1D66408D9B7D2B0A6C3A3B474403F110BE27B6D91B84DD894E146D5D02DB8A9E807BF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207434, "uuid": "35b06792-f861-4a56-962f-903166fdbef7", "value": "43477103f62b5dfd408bf7b94c0e3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207434, "uuid": "02d6811e-980b-4379-9db6-da59b8e9e957", "value": "6144:bJIId9kP7+sYAdo9ZvHsJge7lfh+mQVri2VrpgEhBvZ:/9kP7I/sm2lfv29pgEhhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664207434, "uuid": "f69cd0aa-3149-445c-9f00-b5da214c41c6", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664207434, "uuid": "9cb4dd87-89af-4680-b220-ae19c813fd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207434, "uuid": "55a1daa5-4ed0-4cea-a05e-fb5621536464", "value": "94efbbb48b1d3703e1055160db06e65f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342559ae-3d9c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664197661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197661, "uuid": "02ecc391-73ad-404f-81ac-33e8ec4742f0", "comment": "Malware payload (Smoke Loader)", "value": "7d53fa419ac8d29b79078ca0c4bb85c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197661, "uuid": "f6c7a52d-9e3b-4f0e-a5fd-d5e64da8c057", "comment": "Malware payload (Smoke Loader)", "value": "bc1c19fb9559d3e0f6ede05232c6f72d8306f8858f740bf9a8dd768c0cba92de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197661, "uuid": "1d40565e-00e1-4c4a-ac36-bd4ad61821d6", "comment": "Malware payload (Smoke Loader)", "value": "e051e6cf509d78cad4337ee84b1f4ffaa0c3ac8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197661, "uuid": "fa1ecfb2-5324-403e-82aa-b13a26e91227", "comment": "Malware payload (Smoke Loader)", "value": "50f2153a5d01dc2e9661e53450b9d2368c0ede7f5f83ebcb3e7d6f08de0901da197a337cc880d86acd13572544fc9912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197661, "uuid": "2ee4d2d3-60d5-4ce8-a448-c39fbfd93015", "value": "T148E3E101B3D0E9B3D01545B05865C791BA3E782229269B873B587F5F2F313D2BB3A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197661, "uuid": "01a2ba50-f3fd-4359-b4cd-c1f8115b9e88", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197661, "uuid": "d4dd904a-460f-4a4f-819f-ef4532d030b8", "value": "1536:VTcMoYs1izSP44tTF5YuMdb47ZPaEF1J3IcP9WlY9aRFucLyOGgxjYj1Ei/UunL2:VTSzTF5eb079pUx3TylgGBtJ+/aK5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664197661, "uuid": "836e8080-82c5-4985-b62b-fd3a4e7d820e", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664197661, "uuid": "facf8e00-1c6e-4d37-89ed-f365ae74d305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197661, "uuid": "e17f18f0-4c80-459d-acb4-6891c78f8482", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9fefc8-3dcd-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664218639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218639, "uuid": "6cd0ed73-e014-44d2-9489-e99a7aa96336", "comment": "Malware payload (AgentTesla)", "value": "75116e224789066aeb6c83cbce17310a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218639, "uuid": "33a289dc-d51a-4899-9ce0-aa607a8b8682", "comment": "Malware payload (AgentTesla)", "value": "bc3ecc8f2b20fb6d4bcf4ef92565c58c19040f5309e5cadbaa474344b7161f21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218639, "uuid": "6e63f6a5-7e5d-4efe-8141-c9d01d1272da", "comment": "Malware payload (AgentTesla)", "value": "81b07f3125c34912405144bbcf3f751c334d35da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664218639, "uuid": "9f8d69a6-c140-4ccb-aa70-d14afa78ab2e", "comment": "Malware payload (AgentTesla)", "value": "c2d72c8a2225dacfe5ec584ed9261a069ee7bc6eed5ba6c305962533d174b26079e0044b20202f8be111304e249fd7d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218639, "uuid": "8097c89e-e7ad-40d5-82ce-b6ecc365b7e0", "value": "T1D4052A2035EA561CF47B8BB95FD8B8F649AAF721162DA0FA24B113464733E85CCD1C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218639, "uuid": "d851fb63-c9e6-4a50-b690-c0c8c5c4780d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218639, "uuid": "d8fbfdee-dfe1-4c35-9cd6-92614cfd5b1b", "value": "12288:r7bEXVFExN3AXkVB2hFWoiawAspUytmnP+zUj/woqjJ5nAp0:3bIVFxFhFTChpXtaGgmjrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664218639, "uuid": "6941165f-62f4-4f4f-b9fe-a4a13fe99cb2", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664218639, "uuid": "61d63ad1-9503-4ce7-b04a-575867f5010c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664218639, "uuid": "df6f16fa-1612-4d77-84cc-3777fcf7e19b", "value": "SHIPMENT DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0e1b4b-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215874, "uuid": "71ceb489-0c00-477f-9458-5c0005a348d2", "comment": "Malware payload (IcedID)", "value": "2c89a93390026817e3d5e4127a73c637", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215874, "uuid": "edb52789-6dfd-4426-b95e-b29898c2b0bd", "comment": "Malware payload (IcedID)", "value": "bc65b9d1bdda2829ff01c3ee12803f834422ed8a209ece5c896d0c1934bd1595", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215874, "uuid": "fb7d29ee-331e-47be-b5a8-ef5d8741409e", "comment": "Malware payload (IcedID)", "value": "b44dca8d528b1dcc11a4c888f66ddb8aa90c4766", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215874, "uuid": "b9d4c951-1296-482a-982c-f075091a84de", "comment": "Malware payload (IcedID)", "value": "7452863bf74d041946dd96e2152ffb5e854bac504a0831f752ff4b9799d7077254aa43801ceb766e3cf22f8117483f40", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215874, "uuid": "37fe3366-d23f-46e0-a1c3-cbd23a022478", "value": "T1A715F105CF50256BF00B293E331365D7E8661C2B308ADE0E6B96116E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215874, "uuid": "dc7604db-1777-43cc-aa7c-9ec05cb6728f", "value": "12288:rkVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE+mu5GYAH7og1ANm:rkV2jUeQRI5wPN/pmu5iEFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215874, "uuid": "6c4d4484-6102-4e29-97ba-74a3e7475266", "value": 888310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215874, "uuid": "807cfd4b-b3f5-4376-83b2-dcda12a2c27f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215874, "uuid": "7c993022-e75f-4afa-abe6-c1bf44ba40be", "value": "lycos document 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccf9df1-3d86-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664188227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188227, "uuid": "84ae8653-ac43-43b7-b524-c657682fba78", "comment": "Malware payload (IcedID)", "value": "464399e3cbd82cd6cfb4bd5217ed9913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188227, "uuid": "a0759af8-eb1d-4c94-8305-6b373cb383e7", "comment": "Malware payload (IcedID)", "value": "bcdb22780334fafe85b8f5d41f1e9d3fcc599e84d00e08605d97a7da240b5708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188227, "uuid": "dea3bb8a-55e2-41c7-b612-20e53bff74d7", "comment": "Malware payload (IcedID)", "value": "a156d478f98ea754e448ca82dc5376832ed801e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188227, "uuid": "55e3ce4b-9514-4003-90cf-a3d1fd39d104", "comment": "Malware payload (IcedID)", "value": "89e354bdb7603d1524d6246c239e70ed1796e4e7fc84c70958801a262600cd0f1f9600c392f9b6ac52ebbb831bded852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188227, "uuid": "251f6b42-64be-42b4-a513-25b2c33806ce", "value": "T11A7428D87692F4A2D6B36175007F040BB37A2E57B80CC890E241E9D47EB85AD907BF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188227, "uuid": "f75c730c-df68-42b2-af3f-7a40e9deef25", "value": "791de6ef3010fcf30000747e0b0ea62b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188227, "uuid": "d2fb6626-35df-436d-a60f-79f71bbcc3b7", "value": "6144:4nXcJHP7csJqGGCfXJo0w4wNfL75I2iiXUw0JFY4npeGm:AOHP7tJp0762QlAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188227, "uuid": "3034b259-ce61-4900-aee2-f7e44bf4de41", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188227, "uuid": "74c2db5d-e2c1-4152-b72b-c16ddfa415d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188227, "uuid": "3f477f26-31ad-426d-9704-b319df021dd8", "value": "striking.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c611a3-3d40-11ed-9266-42010a9c0072", "comment": "Malware payload (PrivateLoader)", "timestamp": 1664158368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158368, "uuid": "6a325a36-c2dd-484c-9c8e-c645a43b1328", "comment": "Malware payload (PrivateLoader)", "value": "912a8f94fe2f7fcfbc42122bea26507d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158368, "uuid": "cfafcb6c-7ac4-4a0c-89aa-df3270db0754", "comment": "Malware payload (PrivateLoader)", "value": "bcf4ea9dd478458e247b1997c99cc98c586300964f85773a32f9776fb5b72b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158368, "uuid": "a771179a-a065-4897-b936-812dd0175417", "comment": "Malware payload (PrivateLoader)", "value": "792f9767095d332dcbb537113f0d32a8c348e1c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158368, "uuid": "a30b12be-a209-4dd5-bbfd-17afaad9e18b", "comment": "Malware payload (PrivateLoader)", "value": "0d09bf63d910f729fa9adc20d99439f09ccad03435499b7a7645045958eea182c4f5413ea9733ea2d609d43a83aa682f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664158368, "uuid": "8cc36a69-6487-4a77-91b7-77b588aaab43", "value": "T1D9B3C539D709F00AF4E21075F91E27FAA4547630739548E7FBD68E1AA5A06C3D238E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664158368, "uuid": "2b2359ae-3a02-4d64-b5ca-e3417c3b69fb", "value": "3072:wm9/jEHuBkCGUtDICY9J3wBb3TtwPjg0nSNPH8Hce:NrkuBHTtY9Jgfq80nzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664158368, "uuid": "b77bd279-c889-4fb8-b93f-64a3ef4ba5d3", "value": 109740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664158368, "uuid": "4ed8b6fa-f350-4dc2-a4ca-86a7667911f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664158368, "uuid": "3c4799a1-79db-473d-99db-c1659503680c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689a6ad0-3d68-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664175415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175415, "uuid": "3cbe2371-77e9-4dfd-8c7c-1761fa964bbe", "comment": "Malware payload", "value": "1958ebbc3f5720beea4d6b0cea011f75", "object_relation": "md5", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175415, "uuid": "9c2b0e26-09a2-4298-9b99-09ea915bfd75", "comment": "Malware payload", "value": "bd1221f2165118fe02ace7a042d07da6967aa99f463e8570cb09c34bf7ed2c5a", "object_relation": "sha256", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175415, "uuid": "c9318fa2-211a-4541-8797-1980c5c8f2ea", "comment": "Malware payload", "value": "cfcea39ae02a2ea67a02c22fa3178b25f629a4c3", "object_relation": "sha1", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175415, "uuid": "adffa569-4f87-4c61-b36f-21b100e066db", "comment": "Malware payload", "value": "b8f737b67204a70710e0e08d170fed5c601fc5fba16549dc257fb1534d6c8f7c7f9020b24bd71a023bfca44f8ecf9d78", "object_relation": "sha3-384", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175415, "uuid": "69338e42-99bd-4b2c-b67f-0860dc8563ed", "value": "T14FE405F6C078FC8A9B2C37905F393DE52055B04BDB96C2179E445498B48BCF2BFA449A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175415, "uuid": "54170365-20d7-4aef-a9f5-beaa9d17de4f", "value": "12288:KVx7QZb/a19KmClY5mCbcJmJc5hJLv1QGlqvYLgbofQ0+kNNyfAZTY15PMKqLggA:KVx7Ub/a19KFl0mCoJmJohJLvurvYLgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175415, "uuid": "ad5ceabe-ddf6-4272-81d1-f1432c89a556", "value": 699556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175415, "uuid": "6f9ddf1f-70a7-4e2e-8a27-9f63e3156440", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175415, "uuid": "506162f9-d737-495f-93ed-5febf18ee85a", "value": "pe64.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eece2b27-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664181224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181224, "uuid": "066ed96b-0e7c-4173-8789-129f1f5e8b23", "comment": "Malware payload", "value": "1ff39d2651c218009886339d213c8353", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181224, "uuid": "2fc382e9-f66f-4bc0-98d9-38e2a11dc777", "comment": "Malware payload", "value": "bd622ee1c8f06a6339e7d7a468ad4e52bead583c326b16d0a8dd1e6ad452e886", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181224, "uuid": "8dbde188-464d-44d9-8567-2627496b19d8", "comment": "Malware payload", "value": "6bbe80e056472b56fdb718aa815e25bd1f93b921", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181224, "uuid": "4e92effe-b928-4b63-bad9-eab48d82b7a8", "comment": "Malware payload", "value": "ea0dfd5c9030c6f18c53e825cceed3fcf871b7fa0fe3bc71e128a2a0196bf0a49169e4bfb9ad13dc5c170f565dc3c78e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181224, "uuid": "a3afd881-cb0c-485d-a89d-66afd77fb121", "value": "T18DD61292F36CAB2EC97780334AE6037614890D539A42E75B2A18B35C7DB7AF04E45FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181224, "uuid": "40dc2406-1e6a-4ea2-85ad-eef5a4a77bca", "value": "393216:Spo3LoHtgktcLEgO6WhyTPA4xGu2jyNt7:S67fktcLZXWhyDAqeyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181224, "uuid": "58fa93a8-e69d-48be-a0b3-49295fdafe99", "value": 12694878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181224, "uuid": "d9fb4ec8-bf5c-4a34-93d8-383bc722ff10", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181224, "uuid": "eb1f4ce7-0dee-46d1-984b-e491532cf4ab", "value": "PSD2 Protector_3.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e2f516-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664227563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227563, "uuid": "e133b6ae-8215-440a-95fc-23c35da81b1e", "comment": "Malware payload", "value": "cf2497b3daa79ac14065b743ca6bc0a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227563, "uuid": "62d6af29-aeee-459f-8034-f31ec415f113", "comment": "Malware payload", "value": "bd698b341993b36d7f5ab6442f6757e6da7b9bee04b717c8740b2c2fa61fc253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227563, "uuid": "3cd5309e-a33e-4e1f-bd3e-c3cb6d8c0df4", "comment": "Malware payload", "value": "970274af6f17becd2406c79716e6d24f2c01dbde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227563, "uuid": "839008da-7593-40f4-b4c1-64ea586e6386", "comment": "Malware payload", "value": "e2a38e45945526a3aee3b7b373e55d05b62395623276d9e210e72a0b656dc0e5995efe4b8361151b526241ea56724f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227563, "uuid": "0f215436-7ad3-4445-a6ab-1288d6ab2394", "value": "T1F8D3E0203D649173E15389701C35DA01A97F38216BB1478B7B8C2EAA8F713C2DF7A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227563, "uuid": "b001277a-ce81-4694-8353-1a157644a216", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227563, "uuid": "661583c5-4294-4fc8-aaca-ed10b81af8f3", "value": "3072:w971fChT55EUWrj8rDekzJbaL5pk6ROhQEdM5B:wbfCzWraVzJuLI6RIQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227563, "uuid": "bf4fe77c-4490-4832-9366-469f7ffc1e46", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227563, "uuid": "6525b9d4-7415-42c7-8966-96cedd9406be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227563, "uuid": "0a5a376e-6530-49f4-b2c0-b7161133c465", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebcc3f9-3d96-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664195156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664195156, "uuid": "13d75704-d983-492c-accc-d108b9316636", "comment": "Malware payload (RecordBreaker)", "value": "a43af6d1cb409f84bef92a85ee9620e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664195156, "uuid": "92f73e62-da75-4d35-b3f2-8aded21169f8", "comment": "Malware payload (RecordBreaker)", "value": "bd963743ed3ccb3c8c05084a4f12f5d93d57d7fedfe39950826fd5e14fc14c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664195156, "uuid": "7c6b04f2-467c-4673-a0f0-4f4456ac251c", "comment": "Malware payload (RecordBreaker)", "value": "0ac0dfccf1655eabda813cdf6a5c1c6c4fb38072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664195156, "uuid": "4584523d-5272-489b-bb0f-e4de07cab1ff", "comment": "Malware payload (RecordBreaker)", "value": "547749d9502e27b8da412c5c513fa9c7dfcab1282396828a4f23d93774324ff54defb8ac5068a5e41b61b8597f1bc2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664195156, "uuid": "9c34462d-24ca-4987-956c-a0944ded57ef", "value": "T115751282C330083DE95B213CA2D0B651EEB5A9295D4B0AC35F0987735F7EBFB896518D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664195156, "uuid": "08f3875b-1926-4ff6-979e-96e111a2c4fc", "value": "e60db7d95faa1cf274e4f66667784980", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664195156, "uuid": "df56729b-e1ad-405f-b74c-4007e73ead15", "value": "24576:Wro48zqda2i7X6yTHLa9IQrkoDrdys5xyKdBVUGvZxBBmaj2Mgh5BriyzxvufI:Wrf8Og2i+y7muEkoD55oD+mJMg7BufI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664195156, "uuid": "1a8f0860-6f0e-46a4-9a83-4f5852b33c50", "value": 1566112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664195156, "uuid": "6de000f6-31f5-40e6-a7a5-6f3e1ae2c864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664195156, "uuid": "a55ab8b0-2bfd-429e-a069-ddf338d1b5ce", "value": "a43af6d1cb409f84bef92a85ee9620e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ee91b3-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664191281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191281, "uuid": "3cc8f3d8-4d4f-45f4-bf16-f6450307ba09", "comment": "Malware payload (Stop)", "value": "efdc793aca3dd1dd47d4b2c8a0bf79ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191281, "uuid": "38b33059-6dde-4939-8b63-bfafceebce8e", "comment": "Malware payload (Stop)", "value": "bd9cc3c9718aa9eac1e5b67ba4f1d3757ae757e2eba91babde674a7c8a70cab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191281, "uuid": "08573f05-1d7a-4517-bb1e-97adeb493a89", "comment": "Malware payload (Stop)", "value": "14097461c5a3c27f282810868dd337b264e0f435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191281, "uuid": "a1dff76f-6d3c-4e5a-811d-acaff59a5825", "comment": "Malware payload (Stop)", "value": "1b5805a4345f55a72cf6a6c7c7edbe268209219cbc696a174519d86fb3a84c8a645ec29c8a0a21ba4e01ca4f1dd16312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191281, "uuid": "96a661df-b9e3-4e78-9edc-b77224c4eb76", "value": "T1D5E42301B398E870C85A2634597287C4FE7471115923AE8B2F08796FBF79FE1697B309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191281, "uuid": "0a99949d-99fd-41e7-9831-c7cdfb9815f6", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191281, "uuid": "773fbb99-ecda-47c1-9466-5c498df78d45", "value": "12288:4n4uDGmZv19Ngdm6d0lfl8932GQR3GHbozBT3MUEiqIR27PmDjpQ1Ds7UrX+z:m4uKmBNgdmLf6So2BThiIOPmK1K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191281, "uuid": "13c176d9-86a2-4456-89b9-95dac2ac8baa", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191281, "uuid": "9ad4740c-4405-422f-99a3-6fc6dd9fa0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191281, "uuid": "ca7b660b-a123-4965-ad2b-f58d370ebd1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e105ac50-3d7b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664183778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183778, "uuid": "5f94b82a-3cbd-4baf-ba4d-e035d7973017", "comment": "Malware payload (GCleaner)", "value": "4d93bac52a0a76ec6a7ea3d748c47982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183778, "uuid": "6112ac56-140a-4703-8e9a-1dcd4e5c8b86", "comment": "Malware payload (GCleaner)", "value": "bda407898163ab73cf6e57de3e9363c6ba81b22af3a39e103863a6aa929d13ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183778, "uuid": "f95f9c90-2e6d-4543-ab90-f4c890fa7185", "comment": "Malware payload (GCleaner)", "value": "ea27d08db3bf9b76c313b588562adc3e0488b8c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183778, "uuid": "b1c7776e-e5be-41cd-99d8-169f4bb76a44", "comment": "Malware payload (GCleaner)", "value": "f0b0295d015905e938f4e500360a5d8ca6ce1e027b76e97428ae372550bd409f881fcf456a7b8a2d5ba0a22d296534c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183778, "uuid": "f0985fd2-8221-40e7-95ad-e6b2f63f4364", "value": "T1C0340260B944BC30D4253670D832D2A6A97B782015224E077BF83BBBEE737D169793C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183778, "uuid": "c028cc0c-c27b-4171-8ead-e382b39566e9", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183778, "uuid": "cf870f57-091e-4a37-82c2-ba68762270b6", "value": "3072:R8grpHyz5HrTPw0zWls4bYs/UHUuRCvChKKG04OqMIvBKNnk5rUsnkaZikBpq5B:gr8yWlDbYWUHhe04bMIANnkJUsnkaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664183778, "uuid": "1e4fce53-9da7-4182-8358-66e8a77ab042", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664183778, "uuid": "1fa30e8d-fc25-47db-908d-408bf4314fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183778, "uuid": "2a886464-13fe-4e1e-ba03-e4241a57957d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8af70e-3d88-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664189003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189003, "uuid": "f6b489c6-c6df-4100-83cd-290513d305d1", "comment": "Malware payload", "value": "ef1288de782e65d6e5bd6a327157988f", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189003, "uuid": "764d9b48-79bd-4d28-8e3a-00fb0dd9d4d5", "comment": "Malware payload", "value": "be180a7c43734b7125b2d5cea7edd0174811a58113b048f5fe687db52db47fe3", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189003, "uuid": "33f07d73-d313-44ec-961e-e40700f8717f", "comment": "Malware payload", "value": "a23efb6aa5a242c61c5d50a967a8f29da164c954", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189003, "uuid": "b47c7786-c113-467a-bd88-58382bb407db", "comment": "Malware payload", "value": "cc96de55a2949a219a9b02e901c4600ed4b37e71230047692a7b422615318b2a8f50609911446e7e2550c74da68cadba", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189003, "uuid": "7b9b69f5-bc63-4801-8e9a-c9bd57af8438", "value": "T1F9C3C00D4D5CA1D41FAB2688E59D2DED87D5C602FFC9E62121A5EE37D0A137F9810E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189003, "uuid": "9cda0f75-b37b-4123-8a7d-cb7159504b31", "value": "3072:R4gPEXUk39x0+9W3dg9O2y9SMK+henkJM4Jp:iy2NsdOy5K+henkJlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189003, "uuid": "78fccbc5-5d9f-4695-a70e-fe7e008fa93f", "value": 120836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189003, "uuid": "8fab98b2-625b-4b51-bc93-990187ba6c10", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189003, "uuid": "5eedeb83-5781-449d-9372-9b168826b767", "value": "DSC0002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f16ce73-3def-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1664233301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233301, "uuid": "213db028-ea1f-453a-8160-36b509179243", "comment": "Malware payload (AsyncRAT)", "value": "168ee8403709fc4848328051ff819157", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233301, "uuid": "c099ba4e-f60b-494c-a9af-e3b66bb30364", "comment": "Malware payload (AsyncRAT)", "value": "bf765420bbb03b49f594002013915e508160a4efede03e051075cabad32c51b3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233301, "uuid": "a3fe4c7d-20b5-4001-b03b-08fb6a947c4c", "comment": "Malware payload (AsyncRAT)", "value": "bf96e4267c22e283d192e34fc50ded40802ac83c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664233301, "uuid": "1692c9ea-20ef-4c7e-bbc3-62c8509de08e", "comment": "Malware payload (AsyncRAT)", "value": "4dae336225a90ca02e891744ab45b795a8588ee11408213c0cf405a59e89a07be14a449f8a08493756a203ee9a85c3b1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233301, "uuid": "521d551a-ac9b-4167-9a83-a239d1edaa76", "value": "T1AA6302767B9C1531E969C73B1547DF08E139F6487F56468EECA8C23DBB221022901AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233301, "uuid": "a6fa641f-6aa1-40c1-bbef-811154110b3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233301, "uuid": "583701af-52a9-4b1e-8d8f-1c35cc0f6034", "value": "1536:L2pM3Poamv/TQ6MLXIRakKVyreBOPew0ikXx5utYdsOWg+7/MajDw:iW3ADXcBURL4OmikXbuuVA/Rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664233301, "uuid": "c6ee1cb1-7025-4708-a959-37d95665555b", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664233301, "uuid": "ca8b7f5c-439b-4f60-bd2b-46b5cb1b0821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664233301, "uuid": "767f5bb7-45f5-42af-a31d-01b895039eee", "value": "168ee8403709fc4848328051ff819157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ae0da1-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200882, "uuid": "447c9e9f-dc0e-462c-ba98-0b5d420f52c7", "comment": "Malware payload (Mirai)", "value": "3d0b91fb4656a5d586c0f4f553d96102", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200882, "uuid": "067febec-d8b6-43d8-bd9f-5ba31410f910", "comment": "Malware payload (Mirai)", "value": "bff48e85c612ee0da0f86505725a36c2d6cd1112c89bd99210d5da657f1a0529", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200882, "uuid": "527ec8f0-583f-4d82-89c1-6740a0b394f0", "comment": "Malware payload (Mirai)", "value": "82a92e88ee25f904cea9f8079bcf1391855b8383", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200882, "uuid": "afe6ba5e-46eb-4333-ab85-1b1563a6f3c4", "comment": "Malware payload (Mirai)", "value": "004b63c775aaa0d653eb7e300be1ad37d652de63b5cd0e2cf9f9d402f2a99bc025885535a1a5ee55629332476bae92de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200882, "uuid": "bb712132-5166-474b-8638-6e290eb55888", "value": "T19A931846BC819F12C5C902B9FA1E158E331353F8E2DEB3139E10AB2477C696B0E77995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200882, "uuid": "e24b080a-aeb9-40cd-b6f3-0e52f0093841", "value": "1536:80nRt/ODgzcFEGYv2OUbVvIwkv2+56g5FeDE9xlkrWMdGL8J3KHp15Qnug1WbsZA:dt/ODNYOOgWC+56g5FeDE9xlkrWMdGLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200882, "uuid": "3aecfeb8-88d7-4202-851a-4b97afb77669", "value": 95616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200882, "uuid": "9f794abf-d191-4e1d-b0d6-0530c2b34e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200882, "uuid": "4fcc7474-7790-4f62-bbea-7c81a8348c45", "value": "tamkjll.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff2df23-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215613, "uuid": "dbb55518-1f9f-45db-8102-7c3182558674", "comment": "Malware payload (Mirai)", "value": "3ccad5602a3598321985b7c3b890e373", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215613, "uuid": "2e2eb8d0-8fa1-49c7-8a3e-1c106904681a", "comment": "Malware payload (Mirai)", "value": "bff856697903faeb725b5c8626d2af4cdfc09b74ce15d0e844901bdd096788a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215613, "uuid": "0a2d7b8c-2999-4e86-bc0c-acba98bccf2d", "comment": "Malware payload (Mirai)", "value": "741d9fa5b3ecdda03f43dc4bf2cd1a14bda00f93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215613, "uuid": "59b8f6f7-7368-4cc5-adba-f9617b84a6e0", "comment": "Malware payload (Mirai)", "value": "6102b3dba66a3d10a91f0c6eb4fe009d97d8c8857be3561a642ea09b8309ff470c55ba0d5446844ef96f9fc5951517cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215613, "uuid": "82535ff4-9a8b-4e9a-878f-ac906e77ecc5", "value": "T17C534BCDE683D4F1EC0B04B01077BB778B76E2F92274EA06C7B85972AC52602E506A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215613, "uuid": "b74f09df-4737-47c8-b7ba-4a039ed553f8", "value": "1536:ujolDRip7t1L0u4o6vt6POwych4Qzw87DkKbwhNxrTH+:YolDRipbwswcOwycqy3DNYNZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215613, "uuid": "eb35904c-5845-4adf-80c4-b592f881efc6", "value": 62544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215613, "uuid": "b1a9323a-ef2a-4363-95f6-1df5bd111455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215613, "uuid": "daa86895-907d-43f5-8e8b-a4f143dcf6c2", "value": "skidv2.x86-20220926-1806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f209f7f7-3d9f-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664199268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199268, "uuid": "43fa5d56-9d05-4030-9ab0-55e995d38cba", "comment": "Malware payload (Gozi)", "value": "e1f3b1b510e7c2d9c5606e524d20ed4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199268, "uuid": "a15408bb-ec15-407e-9fcd-1e8b741a3061", "comment": "Malware payload (Gozi)", "value": "c0e28d4e88c59688657c839c344e6c1289002ef0ba461ebbf3cd4b75949312e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199268, "uuid": "cc5c63ff-2f5e-4723-b4bd-30cbecbcb75b", "comment": "Malware payload (Gozi)", "value": "b61b6575974fd8e427a0bf15970d99a4b4dd8440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664199268, "uuid": "f89a45b9-dd81-4d6d-a814-ec851938b9df", "comment": "Malware payload (Gozi)", "value": "7fb2691fe59026626cfcaa803d41866d891e7fab503c1d58b8baa7ac553b7357ce4325e66f687e599285d40ae1321ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199268, "uuid": "6dd5549b-ec2f-48f1-8e54-1cdfb3cdb532", "value": "T17403D1AA6BA04876D5D3C2353A3976C1DF481332423958E0E77B4A398BE6C4F952F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199268, "uuid": "387579c7-3a8b-4a2c-9db5-596904e43cb8", "value": "1640d668d1471f340cbe565fe63522f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199268, "uuid": "1e84f059-07ae-480d-8580-bde81154936b", "value": "768:/QLm41fM01vAIyRCq63goMWPXE2bE/JVMq2LATqeeAeOu2D2wqmLiut:/L41fMSvxACqlaPGhVMq2LpeReOb2Pmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664199268, "uuid": "01831cda-3c98-4884-9a3f-2550fa9dacf0", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664199268, "uuid": "bb6c073b-7bde-4fad-af49-89e7ee51f6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664199268, "uuid": "28e76ab8-a6e5-43e0-8d18-7af8d6f350cf", "value": "c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0310bbe2-3dd0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664219913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219913, "uuid": "daf6542a-3ef4-406f-9b0d-4e48d698389e", "comment": "Malware payload", "value": "d934fba17e2142510ec5a31a96cd111d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219913, "uuid": "e89a2564-b855-450e-bdbb-fda7a5044849", "comment": "Malware payload", "value": "c10ed5b1452606fb48e3d1c0cbc1a28333e02dbb309557b487cbe40491aa6eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219913, "uuid": "e313762e-64c0-4a2d-a48c-363c2665f687", "comment": "Malware payload", "value": "a5e8a3db14fdb2ac369abe4af83ebd24137b4fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219913, "uuid": "470c016f-1fbd-4489-86e5-9738e4e0d6d0", "comment": "Malware payload", "value": "d20819aab798e269052e33fb3d80fce89b356dd2d08a780c9fa06a101073c644c012116fd6d05c6d6373d60b8606541a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219913, "uuid": "019a0eda-9675-4438-aeec-4f8135af82e8", "value": "T17C2402763DD0D531E83DB23298BAD6502A7FB84016619982F37836B99F733D069343DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219913, "uuid": "0077fa22-e386-468d-89c8-8bf37f5f82a7", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219913, "uuid": "7ff9beb3-240e-41c3-86fe-285871c4edb9", "value": "3072:rkRT55fOEdMzL2725oqmyy1AKmjwts7EAbOEtqvbnJU408BzhiV9rvPcDLtCE/By:zI4Y26qmyyvyQAQvjJN0MzOVPuLtCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664219913, "uuid": "a81eb04b-e2c0-482b-97d5-fc967f88dd46", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664219913, "uuid": "16e9ae54-3a55-4439-a4e0-134f27ea6f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219913, "uuid": "fd3a215e-ac9f-4c23-a294-0c6965c9bb66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3706184-3d68-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664175622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175622, "uuid": "88d3fff8-7023-4501-b49e-7ded8845472c", "comment": "Malware payload", "value": "d39cf31659eaaaa1992b8b5fd70c2eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175622, "uuid": "aa557594-48e0-49a1-b87a-b24c4104682f", "comment": "Malware payload", "value": "c141cd36f1be3355eb74deab7e7f36693257142d5f3147eec2f2c13a164a9b6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175622, "uuid": "72cc7aa5-0288-43c7-86a9-f420e57b0d51", "comment": "Malware payload", "value": "df00ac300f8c29ace73f1921dbd26eaec1564446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175622, "uuid": "48e527d6-fa5e-491b-8cb6-7df1b540e273", "comment": "Malware payload", "value": "691f67b3a6fdc4581c0a0309f42e4a14a73511336575a7b1bc4c832dc2f53497df87b150b8ae2c71d5983a6077b71514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175622, "uuid": "765edf5c-327e-40db-868c-2ac5293c72c5", "value": "T19776330233DB4E77F472023095766FB4239AD1466D25C8E7A3960E1D3BBC239F9A9721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175622, "uuid": "4eeae09a-dbd4-4d55-9f21-fdd0bd8a19cc", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175622, "uuid": "db2a1a95-0d64-4d0a-9a5e-0aecea68ba3a", "value": "196608:91Oi0xMQhMTQ86PuwaL/+OWdl7Y6Tjk6OWBIGAduCPv:3OijUMvl/+OmlkQoh2IDuCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175622, "uuid": "b3b2884d-2cbd-4bcf-aab4-4662cd847ec3", "value": 7581353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175622, "uuid": "c41dfdfa-358f-4c8c-ad92-2e83218b6b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175622, "uuid": "15b0bc39-65c7-45ff-91ba-d6c69c82ea60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b14940-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174449, "uuid": "aebb3273-aec9-4569-bdbd-d7cda1bba241", "comment": "Malware payload (SnakeKeylogger)", "value": "06446b46aba6f4facab86cd44aa081b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174449, "uuid": "d8d404ab-9956-4756-8df3-b27186b29698", "comment": "Malware payload (SnakeKeylogger)", "value": "c1b1bb430d273c5d98ee403072a3eb65ea39a0d0328e495d5cc5963d29e236d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174449, "uuid": "05e0b55b-6c0c-4a4f-897e-fbfbbe504a8e", "comment": "Malware payload (SnakeKeylogger)", "value": "2374be05a69bf7fa47e0909deeac41fbc8103517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174449, "uuid": "7c0920f7-ae01-4732-bad2-babef95b80eb", "comment": "Malware payload (SnakeKeylogger)", "value": "b9c3dc1740e747b538a51f54fb88519065d22741b1ff987c776af94c003414d602c1d856ebb276f537a212842026168f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174449, "uuid": "b7b0c078-077d-4156-aa39-444d58e4090b", "value": "T1C5457D92B1918C9BE46B45F1AC6AD53021A3AD5C94A4C10E5ADE7F1F76F3342209EF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174449, "uuid": "c5d2a232-da3e-4380-8cf2-a4b1dfd3bbbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174449, "uuid": "d74a2bae-252b-497c-a659-6fadfc85cb8c", "value": "12288:67biy2sz74MYqOOUES5bKBrQz0uhIqvQ6/zKaXCz0qQk63wkeRD8:+mxskOUEou0z0AIqvjLqz0qZ6eD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174449, "uuid": "5153cf7c-e59c-48d8-aabf-ccd8d8a69a7e", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174449, "uuid": "9fad2298-f774-414d-a1fc-f4cf93e32f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174449, "uuid": "4cf7a5d4-3351-4d07-8f1b-ad353e6228d8", "value": "PO-283330901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873fc7cb-3d7a-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1664183198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183198, "uuid": "31d2446e-d658-49ce-8dda-2e11db88d431", "comment": "Malware payload (AsyncRAT)", "value": "8256fff3e3076a08f34006dfd92599d9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183198, "uuid": "c8e2aee4-9da2-4a91-b914-da52a1cc1efd", "comment": "Malware payload (AsyncRAT)", "value": "c1ccb8872c05b12b9236ff9864baf70384122ecfc5c819ff301ee8b83befbfff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183198, "uuid": "b6767be7-6649-472b-ad77-2075f2c8c33b", "comment": "Malware payload (AsyncRAT)", "value": "7287e1ed0ca90e615b5682007584ea1205b16ef6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664183198, "uuid": "f1af6161-1483-4884-abd8-ce000d229db9", "comment": "Malware payload (AsyncRAT)", "value": "7d9bedf853c563b40e31935300c5a63ee6d56db25ab0b0776beb266999c679fffe3ee4b52b7a5d31a7b52077f282346b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183198, "uuid": "d70e0fd4-edfc-4e76-a588-d3d90d151abe", "value": "T129233D1037E8812BE2BE5BB859F26141857BF2673703D9493CC811DB5B13BC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183198, "uuid": "610bc44b-4b86-4ca3-a108-a861705a7d2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183198, "uuid": "52ca6821-f5b2-4a0c-9f8b-ecfcee981c82", "value": "768:Uov5MNNmnO4Gl2CNI13wRCn1OCDyjb5gr3iCqTwIixOrBLntoAkgWyClZ52tYcFX:Uov5MNQ9AUVebWrSCqToxUt81r5KmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664183198, "uuid": "d728bdde-e29e-47a7-819b-756ed9266086", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664183198, "uuid": "466238e2-357b-4c19-a009-d2249bca11c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664183198, "uuid": "e439a339-a47d-4150-a1d0-767b44fb5aaa", "value": "C1CCB8872C05B12B9236FF9864BAF70384122ECFC5C81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf3e372-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214668, "uuid": "81b9106d-87f9-4286-9650-b8e1b77bacc2", "comment": "Malware payload (IcedID)", "value": "90bfaf210589f99fd00bc0b942870597", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214668, "uuid": "e6c11c3f-4abf-42cf-a9ce-e1fc488fcfb2", "comment": "Malware payload (IcedID)", "value": "c219777c4bdd8df4f3190678b777156b2f81f734f55376a627bedcb4b3daf3dc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214668, "uuid": "220e78f3-7da3-44f7-8c7b-84f4c78332bb", "comment": "Malware payload (IcedID)", "value": "2c520dd9f61b762e44ffccdf69b39a50a53e02d5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214668, "uuid": "e9efd90c-3ff9-4cfb-9af7-bde46e217b7c", "comment": "Malware payload (IcedID)", "value": "cd6ecf0f0963d7e1586d4f160e902342716f5f93c12ddcb157e38e553333172aec53292d8cd9b17e011b670ee2018e85", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214668, "uuid": "f00478a3-edfc-47f0-8245-24b534ab4690", "value": "T16115F101DF40616BF00B693E331769C7A8660C27748BDE1E6B92512E2AC7F60FD35D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214668, "uuid": "fac3ada1-ffee-4fcb-9aba-2857524d25c0", "value": "12288:JGVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEqFIkxQ+9GjT:sV2jUeQRI5wPN/JFIoYjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214668, "uuid": "91988445-4ce8-4431-905c-6ab51a12a784", "value": 886682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214668, "uuid": "9863d20a-8c88-433c-817c-2077d840465c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214668, "uuid": "f434f5cf-8e06-400c-af47-d5dbef642a4a", "value": "jenniferbrantley file 09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3015dedb-3da9-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1664203238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203238, "uuid": "e9ee94f1-6693-46fb-aa4c-740b8ccb1f93", "comment": "Malware payload (njrat)", "value": "baa72f0a4d0ec5929523d963530f918c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203238, "uuid": "15fc20d5-da79-4c4b-97a1-aa6846969bbc", "comment": "Malware payload (njrat)", "value": "c241359bb16c2f829556a085615e945964f419c8b6bf4fe057e074a42debc61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203238, "uuid": "e2b6e1f0-3353-4886-8385-c65996685a22", "comment": "Malware payload (njrat)", "value": "69c59ca8edc4f143dabfb5b886ac134feae552ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203238, "uuid": "b4517b4f-0a89-4b10-a41a-690025b5f0c2", "comment": "Malware payload (njrat)", "value": "395ee71939f0be4e5182509fd4432ec036c9963f23aba8acc9fe8d4c3187437b1b138046a81d572b6e3b727325ad0b9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203238, "uuid": "9172ec01-98af-47ac-95b8-a4e6898dd5e4", "value": "T139032A4D7FE18168C5FD167B06B2D41207BAE14F6E23D90E8EE2649A37736C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203238, "uuid": "a596a05b-bf15-46dd-a07c-c75764d3ab86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203238, "uuid": "7bc0d1e2-528e-47f0-974f-f9cf13802f55", "value": "384:Tqick7sgwi+tx3+j/NSyszg8QPBI3mmTlrAF+rMRTyN/0L+EcoinblneHQM3epzn:W5kQLCNhszg8QeWmBrM+rMRa8NuujQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203238, "uuid": "fdf618f1-79e5-41e2-94c3-7346bc5b1c7b", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203238, "uuid": "758bfc8a-5d13-4a93-8d17-83a4133dd5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203238, "uuid": "dd12f9c1-b8a2-420f-99d4-6a4dfa0161a7", "value": "C241359BB16C2F829556A085615E945964F419C8B6BF4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4507aea8-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664179221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179221, "uuid": "7e9b229b-726c-432b-badd-7ac68b06cf18", "comment": "Malware payload (RemcosRAT)", "value": "3c7563f6d0685a7ebb10b9c9fbef26ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179221, "uuid": "1d58793c-6a3b-4b38-95a3-c80ad54ba8c5", "comment": "Malware payload (RemcosRAT)", "value": "c24d74b011bfd25eb0195ff8d16b2f0f48ce7bce49cbba281bb5795eda4f87ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179221, "uuid": "ade8e357-ae73-47b1-90de-ea3c15741858", "comment": "Malware payload (RemcosRAT)", "value": "9306eed5fc868e120cc1362725b098728ad55d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179221, "uuid": "ab6862d3-60e6-463e-a9b9-7a6b39186532", "comment": "Malware payload (RemcosRAT)", "value": "5a74813ec7d0e4798a9678afd06ed34e75f721828f67f1d6d4f1904da6b6bb529be49946313f61d01ba57fd1b49cca83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179221, "uuid": "17906616-6b55-4b9a-a2a4-974eec73f799", "value": "T16155012627FB8E17D225667485C0D2BA83B59C02E163C28B2FCE6C8FF1977D58690717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179221, "uuid": "457cfcbf-e790-4cac-b686-1f81f24527fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179221, "uuid": "0d9ec34d-4401-480d-8d11-632c930652c4", "value": "24576:0sxsZtEc2ZVg9bOBtdrFE0k3gP7cyKSUyer:/i7YVg96BzrFtk3gPrK9ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179221, "uuid": "10efa983-eb70-4394-b82d-04c85833de41", "value": 1316864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179221, "uuid": "0c3653e3-e57f-4656-9118-4c2dc1703238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179221, "uuid": "ca0bcd19-2229-4878-9cbd-a079e73f5b07", "value": "belgeyitara-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4adbb57-3d6d-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664177771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177771, "uuid": "3ad9261d-7e47-4818-b85e-61367df844b7", "comment": "Malware payload (Smoke Loader)", "value": "26923d8f49d9870d9d7df48850108cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177771, "uuid": "b09a58b4-9da8-4c47-b8f5-9f9ec9e46051", "comment": "Malware payload (Smoke Loader)", "value": "c38727517f07daffbbc9fe6c312995214038e2a73316537e8eac94688b997ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177771, "uuid": "fa5319a9-fd16-462b-9c13-b8b060f1be6b", "comment": "Malware payload (Smoke Loader)", "value": "14aec132e3a6b3da95f43fbc3f4a0717b97063a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177771, "uuid": "77d5b128-cd58-41b3-9135-09b9695463fd", "comment": "Malware payload (Smoke Loader)", "value": "73dc6c0d58d134a74b5b96b32e87a9dc8706901ed2c4cd50efc5f8bb6e83891cf29a38640d31425bd2dcf6e81977c8c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177771, "uuid": "3d8137f8-cfbd-4693-8f05-1f562654f85a", "value": "T1FFE3D0027B90ED32C41545714831EBF5AA3E3C215826568A3F886E7FFF323D2567639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177771, "uuid": "66853013-1a94-41c9-a4ef-a3e228b1948a", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177771, "uuid": "8b887d96-618b-49b0-9b2a-47efd6a6a768", "value": "3072:+1Y8aYG5DRqAC/MeruVCRVp+nkV9lIQ7BuQ15x:hRvCUeSC50kV9lIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664177771, "uuid": "ceababe6-667a-443a-a76d-33157da62d56", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664177771, "uuid": "690a3907-a515-416e-914b-150805f3bad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177771, "uuid": "0eab97f3-9a08-4187-a001-ce603ebee628", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a536dff-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173217, "uuid": "c5d9a98c-25c9-4819-9767-561db25897ba", "comment": "Malware payload (Mirai)", "value": "709151daf9dcbf03ba2258163fd3db7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173217, "uuid": "32d007ec-37b6-4658-a716-7a0a1dccb0c8", "comment": "Malware payload (Mirai)", "value": "c3d7397886012a0d30188fefdc43ec62fd771988474ccaaf4fc6e170a3f85282", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173217, "uuid": "1f63f3b0-57b7-46a7-a4b5-75533b79b532", "comment": "Malware payload (Mirai)", "value": "ebc5540aae256002f4c30efa7b4eef1ae77a8f18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173217, "uuid": "261a3b4e-4417-4789-abde-841404bbdfa0", "comment": "Malware payload (Mirai)", "value": "f0bd24b3c4f1326513ce102a8faf8a703a74913eb2fb68a438c5e2692165ff18a7a1e9062175ccd74fd2f27771f4acae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173217, "uuid": "f5af8299-47a5-4dfc-ae96-06b989fb08ed", "value": "T17F23F232D15AC1B0C9A4183FD952C7D69BE41BF9DABF368123D49392D8E305392DCE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173217, "uuid": "c99c2794-b12d-4c32-8194-36f73dd1a1c5", "value": "768:zT4biORpruuOt+YCZyJUTmSPwnSJEaE+8ekeumhhj4By5s3UozhYg3ZFptvLxiHq:z0JzrstzAyJUTmRq9EveomhaBjzD/pKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173217, "uuid": "6f00fc5a-3c1d-4203-b6fe-2d8d89544c16", "value": 48100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173217, "uuid": "12aca06e-309e-4ddc-ac6a-14ab21c63f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173217, "uuid": "303db0ea-c0fa-4835-99d8-f474069af614", "value": "709151daf9dcbf03ba2258163fd3db7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06124ea2-3d62-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664172673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172673, "uuid": "fd2644ae-c009-4aa0-a006-98744b7628ad", "comment": "Malware payload (Stop)", "value": "9c07db31da925895d4a63013ea34e7c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172673, "uuid": "256f09a8-e9f1-44ce-bddd-1816ced316d9", "comment": "Malware payload (Stop)", "value": "c410766ce834716423030436cb5240ff355a463d7b05241e4ae87985f0e7301e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172673, "uuid": "8834b7bd-8804-41e4-89f1-9fd94b817102", "comment": "Malware payload (Stop)", "value": "f000f0724f3b01fea88afeead17bbaba54186dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664172673, "uuid": "3721dd6f-c80d-45a1-a735-d0f127c5f6d1", "comment": "Malware payload (Stop)", "value": "cdea472f9fbd587a2dec66207d16b35235a8919c9368c62448b1a1d81b0b17b1bfbe92ec7eea2735524d21862ab34e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172673, "uuid": "a0694b9f-5bb4-4564-96b9-4c8fef44b37f", "value": "T120E4235AB620C97DC86520F01839A3E4D6793619A937068E36497D9FBF337C0B739349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172673, "uuid": "0bacea26-91be-4c6c-9d1e-f22c6f288fe2", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172673, "uuid": "dd07f4de-1625-4265-b889-d3063613a06c", "value": "12288:3Ie4EgvbCo6G7R18b6vqKprxLLr75yqiLJhS2n/GbAbSQN2y:h2bCS1188tx7VyqAeoN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664172673, "uuid": "ce2fc749-0c03-4f0e-b532-fe86aecf5eb7", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664172673, "uuid": "1e32cb1d-d121-4ecb-93cd-10788539897d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664172673, "uuid": "fdc28bb1-4ca0-45c4-9fc7-adaddcbf8b2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba055bb-3d89-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664189433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189433, "uuid": "2e69f5f4-2a4e-43e5-a470-7f0c79c1ced0", "comment": "Malware payload (RedLineStealer)", "value": "98ec29af64a184234c8b03f6d1a15966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189433, "uuid": "6324c001-5b00-47ce-8fd9-67ba934e1261", "comment": "Malware payload (RedLineStealer)", "value": "c47a6d3e018fdbc0f63c224735e6ed5746bc6a70c26f7c60e9ccdcd030ac38e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189433, "uuid": "614768e2-849c-4f03-9333-ada953ca28a4", "comment": "Malware payload (RedLineStealer)", "value": "b50d3fb32e4f8482795a935f231293fd98986701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189433, "uuid": "7577077c-6f21-457e-94b2-bbf1b29f8d89", "comment": "Malware payload (RedLineStealer)", "value": "19e8e3d823cb1d37d436953c58434741d03eb8a73ae99eb5cf1aa79d6d4f2aced2e26e956be0c14b5e961ee538ce5c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189433, "uuid": "1526cda4-fe8f-4a9b-a84e-2e56dd38d688", "value": "T1E6E3E10137C0D4B2C00596B55832E3E0EABABC2146265B473B68AF6FDF313E295B6395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189433, "uuid": "78e9da6b-8b30-4802-b904-e30d5f57a096", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189433, "uuid": "9a5f1b61-db88-4f7f-a1f2-a1a1703db36e", "value": "3072:DCWZgGz5eoir8zOBB1+GC2bz9K7ez2653Bkj2kY5B:96loZTGC2/99q65Sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189433, "uuid": "94046337-50b0-40f8-a6d4-112ea16ddb2e", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189433, "uuid": "b13cc75f-827e-455f-8381-089db6dc1ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189433, "uuid": "fe37d38c-7330-491d-982a-e772ea855f15", "value": "98ec29af64a184234c8b03f6d1a15966.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4882b5-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1664173197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173197, "uuid": "a18dba7f-c69f-43a8-8a6e-4e054744e582", "comment": "Malware payload (NetSupport)", "value": "2f0bcc1ba89659a866d3ebb5cd752552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173197, "uuid": "5d853840-2ed2-4545-a78b-74b81a200f1a", "comment": "Malware payload (NetSupport)", "value": "c4841e9b7456e77872f4ac49d68c54d26df696ce090833f4449ae7bf5057eb0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173197, "uuid": "b5fe2a35-0f71-4ea1-8142-12c2e8a97b41", "comment": "Malware payload (NetSupport)", "value": "30e4b73284f682182377ec32b998fb92b6f6d08e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173197, "uuid": "1aff2ce1-c352-49ad-9182-8848e93509ef", "comment": "Malware payload (NetSupport)", "value": "2f3e7f3bb2e49b818381ca0414228ec10ca51ea22a60885424fb5714ddee5c3542dd6a822c4a2a221329c4013fe4204e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173197, "uuid": "82cfcf2c-c9c1-4cd5-af82-273245ed9ed5", "value": "T197C5EF903A93C021C39ED7F0D975E9FD679E6CA1C123758BE68EBD843A30961F265702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173197, "uuid": "d5c53765-07c4-4f92-b31e-f01c0929e308", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173197, "uuid": "55a668ac-8eba-43c0-81e7-6426924249b2", "value": "49152:vKglPE5f5Wv3lDSpPGUOVed3I8tgb2PsMXUBaD7fELSv7Mt4dIP1KZTK:vKgJE5hSQied39t3PrXUmr3zM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173197, "uuid": "74751992-e8c1-40c8-9d70-8dc2dcdba4d7", "value": 2744140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173197, "uuid": "ce8fd3a2-ee96-42d3-9f17-59468605a59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173197, "uuid": "d4a598d9-162a-46fc-8231-3a0dc9295623", "value": "indicative_exchange_rates_dtd_26_09_2022_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a53b9f-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196021, "uuid": "2ecc194e-615e-4b2e-804a-b2dd86d37b03", "comment": "Malware payload (Quakbot)", "value": "d61b083956736665a1ce83131dc0b490", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196021, "uuid": "c1f5bb54-d3fc-4119-8d45-745e2e5cb523", "comment": "Malware payload (Quakbot)", "value": "c4e24d4643ca6e8901e50f5e5b818a790149b27b2e5b71a89f0052bc3d756f6a", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196021, "uuid": "6ed16d71-b176-4a53-a5d4-eb3673c91a07", "comment": "Malware payload (Quakbot)", "value": "c18dfe2763e66b6b3f1e847276f4d82a5a52d86b", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196021, "uuid": "13891c41-0850-40aa-9f4d-a0d733e65d3c", "comment": "Malware payload (Quakbot)", "value": "e8467eaf0a8cf50c0f05cf801807a00ee1b7986a3a24ed20f59d568e815651a4c3fed5750c8b6dd2f3a2ada4b2c58e0f", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196021, "uuid": "e30b0fae-0f4e-45c8-a3ce-e3b7b248b22d", "value": "T133D423EB88DBAFB36C0109153373D65DE088CD25F4AF629E822BD992A41EF585DC45CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196021, "uuid": "33d8b7c3-4804-4c70-a578-4ea5f99fa7ad", "value": "12288:oZEn/Dhh4GcHV5BAOHz+9IPuL2tlnNPIJvukbDMFc6ZGV33PBi2c8LEhP:oZEnLhq7HvBAOHYYign4vlMF9w3fBXcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196021, "uuid": "92a55374-91bf-4c6b-8743-4180b8b5d757", "value": 613415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196021, "uuid": "8f86d09d-7819-4f43-94ff-5cb24980737c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196021, "uuid": "433b15da-c1ec-4b1e-a900-d7fb8d783cca", "value": "tstetueluvpvlapoamsto.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6506e36b-3d68-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664175409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175409, "uuid": "ce47ce8e-baf6-451a-8699-a0c31f611cb2", "comment": "Malware payload", "value": "1e1a0949e772e00c95aa02efc4b36af0", "object_relation": "md5", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175409, "uuid": "a71f358d-28f2-48f2-b658-2d8f3cd5a993", "comment": "Malware payload", "value": "c562503c84ad2dab477e925bf8c0620363c7621f9a21d44574b4cd4f61413998", "object_relation": "sha256", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175409, "uuid": "e5509e51-a3fc-4f36-9e03-226464269e1f", "comment": "Malware payload", "value": "62496b062be23b88d145884790b21c855ca1dfb4", "object_relation": "sha1", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175409, "uuid": "4a213aa0-6313-45e2-8f45-8758a01bcda2", "comment": "Malware payload", "value": "cc7161c57578fb28e6470fd76e910f1cfa73ba0c1d5bbae7f16fe1e65ee734b07183e61b3cb6822f48be4cd0c1f89e52", "object_relation": "sha3-384", "Tag": [ { "name": "170-187-188-177", "colour": "#98A5E3", "exportable": true, "hide_tag": false }, { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175409, "uuid": "90c806da-b67a-4812-9b3e-242e3bbb1ac3", "value": "T10024128F62A97F2BD1791476AC6E4D7305BD7CDEFE0407D2C5A0366F3638257260228A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175409, "uuid": "c71884ae-7d13-467f-89d3-152d55ca6dcb", "value": "a85a2a6b7d7560058e49c7a1455961de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175409, "uuid": "0da7813e-add7-4a8b-a325-2b5a76131ac4", "value": "6144:6ehxCWK5DA4vSeaoN7hf0AfEqmcCcoS5qWt:6eJK+u7hf0AfgcnoS5Dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175409, "uuid": "fb8c459c-8dec-42e5-900c-4b25d67ae0d9", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175409, "uuid": "7addedfb-2878-4e57-bb8a-8524a16ab117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175409, "uuid": "ee8b9d5f-d8bc-4259-bad7-e258d4565b42", "value": "original_NOautorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1e11d3-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227340, "uuid": "c90bb74d-c9fd-4865-aa1a-4d7b39b96554", "comment": "Malware payload (Mirai)", "value": "5485f6f6885420639ae13a9e52c7666e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227340, "uuid": "0e9eb00b-06b9-4caa-b948-31f8474f10e4", "comment": "Malware payload (Mirai)", "value": "c570b3517c64a1e88944d10ccd78b587a52217a7d62bba29d92d1a2b2f7421ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227340, "uuid": "88bb3a1f-fcd2-46aa-ad30-0edb2d1d0518", "comment": "Malware payload (Mirai)", "value": "39f1e05621c92dcd5a9644f6b18f62e5caaf0701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227340, "uuid": "b384a3d2-13e6-490e-a818-1bb0d052602f", "comment": "Malware payload (Mirai)", "value": "313582c7a2ee5d1a9455634801fff4ad8f76b41a8fecdc0b2ae5e1ce1a868c60df91fe986e2b15cd701716818f04a666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227340, "uuid": "5fc61164-dfc3-488b-97ab-b06aa2f3ed7c", "value": "T134430260311EB1E099B0187A7E79BD465F1766BAC3DE306B4727832C62CD30B1BB8567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227340, "uuid": "ddbd3e65-b94d-46eb-b300-45b940750921", "value": "1536:RA9I7fKcIbFd+N/K7CQXbkZcAL3tzDImJiq:Re8KH2/K7CZZfL3xEsiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227340, "uuid": "73c7b20a-645d-4daa-9e60-7cd5c8590448", "value": 58160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227340, "uuid": "8a5ea09e-d615-4e7a-a44f-7741bd4cd06e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227340, "uuid": "f1a1fc96-e33c-4cf9-9b82-10c8bc2ec4df", "value": "5485f6f6885420639ae13a9e52c7666e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee78393-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173279, "uuid": "b45d113c-f7f2-490e-b98c-b6082214b590", "comment": "Malware payload (Mirai)", "value": "3dc7cafe378907da716a8aa68c854bda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173279, "uuid": "7f8f5d3c-4a01-437e-8ba5-b9d1976a8baf", "comment": "Malware payload (Mirai)", "value": "c5a527ab662ffa4e7107f187ad14cf853212023233dda40597f603ddb4120ec5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173279, "uuid": "2b435735-87eb-4eaa-9b80-7dcae5cabf93", "comment": "Malware payload (Mirai)", "value": "f7d0b909dc2bf87ebfe942d18b01786b869794d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173279, "uuid": "745a26bd-e515-413c-aa5f-a2c0ac4a3652", "comment": "Malware payload (Mirai)", "value": "e3c0dd3e802e4463641e48c4448c901583417f3295cf8abc42ce36e5426f4e9df0d7dd7c5be0d49c28d451914b02dea7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173279, "uuid": "aa5cee3f-8c88-46a5-bc1e-38196c308deb", "value": "T11423F1409AD38EACE87E7634567FB8490106B56857558ABBBAC4282DA85370C37783F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173279, "uuid": "942890ba-6042-4036-bd20-2918417a09ba", "value": "768:J5abgiJMCK+eLvJvgucCQVi5BG1YvKzQd9Z5+Q3nbcuyD7UrQRjgeDPcYNL:HabgiiCbedou3YlmKzQCEnouy8ryceD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173279, "uuid": "b0275a11-471e-4945-befa-2948f0f0c913", "value": 47196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173279, "uuid": "b547df1e-3ed8-48c8-b047-cf7b9dbdfbbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173279, "uuid": "40b9a067-e020-43b4-a50f-734af7e5ad10", "value": "3dc7cafe378907da716a8aa68c854bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1873e483-3dad-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664204916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204916, "uuid": "cbe369a8-a259-4cba-b805-11d12c4dfd12", "comment": "Malware payload (Mirai)", "value": "2f093f1006f033ad8cf758c58754a858", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204916, "uuid": "36f6609e-496c-48e5-8ccf-c9bed2b0c3f0", "comment": "Malware payload (Mirai)", "value": "c5cce929444b317726a45479453490800ddbcfe16114d0b9f651bf5030db9be3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204916, "uuid": "39f7d75c-543c-4729-9dd8-b2b96d75eb11", "comment": "Malware payload (Mirai)", "value": "e648c4dea1712fa0b8ad69dc42f1c83564c5e0a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664204916, "uuid": "e118ad95-3a84-4cd2-90a2-00ee5eb84dd0", "comment": "Malware payload (Mirai)", "value": "b6a37930248775a83bded0fd5a1d8aa02782ad3e80c6c3e2c9460b509ee65475b216abcbe6801bfda91a980129cf3c5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204916, "uuid": "61598745-8781-4531-8fc1-1f10425d0245", "value": "T1C5739D77D8990E94C5914030B0A8DE365B33A0C9639B6FFA19A6C2BA5457FECB400FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204916, "uuid": "542fcfe3-1317-433a-8c7c-73e42efe0bc4", "value": "1536:g/nGhBDHgOatlfP/dBoG1EL+cztcHEsKL+mU3A0HCZqtbR:g/Gr7LofP1KjcHEzLcA0HLbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664204916, "uuid": "b3ee9926-ecf4-47c9-9626-820e8da5934d", "value": 75124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664204916, "uuid": "58f2a1f5-c624-4c90-b735-7fb44d8c31bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664204916, "uuid": "0a989948-8fa1-4896-9e2f-968ffbcb60f7", "value": "2f093f1006f033ad8cf758c58754a858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a2c429-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174409, "uuid": "263c8615-8a13-46ad-bd61-c50e94a9900b", "comment": "Malware payload (SnakeKeylogger)", "value": "a514c7c2c68bc9b18e8cd90c30de4980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174409, "uuid": "e9587f83-7cb0-4586-bb7d-580828c888b7", "comment": "Malware payload (SnakeKeylogger)", "value": "c5d0d97ecceb4b96d309f6ae3c27cbc2b6326837765322bd84b49d8dd30078ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174409, "uuid": "a466ca24-8339-4fc1-995e-26a37b1d0efd", "comment": "Malware payload (SnakeKeylogger)", "value": "b5b1607011a373369121875c6a684d14f3d353a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174409, "uuid": "a6810d03-13fb-40c7-960e-4042864b0801", "comment": "Malware payload (SnakeKeylogger)", "value": "6c67f05a1fc4cb39d73906a6f56e30b16d082ca84c7344b35bd869cf9e2246861d8a6e4206aaf56d24d6a91232acad14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174409, "uuid": "0b81dece-b079-4076-bfeb-9fe05ad1ed2c", "value": "T1CB459E92A1908C9BE86B15F1AC6AE53021D7AE5C94A4810D57DEBF1F75F3312209FF0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174409, "uuid": "10e90c8a-3ee7-4007-99bf-e53120939975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174409, "uuid": "65f93c55-cf90-4faf-a42e-d0b7c69d94f8", "value": "12288:7Dc+h5nHSkHyn5wh6kxidbhNfSb10biQp3kNyPetyt8:0+/HNN60yhBSebiQp3kNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174409, "uuid": "12d51eee-5b9b-41e6-b845-aeafb3196099", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174409, "uuid": "ea8ec374-2a33-47a1-9196-dfc8674d9ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174409, "uuid": "b4b81b41-3bc6-4f98-8696-356135a6346a", "value": "faturalar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7b14ab-3db2-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664207230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207230, "uuid": "8e3c7bc6-4292-4869-a6ba-e28ea2026ce2", "comment": "Malware payload (Smoke Loader)", "value": "5c03141722bdef58f45711da8c0e2a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207230, "uuid": "a10449c2-cb12-4701-b502-e2a5500c191f", "comment": "Malware payload (Smoke Loader)", "value": "c611b42e0e811159a908c2535622e8529f5c6192ff0cc57123c47cc6722d1d0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207230, "uuid": "847d38f3-3656-4264-9f38-1bf7bb5d822c", "comment": "Malware payload (Smoke Loader)", "value": "92c601072e0071dc22154d1429945fb3279c29c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664207230, "uuid": "3eaaa84d-7b49-47c6-a5f3-3be300cc1d0c", "comment": "Malware payload (Smoke Loader)", "value": "d7dbb23e528d2bd3f1de9886732584710025c3f378f022606e95d5b8b1041247b252f6564e32af47536cee977ef1c9d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207230, "uuid": "b316b40c-4868-45e9-9161-3cedf7188218", "value": "T19CE3F101BB44D832C5168A315828E7B27ABE7C25467F25873B987E6FBF312D26739305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207230, "uuid": "9a60e6b2-0d3b-4ff4-8146-0a351aabd2ab", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207230, "uuid": "43107e01-840d-4e62-a3be-b1e08f61c886", "value": "3072:9aLD/juTc5NVniZJP5cN/6pO7c++sJo8Ry5Bh+P95B:mfviJCN/6p4qsJNy1+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664207230, "uuid": "4076a812-a8c4-4121-93d4-f8b0e362f152", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664207230, "uuid": "2194f2b0-e82c-4b5f-aa3e-ffa14b1239eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664207230, "uuid": "c5eff16c-4492-49fc-947f-2fc82a7f6517", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a33883-3d42-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664158927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158927, "uuid": "7117cc83-4b62-4293-843d-3e5f1a87fd97", "comment": "Malware payload (Stop)", "value": "54e321ff008d80ddf512c5d2eeb4159b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158927, "uuid": "d7a7624d-8df0-4c81-9654-827b7ec26d69", "comment": "Malware payload (Stop)", "value": "c69351ec7f1f0607b56707f838ed698218d67459a479c5eb29e87b44415b21ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158927, "uuid": "29d089e7-8eeb-4760-ad82-7f8ded2e8633", "comment": "Malware payload (Stop)", "value": "c5c3668c7c3b90c6d687ad4cfe9321add10fdb9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664158927, "uuid": "277db19f-21f8-48f6-b898-664d605ce26a", "comment": "Malware payload (Stop)", "value": "aaee4af7d88bc09e1471df35c254cabda7ad130d8ce81c9083b277ed39bd67ece8d3fc597ea3adf48edeba9d68e8c9f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664158927, "uuid": "96f531c7-01fb-4c37-8f4d-2e5ae29ad974", "value": "T179E423013684E035C37624F14C68DBB08BFDFB054565068B7F786A7E2EB1AA169B7387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664158927, "uuid": "24d951a4-6f9b-44d5-9942-18abc6ef54b4", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664158927, "uuid": "fe7b4347-511d-43fd-8d4a-cf236f5be99d", "value": "12288:vy/PQJYeA44RhuSLDpQYNmpamLShxTsmro0WJiAaqZK/56PuGy:vHJYKkPpQDpJLmxa0I9aq4B6PuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664158927, "uuid": "ded1abc7-0046-458e-9f48-5a3b73e642a3", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664158927, "uuid": "b7a9d1de-a0e9-4363-9e5f-d0e0b1068bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664158927, "uuid": "7aac8a08-2c0c-4442-9190-47799293f248", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7a7b8a-3d77-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664181814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181814, "uuid": "c35bdc71-ba83-4574-8db1-19a19884bf0c", "comment": "Malware payload", "value": "33df5813085692419f1848383801caf8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181814, "uuid": "28129bb6-003c-45ef-b2f4-f8be915a8c9e", "comment": "Malware payload", "value": "c6e2ef8f419325a84a8687373b8d227a7da149c83e9fad205a3c3e6ac4ea307d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181814, "uuid": "cbb8e0a6-cc84-4113-a93f-d4fd1cf88ad7", "comment": "Malware payload", "value": "e2a4362a1c509cc16ce1fbe1d81c1974d30cfb64", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181814, "uuid": "19d645a5-f217-4d74-98d8-44c900d5ed84", "comment": "Malware payload", "value": "4d1d975fdeb3a902f4a0b169c7b124869ffc5f10e8abbdcfb808fb5ddfd258c37951c82ff48e484bb9cd124221abd7d4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181814, "uuid": "8e958fa3-e0b5-46af-87fe-484cd3715853", "value": "T1FE034532A35863750F130243732D6BD2A32AA43877669B94648E516CB783954D3FAFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181814, "uuid": "0fc74181-2f21-4f67-b675-0c798fb6adac", "value": "768:YP6wbP6w4P6whP6wAP6wgP6wS7AP6wHyP6wIP6wKP6wrP6wmP6wd:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181814, "uuid": "538b0654-6b51-4673-97a5-7055d40b7bb7", "value": 39258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181814, "uuid": "f41fd428-c861-4504-8441-10fff8872bea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181814, "uuid": "562f2c05-41ba-4537-b1d9-4c81d8a6c6fb", "value": "newelevate.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c1d141-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664180288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180288, "uuid": "b82c8dce-4f88-4291-a4a9-ed311ee4e0f9", "comment": "Malware payload", "value": "6c9ba54d9e3a68b9e2611955021bc939", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180288, "uuid": "fd1a4f14-489b-4049-b1d9-fa5c80a4646c", "comment": "Malware payload", "value": "c702c2d41d8238744062a0474286881cc3ee8154b2c5f2619d6cae5a32eeba9a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180288, "uuid": "617eda9d-ca22-49f4-bbd9-3dd578979d16", "comment": "Malware payload", "value": "1458c60150cd7b36ac7e0a50089b61fb1da0e52c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180288, "uuid": "ad323cb3-94cb-4e07-9a84-f8205060f244", "comment": "Malware payload", "value": "1c37bf38723456661987477650c3e06c2e5c175eb041f1f5d57a94d8e21bfe2185c6a9d314ab0761004639d2da0d9963", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180288, "uuid": "626bda59-8ef8-478f-8d94-9f93e327b86d", "value": "T16A152021B1777DC3532202B1828F9E46A3297B47B35A1E94F01EEEB82DE45756381F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180288, "uuid": "0af97a7a-c32a-4279-b6f0-6b19a4dacbae", "value": "1536:wpGEch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fa:8yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180288, "uuid": "aa15ff4b-41a5-4c54-86b5-29981ea36358", "value": 885362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180288, "uuid": "13ba4a2e-852f-428a-9ad5-723130316757", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180288, "uuid": "2b696aff-5d27-4a22-81c9-383a6b5caebe", "value": "PO20220926.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f7b880-3d65-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664174369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174369, "uuid": "8f42c759-b21c-431e-900c-a360c42d6ee8", "comment": "Malware payload", "value": "2405aebd21e51ecf9828e58663ee226d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174369, "uuid": "a02497a9-63ee-499b-b259-5c49ebbb8c7e", "comment": "Malware payload", "value": "c790e3e220afd233162afc836e261c797af48a4bab8618cd5e99f6cffc59889e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174369, "uuid": "296a1427-1e1d-4cca-844a-2d11c8c1bc38", "comment": "Malware payload", "value": "020ead3bdb205559c429c18b5c5069ce8290077d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174369, "uuid": "76e060ac-0441-4542-ba29-9e0d5e5803a9", "comment": "Malware payload", "value": "94e16a386e4eef3fbb7b18a4e672d574dad368cbc0a97ccf256e9a3473363acfad625b7591b7365c2a5e661741f7a7ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174369, "uuid": "98501edb-50e4-4c5a-ab86-c817a3c32459", "value": "T1A544F12FEA872EA6F204E57B36F586F78C8D8A16D1B73152074593E75F84226320378D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174369, "uuid": "b5fbf08c-804e-4978-8736-f2edaa5088d4", "value": "6144:dJyHYWpYPEX/N6eiexvwNipJS/zSWJS/ZhuIxJS/naRW:do4WpYPEtMspJS7SWJSOIxJSvaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174369, "uuid": "9d08a2d3-1f91-4160-9d8c-f9e378746368", "value": 261505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174369, "uuid": "f4debe41-9799-4f88-b132-30530e6ef612", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174369, "uuid": "ce575f49-551f-4c96-a7d6-c0c026f2f483", "value": "Wire Instruction.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284ea55b-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664215251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215251, "uuid": "6315ea4f-0120-454a-a76e-5d537b475ef3", "comment": "Malware payload", "value": "74ef6edd64b2c892ddf89b92c912901d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215251, "uuid": "b8a2055e-ad43-49b4-aa5f-f2f6bd93ca0c", "comment": "Malware payload", "value": "c7ac4bdb07d9dcd75b59010aa6e092bb5a96a2f1b565f3ffd4108514805bbc1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215251, "uuid": "e98d1043-db77-41a0-b1f6-6ff9d6a3c97e", "comment": "Malware payload", "value": "c46989a101d555aeee690417a458d8bf78f24223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215251, "uuid": "a3232d63-3616-4f7b-a460-f5a97004ef6a", "comment": "Malware payload", "value": "0b73cb16ea5172cb4f765ad9fddd5b6531a77729cd2f8e642cdbe5db15ec6b94dab471b584524e7183d0c33370d758bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215251, "uuid": "71ce7eb3-99ba-449e-b5ef-a998a9630ac9", "value": "T121763362B8D084F6D06B3934DCD5AB4072B6CF68AA060CAB3345477E687ABB4CC53757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215251, "uuid": "878397b3-414d-4b33-829d-688a1bfbfa0f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215251, "uuid": "52ea5a94-6382-4a38-935c-81a90232b949", "value": "196608:91OCJQnyTXOLKsx5cyIyLrqJTox+yVvnlrXsLzqTF/mUIj0:3OcQbx5qccLe9mUw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215251, "uuid": "1eb43b1a-3db6-45bc-8ee6-0b2a80271c3c", "value": 7636128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215251, "uuid": "71365854-adad-46b7-b1a9-049778589fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215251, "uuid": "520eb88b-cf78-4e1a-894d-e1c1eb863562", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b1ebef-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664215622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215622, "uuid": "c378917f-7d22-4e3b-9d6c-134b3c3caa06", "comment": "Malware payload (Mirai)", "value": "34a2156cd60ffe62b98ef0ea17eefea9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215622, "uuid": "6b257dfc-05c4-4819-9dfc-d6fb33faf10c", "comment": "Malware payload (Mirai)", "value": "c80429795011d403f7bbcf76b8126f68d2d407fe48aae30f617e6897652f7aed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215622, "uuid": "2c1fdae7-dc03-4699-9831-5b8f9937e47d", "comment": "Malware payload (Mirai)", "value": "a382d02dd6282bd7af9f5a81936ea1ed1a489167", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215622, "uuid": "02727939-0e71-4331-856c-774410d9e054", "comment": "Malware payload (Mirai)", "value": "5385c87a29ed19f8e712f8917846b84f01e988207ca52f0eab8597beab003f66e7d4adc02c281d9ac1ab8293a2618a37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215622, "uuid": "6773dfee-d677-4327-91a4-582733fbf278", "value": "T1F293B85E7E218F7DFAAC823587B79E21964833C527E1C585E2ACE5011E7034E741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215622, "uuid": "b1f25c37-9242-4420-87e4-06d38e5e76d2", "value": "1536:CXThRDe9Tq8WwQayu8afXqPETA+je8rHWpUa:CXT69uKQhu8af6P2RvbWpUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215622, "uuid": "6ecc3229-f4b8-49d6-a2d2-cd11964b55e1", "value": 92944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215622, "uuid": "099e771e-7256-481f-8ea9-29916d237502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215622, "uuid": "f7b0651b-d7ee-48d1-9d30-e09152344cea", "value": "skidv2.mips-20220926-1807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e767e9-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664200624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200624, "uuid": "51ab97fd-ccab-43e5-89f6-82266c9c9d97", "comment": "Malware payload (GCleaner)", "value": "24b1afd64e5fd5f86d706c3b128ac53f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200624, "uuid": "96f09948-4543-41be-81ba-995282cacd1a", "comment": "Malware payload (GCleaner)", "value": "c9208801f999bb656711a5b2ff74fb074fc323974735ce6323ef407e5b50cf3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200624, "uuid": "b6dcba2f-b52b-4903-bc73-a2815395c9c7", "comment": "Malware payload (GCleaner)", "value": "e348fb12db1c53d9cb4c12c32d4e37f6e664a95b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200624, "uuid": "cf8f01e2-2fe2-4f33-877d-b5164b024c1d", "comment": "Malware payload (GCleaner)", "value": "378c1506471e7fffcb0517d8a01a621a6a57e9331eca86e42fce916a77be8cdae66362f46da3b3bfee63e3a965523744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200624, "uuid": "a257bac9-0e43-4d8e-a33d-ace91d19261e", "value": "T1D13402957D00E832D92DB271C532C1A559BA742609126A4273F47B6FFF737826F38386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200624, "uuid": "ef4dbf3d-8ed8-4e97-aa6e-5ee07792c14f", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200624, "uuid": "f78c9316-6aea-4ac5-a890-af29e7279391", "value": "3072:sVuQiaOTF5yAuMf8v/K4/fgMUDj/bJIOA6iOMDoNqvWo17ymCPV7jBrz5B:Ci1f8vSMBSj/bJrMkNcL1IdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200624, "uuid": "95767a0b-c7b9-47b6-b49c-89ba904f2c77", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200624, "uuid": "18b68e80-e724-4668-a239-7981742c00e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200624, "uuid": "fc856f0a-dc2e-408a-9d7f-eebfa6c43b30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586b84d8-3d47-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664161215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161215, "uuid": "3e42a18f-c87b-4603-8287-cb0fd73d8184", "comment": "Malware payload (Smoke Loader)", "value": "c490c01091b5392aba68f5869c050cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161215, "uuid": "ed369fc9-adc5-4c53-b018-ce90e42595ee", "comment": "Malware payload (Smoke Loader)", "value": "c9e7f8daeb5903e354a9fe3b182ce126cca286fc2b108f5e0001bdf2876f138e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161215, "uuid": "5e723ecf-a926-4116-a59b-45352ca7af04", "comment": "Malware payload (Smoke Loader)", "value": "212969b06e4d2eb32aa0c0d2dbfb65fd51b649d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161215, "uuid": "60d97c39-c619-4592-bfee-e00a4bb08f7e", "comment": "Malware payload (Smoke Loader)", "value": "56e0556dc12e176f2bade8f6768afe06ba5afe7f4a26b3bd05c28f2a2a623f57476a1a31017c62f30235345b7cd922e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161215, "uuid": "1651b556-9d04-4b54-8708-f3c77743cf09", "value": "T11504E0127A80D933D19A91704874C7A16BBF7C224536158B3B682EBFAF713E143B6397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161215, "uuid": "756d1041-2cf5-4bf8-b7b0-8cf2f9752515", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161215, "uuid": "088b91e0-0fb5-40b1-ba89-6d09cbe22cc4", "value": "3072:bJq/POichgR35hh7BoleqinEEsx570/ihDawPB3fa5x:5hYRulJszga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664161215, "uuid": "4cd8bc48-0eed-46f8-891d-6013d98f69c0", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664161215, "uuid": "1a82aa87-1e84-4b8f-ac50-d986924f5d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161215, "uuid": "4dc651c4-63fd-4058-a87c-ce69050166dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b05d59-3d66-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664174412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174412, "uuid": "ff704363-ad28-4e43-9e17-e746fbce5bc0", "comment": "Malware payload (SnakeKeylogger)", "value": "05eab719e0a171609c3f1ddc738780cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174412, "uuid": "f212b167-0b1b-43c0-824d-3babd413ea00", "comment": "Malware payload (SnakeKeylogger)", "value": "ca388611206c22f9a441c796da81ddd64607da2a303ca5d1a605385a8e60fa22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174412, "uuid": "dbc42f99-f95c-4dc3-b181-96b8eb8bbf6a", "comment": "Malware payload (SnakeKeylogger)", "value": "8a89bba19ec4bef1e77d3317f3ad47f6ab20f1b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664174412, "uuid": "c800508e-077d-44ac-a5c8-65be445fa594", "comment": "Malware payload (SnakeKeylogger)", "value": "cbbcaa6eb91c58418971a0a02a462fbe691273fc7a7aacd4575fde42a0700e7fe1c9d8e971176eba6fafd917d2a1614b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174412, "uuid": "b4b367cf-abde-4daa-acaa-04a76bf29d0f", "value": "T1F525F1320BEACA0BE1152678C4D1D7F6A7A9CD11E477C2D76BCAAC1FF09A465D760320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174412, "uuid": "b8a0b054-6856-4a3d-bef1-43ce13df4602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174412, "uuid": "fe088d86-3a02-405a-aae3-e1bd9a94c0a4", "value": "24576:TA96aTlH/5tWneJkLWoBkMyEZHS/GIYpAG1FE:TAsaxRA5WqkMpxSDYp3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664174412, "uuid": "97b00638-8d27-4d3c-badf-057df9cbd00e", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664174412, "uuid": "fa92a30f-f553-4cc6-a029-5ed55d5b01c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664174412, "uuid": "a911a1c1-ce5d-492d-8bc3-b4d705a9803b", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78f2b49-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200888, "uuid": "c604b8a2-e624-41cd-9d9d-d7415d55ea38", "comment": "Malware payload (Mirai)", "value": "4a865a3d87e0824e137d0e5f6bffb2c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200888, "uuid": "fb62ad4f-bf9d-4f2b-a1d1-a0e6bf3b7f7c", "comment": "Malware payload (Mirai)", "value": "ca87a3ca2761ca572ac23a7c6ef66a4f83976f334489bb6df823a1bf22e63dc4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200888, "uuid": "9da35632-5755-4409-8310-8b51496558ca", "comment": "Malware payload (Mirai)", "value": "ef71750fe8afeae9d0c0a0ebb463f1b28058b489", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200888, "uuid": "808dafda-9576-4189-bb33-473af5a91cf9", "comment": "Malware payload (Mirai)", "value": "40616b3886e1bd6a07aaaabc718676c5db87b84613ca50641cc967debe55f4dece28d73d831ac17bbff1b1dfb1355aa2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200888, "uuid": "337a308a-a7eb-4e7a-897c-c6a484aa2b93", "value": "T1AD834A17B58180FDC09AC034477FB63BD97771BD0238B2AA67D8FE252C16EA11E19C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200888, "uuid": "aacc4111-647e-426e-81c6-fa12907b0957", "value": "1536:a8uepVCfrxgeHce0xiCKigGYa+Kcybyu8HT600RoRVsFJysSU50V:aaVOrxgeHJ6iCKigGT7cE6HO0JRVsCsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200888, "uuid": "e5af01f5-bfea-45a8-b822-1dfed81d9228", "value": 81472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200888, "uuid": "7d2b5a02-cc53-485e-abf2-0e63fb83444d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200888, "uuid": "708eb9a5-8d82-4852-b5a3-e179c14e6ba7", "value": "tamkjll.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b573caba-3da3-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664200885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200885, "uuid": "e34e1708-27af-4622-867d-4343716b861b", "comment": "Malware payload (Mirai)", "value": "2965f3e3e4215e1ee973eb8fd0bd13c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200885, "uuid": "67c45c93-8a24-4ece-8d85-f7d78a005cf8", "comment": "Malware payload (Mirai)", "value": "ca99658df20edfa8674bc45d3896d207a3e9ec3a868d7a82db6b71b6a8616399", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200885, "uuid": "66121159-677c-461e-806a-a109de76f621", "comment": "Malware payload (Mirai)", "value": "c3478e75e67492f3343e017ef2fcd8e70559842c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200885, "uuid": "f2fb5c35-fb42-43a7-a844-69d05e40e6a5", "comment": "Malware payload (Mirai)", "value": "924ef1a89e1cc4b08e1258bfa03983b6832687bc08e4b06ab33ac5df14bc5a3a9505c9ddf12cedf73b7f54e0727192ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200885, "uuid": "dd4dbff8-5ded-4ea3-bb56-bfa3244cafbe", "value": "T1B6F34A46EA818F03C4D61775BA9F42493323A7A4E7EB73068D14AFB43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200885, "uuid": "69c77df7-314f-44ad-996e-b2799216bae8", "value": "3072:A2qOD771NoOA/FFeDE9xlkrQMdGL8J3KHpd5Qnug1WbsZC70hivo9WLKwaD5qOpZ:A2qOD771Ng/FFeDE9xlkrQMdGL8J3KHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200885, "uuid": "24cd99e8-2eb8-45af-b23f-c22cb8df3c17", "value": 170350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200885, "uuid": "6a64a9ca-41b8-4278-b880-315afdab7479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200885, "uuid": "afc5cc4e-88fd-4cd2-8425-c2d30bf396a2", "value": "tamkjll.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdee38c8-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213462, "uuid": "6e7529ec-1bf7-4a2d-ba68-d124079e27d4", "comment": "Malware payload (IcedID)", "value": "c566eb3efcd3d457edf2de69593b8d74", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213462, "uuid": "bc842de5-de7f-46a2-93bd-d4e872ad40f2", "comment": "Malware payload (IcedID)", "value": "cb36ff420bbc18158dbfdf3e9068ab775043db2bc61a637ad592a4762ee71b15", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213462, "uuid": "1f8ae64b-a266-4e9a-b079-f6f20a02eccc", "comment": "Malware payload (IcedID)", "value": "f456aa0d5ed790d44e7ba9a64e7a0b41b913def6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213462, "uuid": "37e0c297-b342-4c2f-a7ff-4d05e0c22cc8", "comment": "Malware payload (IcedID)", "value": "74f41a29d842c8a0cc4da7f964caeb5dabb849eb549473ffe0a45291f5c134a7e77b287fcf8a32c05d0faf9e5970febf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213462, "uuid": "4051d21b-e57c-4549-9dc7-d2de9a35bef6", "value": "T16115F105DF50206BF00B293E361769D7B8661C2B308BDE0A6B86512E2ED7F60FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213462, "uuid": "412d35f2-06e6-4911-bdc2-4ab000578698", "value": "12288:KteBVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DERF2hhgS0JGt:KteBV2jUeQRI5wPN/Q+hP08t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213462, "uuid": "5c03728d-4888-4881-bc5d-c0488c22e2ce", "value": 886471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213462, "uuid": "13cd8011-7360-4450-be65-745892ea319d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213462, "uuid": "424042da-83f0-48cc-9227-a11eff90ed15", "value": "joenjuki.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8a3501-3d95-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664194966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194966, "uuid": "99222e45-de25-4a20-98a5-4a14fea9c1ef", "comment": "Malware payload (GCleaner)", "value": "277d91cd50d667cd425fa3411f479a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194966, "uuid": "3c971d99-c08a-442c-80dc-6e283d10ec89", "comment": "Malware payload (GCleaner)", "value": "cb3ae7ccde1c4f7b6795329c935022e556025bfff1f64164aab074a18df61b9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194966, "uuid": "6fa51e6d-fbc1-4d1b-9554-5611d09faedd", "comment": "Malware payload (GCleaner)", "value": "cee08c8ecbd0305c3d9366f2dbcb942108f5e745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194966, "uuid": "8708f1bf-6a0d-4e86-9fc8-331a11e00db5", "comment": "Malware payload (GCleaner)", "value": "f1bb18942d41ecd5ce4f81557e84f974a53f7c19b7cf341d57c15afecaa0de3b623405a31b90073cc6f5c8befa1a6452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194966, "uuid": "4300044f-534f-41ed-9f04-5f6212d41875", "value": "T1EC3402107D80D472D81A32B09536D6A15AFF7C0615294A42FAF87BAFFF236D05B78386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194966, "uuid": "6d7fccb0-7be1-4a4a-8ef8-8cfcda11e5be", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194966, "uuid": "3f65fce7-7002-4006-b331-741412dbfae1", "value": "3072:Pe8UTF5YkfL/UGWWpymky4n6a9i7LjdeFDJsNq8qDqOcyckjOEskpBR5B:lwgmkJfi7LBejjDVXjCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664194966, "uuid": "ed1a0fe5-e291-4e1c-93a7-39c847487dc1", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664194966, "uuid": "8f22cab9-60d3-4f18-aac4-a9c70e68875c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194966, "uuid": "ca68cb9a-446a-4cf9-871a-80320e45b9cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a6e761-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213879, "uuid": "ca822948-30ab-48a3-a423-997e361075ee", "comment": "Malware payload (IcedID)", "value": "870c7b158f1a6783c45280c7f4267810", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213879, "uuid": "a1d61d8e-824c-4efb-9329-b53ff0f62813", "comment": "Malware payload (IcedID)", "value": "cb7b6d4c2ff89c0d673c3026033b840e8f766c11b7af0983cb0267392a01bc2d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213879, "uuid": "ecea43b4-4670-48b7-97c1-179bfa590dea", "comment": "Malware payload (IcedID)", "value": "0e4ca2f5ea12e26d7e2dfd2d890cdbf79c980761", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213879, "uuid": "a6c927e2-4db1-4aee-9c8e-a56e8562584f", "comment": "Malware payload (IcedID)", "value": "2e723a199b0a2080f8f0e30205f4898784ae5635009dc711be3e25506acb1dd738a393c6599cf29e1a97dfc1aec2ba8d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213879, "uuid": "ee54a613-25d5-41ba-b279-698e6535ff65", "value": "T1CD15F105CF00616BF00B697E371365D7E8661C2B308BDE1AAB96112D29C7FA0FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213879, "uuid": "403b2baf-7ce1-4c2a-884a-036023a180e6", "value": "12288:0/VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DESDvHmYSz5S6daAMfe:0/V2jUeQRI5wPN/HvHmYe5S6YW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213879, "uuid": "1a252793-09df-4dc1-9761-313ad69f57ef", "value": 886829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213879, "uuid": "af31edf8-c420-4c08-ab8e-e2c17587bcef", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213879, "uuid": "4807f356-df36-4333-903b-370c4cc9d6a2", "value": "morrisonmalldocument09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865bcea6-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664179331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179331, "uuid": "74cf3ab2-9227-4e44-ba3c-b56930f01a94", "comment": "Malware payload", "value": "548c6e0cd9f0cd6f3c719a5a5efc4720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179331, "uuid": "a5e7231c-c6e3-4f0f-b243-26c99f644b25", "comment": "Malware payload", "value": "cbd4d254fa1640d6c5828a03e7533830080884a905b2e5de07c358820885593d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179331, "uuid": "de759edd-f24b-4d8d-9c6b-49d11b937e9f", "comment": "Malware payload", "value": "074fce54fb36e993744947947e75bbbbe363cab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179331, "uuid": "b52b8cac-0b6c-4387-90ba-b37b4099c93a", "comment": "Malware payload", "value": "13eb1f27b0a6bd0e26f2edfc22fe0421739bbec2dac6ebfacbfa3abcd17f5e3c51a20a2b97aac690f7c9b79ff2494980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179331, "uuid": "07abba22-1526-46f0-9629-7dbc66411e85", "value": "T1007633A171FAACFFCA526132ED80ACD9D998F9C50D384B1B1388093D3E3DC8645557BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179331, "uuid": "cac7333e-6253-49b3-9a8b-caa0d088aecd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179331, "uuid": "16d6a299-9121-4a42-a576-9c19f93b2305", "value": "196608:91OtgeABKwVXYZYmSz/GcRROkkVfTzAG38AcK:3OYKYqSGcRR67EG2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179331, "uuid": "5f74ccf5-dbe8-4f0e-a233-cadccc1ae5c6", "value": 7586871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179331, "uuid": "42b8c8d5-7539-4970-af95-29f2188f8060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179331, "uuid": "673c3eb5-03e6-4960-bce6-04f02523ec6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f592142e-3d9b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664197556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197556, "uuid": "cea80572-f44f-4f41-b659-04a4573633cc", "comment": "Malware payload (GCleaner)", "value": "6bb8f5332a13cd525149708a68a44c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197556, "uuid": "9699a2b1-d7c2-4e6c-a54c-f801c093b672", "comment": "Malware payload (GCleaner)", "value": "cbef68f0196d1dd5d4226824593481affa8deacb3aa8f513cc46ce6b7079eea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197556, "uuid": "7cd4e90c-b07b-45ac-9bfa-35ea827bb9bb", "comment": "Malware payload (GCleaner)", "value": "1378147587efd5db076f07f902b8650e24347985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664197556, "uuid": "9313cf2b-bc26-4549-a5f6-7cde01a1cd45", "comment": "Malware payload (GCleaner)", "value": "fd3a69bb93433b7214ba853ecaecb07524f6178ef06a6b280d1a2ab38f82bf146e0fdc1fef7173157ae280b60e4f55e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197556, "uuid": "6637fe97-9a26-4118-9e5f-309cf052805b", "value": "T14034F1617EC0D872D91974708931DA72A6BFBC5012269D427BB83F5BAF326C16A303D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197556, "uuid": "091cb021-fc82-49c3-9a3c-2ec1662d19a0", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197556, "uuid": "9b09b855-619b-45b5-b660-4fe2ea533e2a", "value": "3072:knjITF5p+WgGfnzlPs9EYFYdgd7LQmz2QiEsHSkxi5NvcNzFcVDLB25B:Ay+WpzA3uud4U2vEsHSkxYviFcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664197556, "uuid": "c2eae27f-8787-4cd3-a02a-013bf67ef81f", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664197556, "uuid": "40f9addb-7a6a-41c9-bda1-da8b7bf2c258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664197556, "uuid": "23b564c1-242a-41b8-93dc-7a7d85297ad5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3131e35f-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664179188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179188, "uuid": "4e5b0b7d-7ab0-409e-8725-daaeefd04956", "comment": "Malware payload (SnakeKeylogger)", "value": "767bef6ba30559c23487aa44678f7a45", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179188, "uuid": "214c3dd7-a7c8-4608-837c-049e0aee5a56", "comment": "Malware payload (SnakeKeylogger)", "value": "cc251f6e2064a13d14f3d32cd84e7db379780e5ae6bb925dc3f239b490f72eef", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179188, "uuid": "7fa6443c-9599-4485-8a88-422b8ce83b68", "comment": "Malware payload (SnakeKeylogger)", "value": "578bac7fef39a0ade36c8ad9b4cdc6b62325ba71", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179188, "uuid": "bed0e2c4-d160-4b50-a806-5e7b1a0c7323", "comment": "Malware payload (SnakeKeylogger)", "value": "6e12f69e0bf4c3239923a8596ec3c67ba0af687372ad64ffe788517570fb2912d3af1b63f4190cf76d22a95128396083", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179188, "uuid": "88ade568-c7d9-4689-a7b1-d878c7ee07b4", "value": "T10AF4237F46A7EB7D4CC151875D14BE57F27C08B8A92B23B6FA410E73E8041DA2E58C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179188, "uuid": "7279f7f2-83e6-4a91-a707-dd5d1a7c503a", "value": "12288:KXy3QBlUIzqllWATk7h04JoJLjK6aJPvgWqPMIH5s39YHuotO2V:KXWFIWeqOYJfK6+whPMbahtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179188, "uuid": "7eb213d8-2561-4325-b300-1e4352d05b6a", "value": 743192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179188, "uuid": "5e1ce77b-58d2-4e03-a19c-623ce9394737", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179188, "uuid": "0460fd7c-df2f-4f9c-9b0f-eae4f360dcc2", "value": "TT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d7b396-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215089, "uuid": "d04d2987-ab55-46dd-8f0a-690785f76f56", "comment": "Malware payload (IcedID)", "value": "6ec1488f15f0573d3543e853af6d6e09", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215089, "uuid": "84632b73-a85a-4088-9a75-09e106f6384c", "comment": "Malware payload (IcedID)", "value": "cc42ef46da6aaeba9e41b2c5ac494f59383fec47f5736d27d4654613fe4cc610", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215089, "uuid": "a2c0104d-c0f8-46f4-b94e-fac89d2b2189", "comment": "Malware payload (IcedID)", "value": "941da2c83cd00abd146d7ef985990933f7f146cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215089, "uuid": "62be3d75-1891-4814-91e2-0ecd141de348", "comment": "Malware payload (IcedID)", "value": "878d99f4305427bb6d43605a39c109401e76148558a27294a4bcbc8d66952c45c23d43a74e7e6a7d6bfa3dd7c0d5cbd0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215089, "uuid": "9a571c06-2a61-42a0-846f-b8419d38ea13", "value": "T19F15F105CF44206BF00B693E371765D7F8A61C27708BDE1A6B92112E2AC7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215089, "uuid": "6037d70b-3fae-4c67-924e-4d4fee2962c6", "value": "12288:h6VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEW2rlj7REMCyc53:h6V2jUeQRI5wPN//2rlfREMCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215089, "uuid": "b16d2321-8f46-4ed4-8686-00aad76785de", "value": 887789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215089, "uuid": "e622a25b-1f62-440a-a634-aae189c69de2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215089, "uuid": "4de9d71c-4fe3-4205-8985-44d03a80915a", "value": "kingwoodcable,invoice,09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43796835-3df1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664234194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234194, "uuid": "64a407e0-018e-4a46-8083-53f0d7dfdf00", "comment": "Malware payload", "value": "1e53401e371e97f0cdeb43f41b33bc90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234194, "uuid": "14b634ae-6b48-43d8-b995-b384f3253b58", "comment": "Malware payload", "value": "ccf9a7ae0893516918c0ab6220ebc52faf12c849f3db2c3c755b5fb7fd83084d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234194, "uuid": "6b5eb422-c3d9-445f-8018-1b00ec6859e9", "comment": "Malware payload", "value": "df9804588b32a8dca17c6de09a3591d3c6a919fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664234194, "uuid": "bf84782a-ecf2-4194-a3b5-bdd561b117ff", "comment": "Malware payload", "value": "49de7ca9b1b4abd35d6131c924fa627465247a776bd1ad6455e40cf0d689f8969f398040addda9da5914dfd75c5c65c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234194, "uuid": "d6153454-4bcd-4e92-8df5-d3ab143a87d0", "value": "T1E2763370B0D185FFE8A4C8349A115ED4F09FCDA46B0084AFB7A56E5E6E38387957F620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234194, "uuid": "e1f9bf23-3004-47f3-8b9b-5121bd2e69ed", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234194, "uuid": "b5754a57-d738-406e-b068-a1ddd6b4d3cf", "value": "196608:91O0n4QWjrlaIQsHpVH7oKENSwP5XvMfVt1G2YEa5mbZo:3OC4lJ3brEk45UT1G2hacbZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664234194, "uuid": "e8c82e5f-8bbf-4e68-851e-4dd8f90bbaff", "value": 7589377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664234194, "uuid": "42e4b853-52ac-4181-9f85-4437f68f711f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664234194, "uuid": "d3b6bd08-b202-46f8-bfc0-a1b28a992681", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aadd979-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664180627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180627, "uuid": "3681ee89-f562-4d3e-ab23-df7f606bf01c", "comment": "Malware payload", "value": "415205ccfc65496a54c3950d8952e746", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180627, "uuid": "1ae59d49-6c93-4a01-a634-a403c24ebfad", "comment": "Malware payload", "value": "cd011dcdaf5457367b5b4abcd73e78f017f207c610a11f26db8841238dca7733", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180627, "uuid": "81088038-b631-46fa-a7b1-f631f851995b", "comment": "Malware payload", "value": "f038af8eac0f8f891562fa384581af56095aab88", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180627, "uuid": "6fb20a1d-b6bb-4044-bb5d-8e8e81cdddb1", "comment": "Malware payload", "value": "3b39543819a74a07e60ff61171f4654f6ac1b6a2040b40dcf882ddf924a2654ed26907acda9db094099491c0395f8bae", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180627, "uuid": "989a7cd6-3e38-447f-ab61-fb16dfafc0ab", "value": "T162312094112CADDDEF331D85C7AA1125626C2DC447F061B21464ECD82DB92DA74825FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180627, "uuid": "341ac410-b1bd-4d86-a6eb-ac084b63f7a6", "value": "24:A9ivV0AlQMlQigUY/uQ6Fz03h12lghBsFspzPSo0ZN+qB/bAIeWAnFsp423UFdM1:AEd0GRQ6hyth5pz6kuTpP+dMBnE+Tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180627, "uuid": "06114c94-8784-46ff-a651-b70e347a16fe", "value": 1513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180627, "uuid": "1935f9d8-bec9-4c01-a95c-79345dab2389", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180627, "uuid": "7230f951-9573-47b9-aaeb-aee0272ec997", "value": "Order 84889-CVE2-52022, pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e0374e-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664181023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181023, "uuid": "5508ec4c-989c-48f2-95ab-695bbbcb4b8e", "comment": "Malware payload (IcedID)", "value": "7d66a2a0aa02e626fed46780516e0acd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181023, "uuid": "4c1a4a00-66c9-4893-a288-50eb1c451f5f", "comment": "Malware payload (IcedID)", "value": "ce7607cc934bcc3362fff24deef331e72940163fa21b83c740458283a9f8ecbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181023, "uuid": "114b7d25-073d-4502-8ee4-8caa4c8b1041", "comment": "Malware payload (IcedID)", "value": "d07cab7a949b98d7e961bb0e9030db6969cf391f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181023, "uuid": "9aee0d70-a5af-4039-afac-46ce0ce2b655", "comment": "Malware payload (IcedID)", "value": "7f1d9879f2e57dbb0097dcc1adcbe7487f49eaee6099e65f3730506361fdd750cf74433e538fcfc42c805a20fc7f6ceb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181023, "uuid": "72f90c34-b2ae-4955-9eee-501978ced8bf", "value": "T1387428D87792F4A2D6B36075007F040BB37A2A57B84CC890E241E9D47EB85AD913BF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181023, "uuid": "202f024c-965d-415e-a4e6-7f8687ec50f4", "value": "0a9aef6c3988a175605d76552a506410", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181023, "uuid": "9e128114-076f-4b9d-b554-c40b7975f3ac", "value": "6144:66HdvqSwNOTzZLen7qACQ9j6pSHP7csiU302dw9qOI:JPLQHP7AX2djOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181023, "uuid": "df709567-3ba1-48f8-84e6-1201a95d9eee", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181023, "uuid": "1add3dca-ffd5-481c-b5aa-df669ab9d7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181023, "uuid": "5aa4ee4c-aed4-477f-a616-72bc1bce4da5", "value": "7d66a2a0aa02e626fed46780516e0acd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6759c9b2-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227382, "uuid": "83d4900b-5a58-4427-a080-16520293e529", "comment": "Malware payload (Mirai)", "value": "34b7cd6edb13066f59145e332387d10c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227382, "uuid": "72be7100-e324-4456-b54c-aab76b9a2dfa", "comment": "Malware payload (Mirai)", "value": "cef9b777d9e0b28c7e3f8771d9dc2441fd038af7211aa2254f1d2883b0dd74ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227382, "uuid": "3fa5cf07-e14f-4c2c-a6f1-1f53811dc8c0", "comment": "Malware payload (Mirai)", "value": "168c094ef646e2ce9f070f7cf1e006679e9e7775", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227382, "uuid": "232d4a8c-6d77-455f-84c7-9348d77f50f8", "comment": "Malware payload (Mirai)", "value": "f3e30a4cdde25ee3067235c1762551ebca08cdb415b3a6d8f3f2aaa5a95f61f2a6fcf2ffcac7fd664d1bd43c1c907a76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227382, "uuid": "593aee66-0cfd-499d-887f-99aca35f9b2b", "value": "T1F6D2F16514A2852FC9BCC27B6FDBAF1560FA0C8E690BD143558DB78E9EC31D0A128F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227382, "uuid": "4fcd9044-fec9-46c8-b875-805fdca3c2b2", "value": "384:MikzON8UBTj8ixQfjmwlAjC3SaYpdGgPRGILMth0bfkpsbCK1JnbT/nn9v1RDu:szW8UBTYiarzxChpogPxM+Vbp1JbLpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227382, "uuid": "215f41b7-b2de-4bdd-b565-7bb493c51da8", "value": 30852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227382, "uuid": "53c01fd7-29f5-4318-913b-03a80b5c07a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227382, "uuid": "39d3fc1f-7dd7-4980-a11f-ae6bf5a636fb", "value": "34b7cd6edb13066f59145e332387d10c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac8adce-3dd7-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664223093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223093, "uuid": "01473c5b-7bae-4413-9675-37b58573fea3", "comment": "Malware payload (IcedID)", "value": "eec43702fc1e37c0375c8f2347fa382c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223093, "uuid": "bed859ca-f59e-4648-bc59-e082bfe53538", "comment": "Malware payload (IcedID)", "value": "cf87fceb65b025e6f9f824496762f234ea3e043b8b4150df251d28cc80aaa1a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223093, "uuid": "d608e33b-7ede-4cc1-a3d3-8494e82edecb", "comment": "Malware payload (IcedID)", "value": "6f8d713ece3cab297697a9d39b683ea8a88afcd3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223093, "uuid": "18268e39-3c17-43ba-b6b9-5441bf7c942d", "comment": "Malware payload (IcedID)", "value": "3ffcfb9aae9bad79cbc536b1eb2fbd57fbfecadeeb3cdc6d5dc7bd68988b6e8adde659d3fe3fa77acbd4c072ff5a79c2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223093, "uuid": "e9a1625f-81a3-4d3b-959b-9dbb62ab1362", "value": "T1AD15F105CF50616BF00B693B371365C7E8661C27308BDE1AAB86112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223093, "uuid": "f9ed396e-7327-4331-9712-03580177d3e8", "value": "12288:yVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DER9d/+Ctz59prrhFH:yV2jUeQRI5wPN/9Y5/hFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664223093, "uuid": "c4b630e8-d8dc-431c-95a7-fa3449db88f0", "value": 887012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664223093, "uuid": "d651da38-88a0-4cda-a79b-0682df1a50b4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223093, "uuid": "852a31f5-ebc2-4c28-b47f-d3fafebae182", "value": "myfairpoint,invoice,09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db68b3e7-3db0-11ed-9266-42010a9c0072", "comment": "Malware payload (QuasarRAT)", "timestamp": 1664206532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206532, "uuid": "1d0e264c-bafb-4ac0-85a1-fa65adaf2760", "comment": "Malware payload (QuasarRAT)", "value": "ae2bc99fa3d39c5ce41fc2f5daf84492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206532, "uuid": "85a8c929-0c77-481a-a486-e42df6a94cfa", "comment": "Malware payload (QuasarRAT)", "value": "cfba9dab9282455d194d30dad7eac6cfc5c8e5d6caf94d631ed2b01a86e3a97f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206532, "uuid": "2f5dfdd6-96cc-48cf-adf8-c4ae65bd850c", "comment": "Malware payload (QuasarRAT)", "value": "a2ded46cf05a9b990b18e041a2ec38b1b99a8718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206532, "uuid": "65ab4706-ff0d-4a8f-b6ae-5ab69641a4a1", "comment": "Malware payload (QuasarRAT)", "value": "4a02689ebadc13fcf7fb5b20b6ce341cc1c5073b574d52d40dc25bae1127bf6c8a3d28cbdaae8e0f53eec548a2e95efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206532, "uuid": "424e2395-5089-4001-bd04-39c281c410ae", "value": "T197D54A1877F84E2BE07ED7B2E5B0105267F1F82AB3A3EB4B618166790D53B405D412BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206532, "uuid": "2ef93542-0c79-4859-9a1f-651c2ae2c78e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206532, "uuid": "1fbbb02c-5a68-4c09-afe2-49d65d41caf4", "value": "49152:V0quZIhnwj8O/1ERxfzWOe4ZS7jVNtYNXUfRza32ehyfTlm:V0fZIhnwj88+RxfzWOe4ZS7jVNtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206532, "uuid": "c2f959d0-4449-4542-89ae-f9ffdd7345ee", "value": 2898944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206532, "uuid": "017691fc-064a-47a2-ac9d-7fed87c32a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206532, "uuid": "130fda32-b09b-4ce9-ab08-8e4116c3864e", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fab3df9-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214485, "uuid": "821a2b26-e0c2-4bf3-8255-9c3acbd7113b", "comment": "Malware payload (IcedID)", "value": "e3f31139ce0af4942c97f98c2e49030f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214485, "uuid": "ab359995-e5db-40a2-955e-c00064a365ef", "comment": "Malware payload (IcedID)", "value": "cff784097a93c27539c5cd51c1ff2073fcc45a9dd72209f9c11ad14f034bbf01", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214485, "uuid": "145fb6b7-6e92-460b-9e63-6722181a1f27", "comment": "Malware payload (IcedID)", "value": "c8be02d711d37ac68b18cfb7b9158b7df914117c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214485, "uuid": "d7c32e89-2e59-42e3-9987-0d7e28095fa8", "comment": "Malware payload (IcedID)", "value": "8db62bdb312461bf18bb1c95d58810acc03dff7b38e5a84a14da7f597a87ddffa8e0a53e4cc62b753609abbe57adefd0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214485, "uuid": "6cfc9db8-045b-4d08-8381-ca676a814618", "value": "T13C15F105CF54216BF00B293E371365C7F8661C2B748BDE0A6B96112E2AC7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214485, "uuid": "723f6456-ecf1-434d-874a-a0421b9baa6c", "value": "12288:2KVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE/M/yuuV+XHfzPdiYKY4:3V2jUeQRI5wPN/3yVV+XHL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214485, "uuid": "de094a05-f5cd-40c8-bb26-9e8be40b46cd", "value": 887997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214485, "uuid": "8ddff9d5-f94b-4bf6-9492-a407e425bd09", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214485, "uuid": "a8cd27a4-2e11-49b4-a1e4-4cf76a02a395", "value": "manickbag,invoice,09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345ebf55-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180482, "uuid": "f4b4b8c6-4247-41b8-8e0d-aaf5ace830d9", "comment": "Malware payload (GuLoader)", "value": "b1334d41e70a4b116e295d930322177d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180482, "uuid": "cecb9362-c6b4-407d-8983-b5e4b08a689f", "comment": "Malware payload (GuLoader)", "value": "d02e56804f169f8d7c86b0ba390edaf37b6217ec8018939fcf1accfd453c8540", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180482, "uuid": "5f3736c7-02ca-47e7-8202-fc9c0424bcfc", "comment": "Malware payload (GuLoader)", "value": "eeedfda5e78740cb859028c6e60dd77699936a7f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180482, "uuid": "878ee2e4-8d52-44b1-902e-744343def858", "comment": "Malware payload (GuLoader)", "value": "a403449a268a882b5083210c1d251381fcc8364f96ba992099c7bda43b707c971e99c2488e49b68ae8a7d5f5d9b8f8af", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180482, "uuid": "248560c5-716b-4bac-94e2-4fc3d7f1eb11", "value": "T1680440688915D8F93B0DB33FF0020BF9924887024721852BF54B259FABAF35CA7595DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180482, "uuid": "1e9bf3f3-d3de-444a-948c-aea402bb1590", "value": "3072:FjaEhAt7MQ+IxLbyiY91VtcFTgEcCP3BK+YGCpF31IpuTtS7xA4evM8K4Ec5CnNN:FO7toQ+INmt7TwhPRzo1IpuTA7xPe3Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180482, "uuid": "f898f4bd-f5f8-48a3-afb4-0da609b1823d", "value": 189485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180482, "uuid": "c811cea1-3f01-49bb-a5fb-1d723e1f0299", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180482, "uuid": "cdca9d56-f1e3-48f7-b6a3-892ff5a00eab", "value": "Unobta123.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a5eeb9-3df6-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664236374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236374, "uuid": "a0635b4f-b303-4919-8250-79cd4ba7d25f", "comment": "Malware payload (Mirai)", "value": "ce33a0b06ad8eec8b051cd772f30a3c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236374, "uuid": "4b6c86e3-c406-4e1f-981d-7780871a2a59", "comment": "Malware payload (Mirai)", "value": "d08510d9cc3c93b55d126e91a06da401d096f72405b6ef7b3565b39639247e91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236374, "uuid": "6e240e9c-015d-4698-be6d-f8dec5ea87a6", "comment": "Malware payload (Mirai)", "value": "19d0c9a83c405e903dde13fd4ff0291d9169a355", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664236374, "uuid": "dc56ff76-e0e9-4b03-a6b7-dfd4fe571ff6", "comment": "Malware payload (Mirai)", "value": "15d90041a4fff36cf31d55f31168721350048eebd718cbba05f1a1ce38342f8949af951fa408dc84c57a831dd5fe7369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236374, "uuid": "15c54299-0b20-4ff7-888e-e077663e1962", "value": "T1C83318B51516F2ACE9E22038F40720F529520A1C3ADDE2D3B0934175FFB9B4CB96AD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236374, "uuid": "abeec319-c8fc-4c4c-bfaa-029355260f7c", "value": "768:DRVhMqBAy5Juan3mEAqPQi1NtuAkw7J1Tw9ulmj:DTAxaWE1FDtuAR7M9ulmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664236374, "uuid": "22a0a2db-6dfd-4747-981e-bb01b0069b74", "value": 50632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664236374, "uuid": "59be676c-8400-4c55-af6c-ac24dd1a993c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664236374, "uuid": "53a34e62-00d2-436c-ba6b-873a8ac67093", "value": "ce33a0b06ad8eec8b051cd772f30a3c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1a170e-3d48-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664161729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161729, "uuid": "ca195140-ea17-480d-90b5-0c06c6bb87da", "comment": "Malware payload (AgentTesla)", "value": "4e85e4a9501bbb6cf9adf372ee3d28cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161729, "uuid": "e01885ef-859d-4a3a-a41d-acf147e44860", "comment": "Malware payload (AgentTesla)", "value": "d1be2499de89be1f90b8fba3abbf20cfd30152c3ae10674152b2604ac86d76ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161729, "uuid": "afc2e20f-cfae-4fa2-bf0b-8ed3f6fac0f7", "comment": "Malware payload (AgentTesla)", "value": "d40a23803671e3f5fcb28ffe305b7beb0cddaea7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161729, "uuid": "a090655c-55bd-4f79-b159-c439f8f5ba3b", "comment": "Malware payload (AgentTesla)", "value": "339c91c023631c88eec718cad578221d87a51c5bcfcb1b8a1cef1e3922523057b05a1aa4db2259923401ab6e765e3ecb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161729, "uuid": "781cc87e-e276-4c0f-b687-3cf43636a693", "value": "T128626C1AEBD44932E93807785CA34F126A3B9B101DB7CB5E388C129F1F23F6119A2775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161729, "uuid": "967ce0cc-338c-49e9-9b5a-0ea38200b788", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161729, "uuid": "b1d8d50e-7951-4250-9697-4132b5b00815", "value": "384:a1XYcLqX8eENyUFoYGc4lRozeoH+b/iLAyG:QIwxCUlWqz3ebUAyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664161729, "uuid": "fbbb7148-f163-4b0c-b0eb-1f48c823c245", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664161729, "uuid": "c86c88bb-63f0-4867-a564-deb4ee745e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161729, "uuid": "e1661f73-7f67-4772-b349-c9c2383a130f", "value": "SecuriteInfo.com.Win32.DropperX-gen.7054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e311cfb-3d2e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664150541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664150541, "uuid": "1c91addf-fc50-410a-a79c-93008bd04bd2", "comment": "Malware payload", "value": "f9880eb85313a86f5a5b88ec55331845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664150541, "uuid": "7420e4f8-f25a-47d1-8344-dd007d0a7921", "comment": "Malware payload", "value": "d1f736a7ca0eed7a921d5b44334388764dc66a38fdb0b78bb7f01fe36b1d8a91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664150541, "uuid": "6263ecc2-c061-4b58-bd2e-10c14b050b24", "comment": "Malware payload", "value": "426ccf62e77060a2ca72c5971ca00723da0be2f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664150541, "uuid": "3299d8fe-a54c-4838-8478-dc8bdae14d14", "comment": "Malware payload", "value": "1bcdf7b9bf15af143df30f2ffa32e4c7aadc57b2829e7a2aa3fa8eee923d9037e486d419ebd689595f85510847663113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664150541, "uuid": "2583de68-e3a5-427d-a610-d41302386b72", "value": "T1A276333130D088BBEAC60D33465D57F5C0EABBCC1E229CF77741952BA97C5AC9A3152A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664150541, "uuid": "f174dfa9-51bb-451b-946b-77798aa5f24d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664150541, "uuid": "364ff9be-7a43-43fe-b11b-7494e1ec8397", "value": "196608:91OOvwJsHoSdw1Qypcy73RbjJmTc2dpUkYeu1ufXJHIuYx:3OmpIfRbjJC3PUMu0fJouu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664150541, "uuid": "dce16b58-a22b-4019-8d92-142c3fdc3cbc", "value": 7649719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664150541, "uuid": "c75ad792-d09b-4af1-ae79-a7003ecaea3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664150541, "uuid": "a02fdb61-e5f8-4ba2-bcab-c51b71eb7bcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccc1c5a-3db8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664209702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209702, "uuid": "e9275b37-58da-4eb3-8f93-7b3388ecbd29", "comment": "Malware payload", "value": "f8463962698412317442b7fec3e90e50", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209702, "uuid": "2d05846d-495b-44ab-8c57-57b669b3be8b", "comment": "Malware payload", "value": "d2520eaede1f6f07a4e8d23607a5786f7e7290f30afaae3bbae0d3784a41bfbd", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209702, "uuid": "bde59430-c572-4834-bb53-6e4470cd2767", "comment": "Malware payload", "value": "db969a6149e6e7346c18f56430b6d12fffc5ffc8", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209702, "uuid": "d45d7d06-c06b-45d8-8edf-7f8d44806808", "comment": "Malware payload", "value": "3c6f891d2d1e101261a04c7b2f5b74751dd8266294341ded00ad4993b2ddf9f1f86337b4c322e228f43dff3de081f95b", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209702, "uuid": "8f2eebb1-456f-45b0-a9fa-d9021e167293", "value": "T1F10523182F188D34199E07632AAE2D5E3A528CC1C5DF90FF60F175DB213E95D468BEB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209702, "uuid": "54cd43c1-bd92-4aa3-93c3-4124c5818b37", "value": "12288:+73GOdabXoA27IkrwQql0tfCal/ApRt9IGase9CIZZl7X6bfEogvSeOxjKWE0:+7uXG7qQJFC93gzCSIfRU6+Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209702, "uuid": "b58eff92-6378-4c16-a4bd-58983d386c33", "value": 811460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209702, "uuid": "ce8b5b3b-6505-4f54-8ad1-c8633937c339", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209702, "uuid": "9ee3f8a8-6ab5-423c-91a5-9c5888a71796", "value": "hola.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d2a8ab-3db7-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664209257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209257, "uuid": "1629ad65-5a7d-43e4-9032-417f7be3a56d", "comment": "Malware payload (AgentTesla)", "value": "fa4b3bedfeaa2afb11d8e10df2b13464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209257, "uuid": "53de8374-83ae-4971-8344-af21436bc6db", "comment": "Malware payload (AgentTesla)", "value": "d31cf84c72885dd1108abe0ad6a88776d4650ffc073556a334b8c4fba98376c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209257, "uuid": "b557c7f8-e26b-46a4-9cae-a0b5ca93ae86", "comment": "Malware payload (AgentTesla)", "value": "5cba78d33669dfed8fb15c9fbe3ef131e304fa27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209257, "uuid": "8125a4ae-b910-49dc-b96b-2f243270e145", "comment": "Malware payload (AgentTesla)", "value": "4331402e3f39fd220251f08b69ee942c4b9f628e2757897d36bbf44d63dcdc16aac4b535363ac09bb3c2b4c45ea17c49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209257, "uuid": "5a0c200d-59db-4737-aa4c-4ad157aa86db", "value": "T140E412163F980350C1BEF37740C5A96127F2E3CB5A19CBDE2D8E61AE37227C2AB05555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209257, "uuid": "0ca5df2c-7ee9-477d-9d8c-9aa6cb31f5a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209257, "uuid": "25cd082f-85ea-449e-8899-fcf3f020bb6c", "value": "6144:uHc7foqMtH3visHHAH188II+M3gW6g3PAo4MfuPkla2Kgfy4E/bl4Q9atpQNu5I7:oc7fqpHHHAH1FIIdEMrWPkXKSyOw3ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209257, "uuid": "3df864be-780f-47e1-a6ba-e53f78d73333", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209257, "uuid": "64f00b90-c744-4540-b08e-9f2c710f1dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209257, "uuid": "7cc647f6-8e7e-41dd-99a1-f360523bd1c6", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.25.5.22492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c485ab4b-3dcf-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664219808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219808, "uuid": "2a33f819-a09b-4709-8693-68545440b721", "comment": "Malware payload (Smoke Loader)", "value": "aaad2400aaa4544edf9ea75c189a3c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219808, "uuid": "1ed79d71-92bf-49b9-af4f-5404424f500c", "comment": "Malware payload (Smoke Loader)", "value": "d3a12feea2622c04f5b6e8dc9619aef38e1937ffbc998daba56eae0fb299b0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219808, "uuid": "a912b922-bcf2-452f-b86f-270d99fa45bf", "comment": "Malware payload (Smoke Loader)", "value": "bdc023a1fcbe414c255e855832c3a68c1f6bb9f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664219808, "uuid": "7f5329ff-7c6b-45b0-a227-eb0ba8ccf2a7", "comment": "Malware payload (Smoke Loader)", "value": "697de063e766ab275c253b3bd937af027337cbbbd5686a4609d28dcb6bc5b20238debdd18e3c07a2dd5aae8d9bf6181a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219808, "uuid": "188a4bb0-5887-4aa6-b9bd-26ea45f7fb8a", "value": "T11AD3E1207C51D033C42298B51570D690AA7B79725DB98A877B982EBF2F702D3673A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219808, "uuid": "70752a7e-0694-4ced-9c24-2c793bcb4989", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219808, "uuid": "4e1a4c30-4381-4a00-9eed-a5d752a46c9c", "value": "3072:tgp0T55r4KL8Tliv7ZLmBj+j9GSjyneRqdhvU5B:yO4QuW7Us5GYRsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664219808, "uuid": "c532b9dd-f19f-4ca2-9e8d-0e580b7e3e77", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664219808, "uuid": "03fe322a-5a5e-49dc-9ea0-671c7fdb6745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664219808, "uuid": "65a4a372-1a55-41a8-9e4c-c12b595d8f11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a146585-3dbe-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664212328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212328, "uuid": "900cc8fb-5caa-488f-aef8-4b4335728214", "comment": "Malware payload (GCleaner)", "value": "28662d90901f77ef1f7563d06527dc37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212328, "uuid": "1bc3d9ca-c8f1-4644-b6ff-7c7ecf9edaab", "comment": "Malware payload (GCleaner)", "value": "d3ba77deb12b2efd2fdc93eb6dd789727f49f4a3fac3cbb74d22fa1142413de2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212328, "uuid": "ae73eafa-5153-4a8d-86c6-a709b19bb766", "comment": "Malware payload (GCleaner)", "value": "117347353515109e8dbe5e5cba0ffa46868be388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212328, "uuid": "f6fa8906-0c74-4d40-ac17-a13b4d2a644a", "comment": "Malware payload (GCleaner)", "value": "cd1018ba17273f9256f39358ba3e4416873f6f05d337aa8a3f3d30e3aea12f2a7b40bb23228a7f0c8253165d7c201143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212328, "uuid": "04b72e2f-61f8-4962-941b-feb26b4eaa90", "value": "T17B2401767C905433C86B37B04872D645AEFFE9522502484BF7F8625A8F32AC15B3939B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212328, "uuid": "3083b82e-bb8c-4aff-9caa-f2e0a215a0b0", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212328, "uuid": "73101df4-1908-4e05-80a7-94fd1e5fd121", "value": "3072:yH7OKAxTc5iirR3rsjIy5hwldTDooUjX/uxYYGhGhJNSVhtGNhc9Zht+5B:IFFAcybwlJUoUjX/UIhk+ht6c9Zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212328, "uuid": "fb1c170f-3466-4426-9613-b4cc43318ac1", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212328, "uuid": "084e429c-d61f-4907-a27e-e2590beb0dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212328, "uuid": "f47dde46-0935-4d60-b25c-b2db0f745572", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f0b3c5-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664180996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180996, "uuid": "f48410b2-84a6-43c2-b189-eadc4899944d", "comment": "Malware payload", "value": "0b198a9c8626d3da97de738ed3b11152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180996, "uuid": "3d3bfd24-e62f-4018-9d41-461283e8cbf7", "comment": "Malware payload", "value": "d46e663968823798523ece2e0feaeb7d466a1eb1fb579eba4df2fa1d2bf3f734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180996, "uuid": "a9067a0a-a058-4c54-96be-0fb4e5f4ccb1", "comment": "Malware payload", "value": "75d31ade268e71c9b007c521d5b46b3f411f3ed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180996, "uuid": "063b71bb-657e-4430-bad7-213e518d3e5d", "comment": "Malware payload", "value": "fd9230fc0aee456822b3862a68e67c1af8ab54027a44c186761c33a0a306b625e9944d8ed6c6407928c569a0d421b049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180996, "uuid": "49f254fa-94cb-4252-94d8-e475ac276fd6", "value": "T197C43A103568ABA5FAB1C7F428A9225093FC3A0971EED36C1C9794F4B161F6785D0E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180996, "uuid": "61c9e91a-1a22-40ce-a6b5-c7cdce639941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180996, "uuid": "6d50f663-57a1-46c3-9d8e-5378e252dd4d", "value": "6144:8mNShJFAFanl5ekTOmc+kLWe2Ick3aMc7KLStLtEV8LobS6Hz2XPPnH84nY4cSYp:d65ekT3Tszck3aMc7OALo7HUNY+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180996, "uuid": "47361a9c-edc0-4e06-8c6d-2786cc17acca", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180996, "uuid": "02c80092-22b7-4ae4-92db-2abbf5e3587b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180996, "uuid": "e8f29523-23a7-4485-89eb-cd9676d83668", "value": "0b198a9c8626d3da97de738ed3b11152.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e74c63-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214686, "uuid": "03a051f8-8503-4d62-b2c4-5abbe6d4bad3", "comment": "Malware payload (IcedID)", "value": "b77224a6c9eb4987077d0f7ec33af582", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214686, "uuid": "2243e52f-692b-46a4-ae79-05d5659d9f44", "comment": "Malware payload (IcedID)", "value": "d47334b943e152eef809da3d651880e1821749ad9ba2b2e08c9fd5a2db4a8e1c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214686, "uuid": "275cb5cc-23d5-47ee-b290-45de8a12ae7d", "comment": "Malware payload (IcedID)", "value": "311d8d1dfc90096ccd26db3922fe03fa3c0ced85", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214686, "uuid": "7821f956-057a-46eb-b917-1e7e7d104fe0", "comment": "Malware payload (IcedID)", "value": "96ed5c3b7de482593b15d445df62584d31973b7c72d0b6de847daf4afa3c14f0f92c746d2f92f3772a19483b01f0266a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214686, "uuid": "70b0e9e2-8d23-4f3f-9b6b-55007c7f6378", "value": "T1B315F101CF44606BF00B693E371365D7B8A61C27708BDE1A6B82612E2AD7F60FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214686, "uuid": "6cc0cac4-92b7-45f1-aa7b-557e6627c2c2", "value": "12288:nGOVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEOesyErljCREMJyc5RU:nVV2jUeQRI5wPN/8krleREMJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214686, "uuid": "d4631eca-847d-4230-bef0-88727d78b037", "value": 888327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214686, "uuid": "9657081c-7a1c-45be-82e3-f2485e1917cc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214686, "uuid": "f06f5c62-7c5f-4e2a-a70e-63f239e02948", "value": "kingwoodcable-invoice-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51979a6-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213876, "uuid": "17b97f00-ab7f-474b-805d-b8f9ba263031", "comment": "Malware payload (IcedID)", "value": "d29f1882131edc851ed1705c0c7b110e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213876, "uuid": "1f307257-c7da-4b69-92d0-d0a86ff9a4d9", "comment": "Malware payload (IcedID)", "value": "d50af70fb63188c270ec67734bc1c9de8a4120ca5088c242fbb20123f98adfdd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213876, "uuid": "4b4cac44-2889-47d3-b918-1105b24fba79", "comment": "Malware payload (IcedID)", "value": "7f1323fb2a5539a9021401023bcc86db2dfee3d8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213876, "uuid": "e681be08-91cd-43f8-a669-970bae511d07", "comment": "Malware payload (IcedID)", "value": "570ae867b085f4cc5045d20981cbcc41e7b4be1cc0eaa197987c0b494b1ac06605781ad7ceba1e47fa482817f4cdb9df", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213876, "uuid": "e0e1cac6-5fdb-4fce-ac3f-7ff5ab9736a9", "value": "T16115F105CF50206BF00B693E371365D7B8661C2B308BDE1A6B96512E29D7F60FC3AD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213876, "uuid": "fe8cdccc-2cee-4041-8a74-0a21251da0e8", "value": "12288:GVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DET90MD6c1A4Vwp:GV2jUeQRI5wPN/y90MVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213876, "uuid": "c0b4d7aa-cf2a-424b-8088-33aec6928be7", "value": 887995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213876, "uuid": "5cb2e92b-b86c-4f07-96d8-ec84bb6dead8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213876, "uuid": "ae56c337-ce30-4825-8623-59c61cfb2ad4", "value": "lisawolfhomes-file-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d45d7c-3d6d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664177500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177500, "uuid": "ad6b5a24-db3d-466d-b901-3f836e0228ad", "comment": "Malware payload (AgentTesla)", "value": "36aa551fc4611e23e5c1275c5ec9f988", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177500, "uuid": "5ac8fc57-9813-45b8-97fd-9eddf529734b", "comment": "Malware payload (AgentTesla)", "value": "d5af77fbabd67255d4d1f3e31f0379496c8dd2401198f663e9dc25c64851d5e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177500, "uuid": "2c757653-d79b-4df9-8402-e6294f94c043", "comment": "Malware payload (AgentTesla)", "value": "400e144c8a2593e336a7854e1a43e767dbbe53ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664177500, "uuid": "a54496c5-22c4-4671-9005-a490f5bc801f", "comment": "Malware payload (AgentTesla)", "value": "140ec598733a64e64691655c57abfb794680e099ba9544fcbd9cee55cd04dc2d5b379f5e24f2bb62390a5673b4454110", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177500, "uuid": "59ad0707-d283-4dfa-a271-62bfd8d10f82", "value": "T1D2636803F19EC35DEA688AB1313E4270D188EF2B59109AD6F8DAFD3F457A08D1B552E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177500, "uuid": "2ac77163-5e79-4cd8-a1ad-e7bb2b80e90e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177500, "uuid": "42d41ad5-ff3d-48d8-92a6-fd27ebcafbda", "value": "384:TYkxJRTDeUzpNGkrdwTXCZB9i3oN6anxOPz0GwJ3TDCYt/9QylTi:TfxJVyUfi3yLDTVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664177500, "uuid": "de97969d-f3a0-43f4-8ce7-baac38c13ebf", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664177500, "uuid": "b2dc718d-542e-4046-9982-6cf77e06fab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664177500, "uuid": "59680c8b-920e-4218-89a2-f931122021ba", "value": "Factura pagada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dffce9-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173243, "uuid": "d6f04bde-f665-4f5a-8ba7-ab1c41de02e0", "comment": "Malware payload (Mirai)", "value": "600adb3a743372193da0925922a398d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173243, "uuid": "e5883135-25aa-4f63-978c-0746e201689d", "comment": "Malware payload (Mirai)", "value": "d668a0e6ef1fcf871d749c561b566c90ceff28bd33bce0538487a63810a9b6e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173243, "uuid": "bd2d213d-741a-4f89-85ec-5e98ae6a27bc", "comment": "Malware payload (Mirai)", "value": "c6f08ca356f9425a8824b36f511e0b54a710c85c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173243, "uuid": "d1e7bacf-bda8-4bcb-8874-b89f5b50d2f6", "comment": "Malware payload (Mirai)", "value": "bb507817a59b9d9cd5e65597acb7f4afec64fd08e8796793f16162fd0dc3d3decf3f69003d7462670907f7b640327732", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173243, "uuid": "a765ae07-da0b-435d-822f-0a649bf9d847", "value": "T11653D616FF904FEBE85BCD3305AC8701399D685612B87B357A30C969F25E68F12E3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173243, "uuid": "75488d1b-f0b5-4ba8-a800-2fdbf3a7d27e", "value": "1536:ozcXv+9ccTWDlLAjjgp3LaODXwZYwVg04BQYs:owXv+9cNbDAEWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173243, "uuid": "c43bee19-242c-4a87-ab32-78f66ad6bc2e", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173243, "uuid": "f8a05cfe-85a2-4bbe-b2dc-8664371db217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173243, "uuid": "f80e2ab5-c6b0-494e-88c8-b1779c614a52", "value": "600adb3a743372193da0925922a398d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf055cd-3db7-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664209514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209514, "uuid": "bb2471ac-8cd4-4f57-8f75-6d26250ed888", "comment": "Malware payload (ArkeiStealer)", "value": "9d1aa9f2c28fe50874c630f3cf158615", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209514, "uuid": "ca8a206b-3308-4382-8120-28f48cddd21d", "comment": "Malware payload (ArkeiStealer)", "value": "d74e35ce1229ef0e134937caa01fd67a8fdf3fd0c7a85762090b10631fb526b7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209514, "uuid": "2c58f8e4-0532-42ee-8a0e-3bf85a39f4d7", "comment": "Malware payload (ArkeiStealer)", "value": "e065542754f33e6257b5f0510074ac862251d250", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209514, "uuid": "830509a6-0b4f-45be-9283-a0e68e8cbf82", "comment": "Malware payload (ArkeiStealer)", "value": "4b83382d0c25e3836c9a3a7c0fd1e454474142e888cd95119606260ccdad5a8bc4fc87cae90aa803bfbd4f32ea3c25f8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209514, "uuid": "1b3e8baf-20b7-47f1-aafa-065c0f9ce3ee", "value": "T16536233711652049D0D88D3A8533FDF272F627774E82ACB5B9C939CB2A721E5A313993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209514, "uuid": "53f483b2-a4da-4667-8486-71729eb0d432", "value": "fd3258e57d13ede5b09dbec9a353bbbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209514, "uuid": "6700f01a-bb7f-4b7f-9c5d-ccdafa0b3f38", "value": "98304:WZR4x+HvkIYSRdAAmQDBMBTvu53ev0rs3FQsaJZAdiohNb2nws:CKx+HvqSRa3BKVr8Qvz+i4Nb8ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209514, "uuid": "b7720011-04a9-4a73-9b1b-5f80c884e492", "value": 4952912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209514, "uuid": "caa35995-34a3-48c8-8d11-7d5134bdc69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209514, "uuid": "57a82865-8340-46a7-bd43-b5aeba869271", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942c4f9c-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664180213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180213, "uuid": "a5105554-e12b-4503-8e49-3b5bb4206044", "comment": "Malware payload (AgentTesla)", "value": "8a32017e36960f365076023db2432821", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180213, "uuid": "43451fb4-7cd4-4d7d-b75e-2fa6d4427a3a", "comment": "Malware payload (AgentTesla)", "value": "d7f913d0c42823a04e980b79d3a2d59cb7f3e5010ab76be3deff721ceaa6be18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180213, "uuid": "320ad4ab-ae1d-4e7c-b19f-24fc6f631d1e", "comment": "Malware payload (AgentTesla)", "value": "a7baf8eb36dad4c6c8ab1ed7beeca6502ec75ebb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180213, "uuid": "ebde0bf0-8d56-4998-8824-64ef9df8a486", "comment": "Malware payload (AgentTesla)", "value": "7f625104f77da1af882dad30e42ea378c5a2136f138a2143cd88ac1c74649cd78c92bafbd25ce87fe92f602482ef2190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180213, "uuid": "5151a792-5a4d-4a2b-8399-cd8fedff033d", "value": "T192563392B2441CE6F97B923948D2421DE6B1782043A4D20F57E06B7B1F677E13E3BB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180213, "uuid": "1cbf500e-8a6f-4bd6-9a89-2b63c4507b58", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180213, "uuid": "6e78e9bf-eaf5-4489-afcf-504ee83b7614", "value": "196608:gx6dQmRrdA6lakaqdVTmRR0Df5lG7Knn:FdQOlawdIRRK5s8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180213, "uuid": "88bb7f36-e4c5-42ab-a408-84d8a4fd5f51", "value": 6464678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180213, "uuid": "cc9c117b-3c79-4fc8-84b7-a3bc8a4e0228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180213, "uuid": "a9063c9e-b62d-4c5d-9bed-9fe212ab5a48", "value": "8a32017e36960f365076023db2432821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e57235-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664171220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171220, "uuid": "a76f13ad-4994-47b2-a662-35eb8c1c3e5d", "comment": "Malware payload (AgentTesla)", "value": "c1e5a1a648d47169eff728c8275a1622", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171220, "uuid": "22d4795b-4c56-4bdd-88d6-e0d8c9f4c417", "comment": "Malware payload (AgentTesla)", "value": "d857d8cc3482be343baaa378bffe44d2870811ddc65e8441c0d5b0e258fb44c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171220, "uuid": "5d807c54-bd6a-4b2b-b4a4-a97e47302528", "comment": "Malware payload (AgentTesla)", "value": "913b7e572ae0119cd30971d2fb1833904b04cbdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171220, "uuid": "9d99aa54-5371-4eee-b04a-ef80b9a4e05b", "comment": "Malware payload (AgentTesla)", "value": "86cf22b484f29760b7d40fcab03b3b4d83185a35d2af9daddda8705d3b7740d700460e5d2da2796575b4a899f26840c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171220, "uuid": "370a3795-11e6-4aec-93d6-5b9bc6ca6007", "value": "T16E25F1331BEA8B0BD1167678D5D1D6F6A7ADDC00F467C29B67CAAC1FF08A461DA60310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171220, "uuid": "c503e018-5450-47f9-88ef-914163c3d6e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171220, "uuid": "b13b8fda-5b23-492a-834e-496e97f3200f", "value": "12288:76o3HEaY1DV3SyPTWNUHhutRdkkfjvc1BzCcb8/8+lPlYROaIA/cuMPlfgTbuiQZ:BHF8t6N+CdfjvczPI8+HYJEJPl4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171220, "uuid": "7d090644-813c-4538-b83a-e3f40f79813f", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171220, "uuid": "be6db087-bf34-4dd7-ab77-aa57b9ebb5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171220, "uuid": "69784dac-94f8-4d54-853b-40fadbe2f154", "value": "SecuriteInfo.com.Win32.RATX-gen.10914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b72a313-3d4e-11ed-9266-42010a9c0072", "comment": "Malware payload (Joker)", "timestamp": 1664164280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "a28f51e3-a1c7-4746-838c-05498da7326e", "comment": "Malware payload (Joker)", "value": "e64eb87a1a5f0a4e08311799c89845c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Coop", "colour": "#BA6E2E", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "d48d2713-a1f7-4ef6-89b5-e1c8ce60df72", "comment": "Malware payload (Joker)", "value": "d8c04583ad8c552a91197d639f8aa2726e7dd1269c0633968c4bc7fe34ebd39d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Coop", "colour": "#BA6E2E", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "018b84a8-6890-4030-ad15-c1488087c1e4", "comment": "Malware payload (Joker)", "value": "ca7447547322836464162c89bbce11471da0dfb6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Coop", "colour": "#BA6E2E", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "da73a50a-194d-460f-9d86-4e553b1d4b38", "comment": "Malware payload (Joker)", "value": "8977e6953e315fb55514c13228f66ccf897c9e072d2674a2a8e02f012958eb13a98139af8396a66282a70d598fd4fc68", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Coop", "colour": "#BA6E2E", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164280, "uuid": "d3981189-4759-4090-8b64-aeae0bf2d4be", "value": "T1EF273391E33DD92AE53785329FB7013729760D895052EB261798F62C2ABBE446FC0FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164280, "uuid": "63ef69cd-61d4-4c5d-b2b3-c4f1145bb899", "value": "393216:vaQpsFFnyUYK+IsyTYxoCYRx3e+/gLo0LHnqytYGqjMorCY97gHts2Wx9u+U438:vMnGbIaxF25eYmnHqgYGAneHa22Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664164280, "uuid": "8ae9c12b-71b3-4a41-8b68-a2ac682880b6", "value": 22332806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664164280, "uuid": "a779d226-a6cd-4f3a-9eea-0da983787b67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164280, "uuid": "c1a149c3-3cbb-4723-9693-37151ce3bf2e", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51f45ee-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214682, "uuid": "85caeb82-62b7-450d-a3f9-643ac0fc696a", "comment": "Malware payload (IcedID)", "value": "8800ebee81ecaac20cd1a31d9b8ab872", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214682, "uuid": "f7b0ba85-f4f6-45f5-a706-88b432515c0f", "comment": "Malware payload (IcedID)", "value": "da08cc0f50eedb128dcd8027450329fc5f8f51c81aa24d86c79789d278918f78", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214682, "uuid": "987550ad-b6a6-4476-8a7c-5587bd16d585", "comment": "Malware payload (IcedID)", "value": "c163d993c1d6c1fe9b158dee3a6ed9662f6c4bf2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214682, "uuid": "e7347d48-caa0-4d53-89e0-87673088926b", "comment": "Malware payload (IcedID)", "value": "6f18e8f17e1bca78e23893489b1d76aa97997e3cd6e2f5e52df9ff2728f38c6533e464cbd917569f03e7933901d2c216", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214682, "uuid": "6988dbb3-6695-450d-8caa-8494ee15dd3e", "value": "T18A15F105CF10246BF00B693E371369D7A9621C2B308BDE1E6B96512E1AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214682, "uuid": "83903efd-0fd6-41ff-8494-ea9565c9856e", "value": "12288:h5VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEMHNx0Szvk9V6dUM:h5V2jUeQRI5wPN/NH3zM9VS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214682, "uuid": "9013fce8-33ab-4b93-96e6-68a9b28d1f9e", "value": 887075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214682, "uuid": "586355a4-05b5-44ee-8279-9527a672e632", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214682, "uuid": "0231a7c2-e787-4f95-ab64-e488f81b04c9", "value": "kingwoodcable,file,09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e785a13-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215878, "uuid": "67dbd58f-e023-4774-bf85-c9fa61b8978a", "comment": "Malware payload (IcedID)", "value": "4f4c0eef484c7b982f5dcd1f736fafd2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215878, "uuid": "b21027a5-0471-4f91-948b-a7e37b2ba7e2", "comment": "Malware payload (IcedID)", "value": "da53ec50385bd308bdae8095edde4f87b59f490ee31c91eecaeebf045a299747", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215878, "uuid": "baa333fe-24c8-4f27-8f18-7fe3dbcf1718", "comment": "Malware payload (IcedID)", "value": "70aa3ae957e438620a7ce8e7e44ea3bd78951696", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215878, "uuid": "9e284363-cd35-4967-9251-ec15b0dc4950", "comment": "Malware payload (IcedID)", "value": "dff78cea919933bd8d1576f9b0d751a76691afe5ff7ec0ce160973c7bde2bc58ccf55d2af2c5d780e09d338a10b9e4eb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215878, "uuid": "eafc24af-28c1-4434-b36e-fba1105aa44c", "value": "T1C315F101CF04616BF00B693E371765D7A8A61C2B308BDE0A6B97512E29C7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215878, "uuid": "a59923ef-4a48-404f-a366-f01f3c305261", "value": "12288:CpXVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEeGAkz5W6dg2oT:CpXV2jUeQRI5wPN/1D45W6SZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215878, "uuid": "f2744a25-e7d1-46bf-854a-5d8ee4b47382", "value": 887071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215878, "uuid": "42f31f50-dc19-474e-9329-ab1fa3974198", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215878, "uuid": "7b5ba3e9-2c97-4b65-b598-3ee17d389481", "value": "mytheatreacademy,doc,09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81d9990-3d50-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664165295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165295, "uuid": "0841f89c-a19e-4734-b06b-01e6b284a41f", "comment": "Malware payload (GCleaner)", "value": "d83dad45b7bd7914a3d18350870f47aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165295, "uuid": "9e517b1c-baa6-4ed9-a2d1-71538a987978", "comment": "Malware payload (GCleaner)", "value": "daac630b1ac677b0f411b02293a4fa618383beb61a15a51944a9ab7fb137843c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165295, "uuid": "031c4f18-edcf-458a-bf95-5e5269d5c4a2", "comment": "Malware payload (GCleaner)", "value": "81c9df67e348947360386d34db7125012cfb800e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165295, "uuid": "8179068e-0015-4258-ab64-8d0fe5ddbd38", "comment": "Malware payload (GCleaner)", "value": "3b3fe1394368460418bd384e50465f54cd639549de4940bf370f7c1bf4f7fe036fd510c6108c82eb4b53aa0569e6de4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165295, "uuid": "7ff22744-7727-41e7-8ea2-03547bf903ab", "value": "T14434F1917E94EC32D86871718436D6E076BEB8510126AA077BB46E5FBE327D02B343D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165295, "uuid": "4d169f87-5d56-4523-96f7-882b4f46f276", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165295, "uuid": "ab6cd3d0-493e-4d83-b45d-45b28517d1c3", "value": "3072:0XS1G55OadCSb8E8cC88sK/Oc+PwZyWdQZ0NmoSS4eg8AM97LxzWBUKrx/gDRBz0:fasqvnDK2ZPwla0bSS9jlme7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165295, "uuid": "18c20b7e-2859-491f-93c8-21349ad8631a", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165295, "uuid": "cb47a102-1f2c-429f-9ec7-a4fb20b810f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165295, "uuid": "ed6666c7-efa6-4696-86c5-935002be9bd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d0be3a-3da9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664203187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203187, "uuid": "98979a16-ed27-4231-af48-a8172a5b53b4", "comment": "Malware payload", "value": "ef698f791f9dcdb2d11a7f04590596bb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203187, "uuid": "7ab9b168-e95f-41df-9421-b5bc7e95df5a", "comment": "Malware payload", "value": "db4fbd5875ef6fb4773d0ba873b6f39f7c385d089ebe2177ab9678523f09ebd9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203187, "uuid": "22e10ace-0311-4317-aa06-449ff82cbf85", "comment": "Malware payload", "value": "fcc34efe1848de6efd5d720b75963084293a768e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203187, "uuid": "6a7c4ede-ad51-44a6-a99c-61d3fdb743b8", "comment": "Malware payload", "value": "8d9b7e53c6374cbbb179646ce04f55bac2858ba3fc302e7a3f0ae4d9613464f67a1f79dba24a9b49206d65630df2cefa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203187, "uuid": "23b8a54b-4fbc-477e-825f-c47096a09fa2", "value": "T1C7F2F26B596D23BA6A1A43D2C398F7DC0A236AC44F36409DDDC1D61CACF208DDF16E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203187, "uuid": "f070fa46-4498-4a89-b902-2cfb38631600", "value": "768:qqdgC06dykkptgDriddSG8xsYpo+isJKusblgaa0xL:q2x0oymoSG8xswo+nJKusbaqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203187, "uuid": "64f251b3-2ed5-47e5-9d6e-a582ff793cf4", "value": 34543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203187, "uuid": "1ef06df4-8cee-414e-9ba2-b4c9f6305eea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203187, "uuid": "5938721f-cb41-4713-8190-eff1d484ef13", "value": "attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2dc746a-3d69-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1664175996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175996, "uuid": "6de2168b-f90e-4273-97ae-0892ab29ebaa", "comment": "Malware payload (NanoCore)", "value": "89197e451346ed5a3ba154f394948de7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175996, "uuid": "b1bde83b-694c-4e1f-ab63-39fd4ba281cd", "comment": "Malware payload (NanoCore)", "value": "dbab1bf30e571bddf1c21a19bedebffd5a348145ea76abddc34a5172df49aa3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175996, "uuid": "cb213abb-7dea-4dc1-9a2b-8f326c9539cb", "comment": "Malware payload (NanoCore)", "value": "0e9d39ec84881ca095a9c1400d64ec586e983402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175996, "uuid": "fe544dab-f26a-4367-a73e-bbbfde86d054", "comment": "Malware payload (NanoCore)", "value": "90d3df18de8c81651cff3fed02634cf71e3bc539defe6f9812b3f0a575db0d9ae5da5e6a724655621a8598cc16963b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175996, "uuid": "ff08dafb-59ba-400e-b7b1-d1693346321c", "value": "T1F125195831E6329EF46BC6B58FD87CF59A56F632431F5177607302898B2ED82CE90872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175996, "uuid": "2882e56b-fe2e-408e-af06-b4cfeaaecee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175996, "uuid": "7f1d8799-1913-45f6-b1b5-b6c84f2f9e63", "value": "12288:kgqC2JPYZVj5taS55PO88JplF4HwjADqjJ5ndW+/Pi7gvkdCOVy/0BA+l6lhIiob:kg52p4J5tz688j4HojrIaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175996, "uuid": "dbd190d9-8e5c-42a7-9887-be5aefca33ed", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175996, "uuid": "ea172ac9-e321-4db0-9666-157420e20511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175996, "uuid": "e4a74ec0-c47a-47e8-a169-680fdc6123a1", "value": "Jens Frodesen CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc92435-3d87-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664188950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188950, "uuid": "78b77ead-ae15-46cc-b39a-65c24a353139", "comment": "Malware payload", "value": "2e7cabd257024e15cc992960ce73a55b", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188950, "uuid": "ddcc3789-8a93-41db-b402-0f3cbfc8f99d", "comment": "Malware payload", "value": "dcbc485f71a0e60920a99bcb8b57c56fc58fcf100707fcbdb8c05b56431374ca", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188950, "uuid": "0821d459-f983-4376-b4c7-c3762971a9ed", "comment": "Malware payload", "value": "b9f5310746779c9e57dac2c5163c7a091f909817", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664188950, "uuid": "9ffacdd6-4eea-4c08-b2a4-abed8d40fa58", "comment": "Malware payload", "value": "dddc940cab8e603cfbb0c773febd49c8c0e8a5a0fe08ac8e4f0574581966aad97f5dece4a2310c6aafccecbae8eccc5b", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188950, "uuid": "6c61bf0f-3585-4d75-aa73-d8957ee904ea", "value": "T194E2F1068BDC5818ABE768DB5327D85B8A2D3E0C7B70FEF61C95727711005CA3C7226A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188950, "uuid": "b68a8888-ab40-4b7a-bfb2-368e86ee6801", "value": "768:Qg73eDw1Yc5h3tCM9oAE0lCxEfos+tKWPjfOMk90973hPFgJuicjPNG:Qg7n30UoWfo7KifTZ8u1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664188950, "uuid": "4785e6de-ed31-4f3e-9639-bc5523451484", "value": 31780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664188950, "uuid": "a84ccdd5-8a51-4b20-8e59-09e306ba60a0", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664188950, "uuid": "2eb0226b-6f8e-494e-aac0-1803923ef4a4", "value": "DSC0001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5cee71-3d75-11ed-9266-42010a9c0072", "comment": "Malware payload (StormKitty)", "timestamp": 1664180868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180868, "uuid": "499d558a-71b7-4d18-bfa1-3a248b601cdf", "comment": "Malware payload (StormKitty)", "value": "d11c83b988df04a4c28f9d13f541e62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180868, "uuid": "10bcf7be-1d5b-416a-8a23-90479b5a0d6e", "comment": "Malware payload (StormKitty)", "value": "dda40af7e530bf5744b1ae2219bcf10b8457f18c6a8ef39e9423badaf30beec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180868, "uuid": "7c15863b-1924-47c6-aa4a-87646c098312", "comment": "Malware payload (StormKitty)", "value": "a078c177c1defb15aabd2a36b13b8894cda439f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180868, "uuid": "78726887-b956-4d1f-8a8f-a9178425978e", "comment": "Malware payload (StormKitty)", "value": "898eef9033ef80da91c02fe7ae1bb686c6b0348edd069cd26d5453dcfa7bb4659e56dec63cda1e3aa9f1a489c8742dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180868, "uuid": "0985d66a-b9ac-4921-b49b-f87460b96485", "value": "T12A45C091068CADC7D0533A705C72DEF1066EEEE46221C10A3BC77F2FF473A662666949", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180868, "uuid": "2d575483-9046-498f-8724-905fc576199d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180868, "uuid": "097a6b5d-f569-4ec7-bbb4-47d1a1b2e32a", "value": "12288:mVqvrjjHby/Wuw2YJ5RH/KTuowkP4Ylib+vektHuxqilKlFL4JEgm3FyEgUiGa:1v7aYVCwkQd+xtOxxE6ENFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180868, "uuid": "b5b1548c-0a7a-4b70-b4ca-25e6ebef775b", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180868, "uuid": "255daf51-8fd6-4bc8-92de-ed8d295226d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180868, "uuid": "407420ad-7c9b-4c39-b35a-902ceeebba9c", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bac4f9-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215882, "uuid": "4ea49406-ba4c-4887-a052-14b7533f0fa6", "comment": "Malware payload (IcedID)", "value": "2262368ac0d2d1084577522f4c27e090", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215882, "uuid": "64906936-393f-44a4-9ee1-c49f0236faf6", "comment": "Malware payload (IcedID)", "value": "de2d8a887e2d5950f27287c587e0895a52774aad7e61f472be74ddfe44ea5d71", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215882, "uuid": "a7c04c45-6c5a-43e4-b1fa-cb5111bc6c66", "comment": "Malware payload (IcedID)", "value": "b4dc2c60e1b3e717293d90e66f4f3497e825cc47", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215882, "uuid": "fe4616d2-8390-404f-b05c-0253c835ef82", "comment": "Malware payload (IcedID)", "value": "1fa582c6bc4f3c059cc6f950d24948b033c68a5bfdfb7739888b43e4fedf02ce574df89eef11ff43741248c8c7285fb1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215882, "uuid": "33ecf473-e048-490c-9e9d-a9eb79a7e74b", "value": "T10E15F101CF14606BF00B683E371765C7E9660C27708BDE0AAB96512E29D7FA0FD39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215882, "uuid": "dddf0624-812c-41c4-90b7-11ce2dc70f33", "value": "12288:GGVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEeE4gb9oLU9gi6dEoK:/V2jUeQRI5wPN/qZb9oLZi6xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215882, "uuid": "2fe0a2c4-89db-4d10-9606-0586f995d243", "value": 886850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215882, "uuid": "405cefb7-09fa-48a3-8131-d49f4ee52be1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215882, "uuid": "f15d76a6-a476-4a5e-b832-a02729bdd183", "value": "nicewines.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992c1dce-3d95-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664194824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194824, "uuid": "134145b7-8786-497c-8681-2775acccc11b", "comment": "Malware payload (Stop)", "value": "382a71335db7126dc85f63f0f158d35a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194824, "uuid": "990a0482-3842-4064-a74d-160b7d13324d", "comment": "Malware payload (Stop)", "value": "de417fda4f409c9c55f491457fc0c60a628ba892d225c8963d7d77affcf7cd3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194824, "uuid": "0ef2c2f0-07fa-4149-b1eb-8f16e504276f", "comment": "Malware payload (Stop)", "value": "b3b8e0d56094fe3ce416ef44710ab0fe63a7bc8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664194824, "uuid": "2421a25e-82cb-4467-8b5e-b3cf6e6cadbd", "comment": "Malware payload (Stop)", "value": "3a00f879d7317978aaf16446c8339812d50957c53569b3ba9e39cd34bc025b6acd75c18527064003197769bdc7799338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194824, "uuid": "6e2fc0c0-309a-4d6d-89d8-b8e6b297cdf4", "value": "T1DCE42300BA45C832C21A19745C3A92E1EBBD2B2319781E8373987F3F5A765D1BE7D718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194824, "uuid": "469a71d3-0f4c-43f9-9c46-5f4a62d61b8e", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194824, "uuid": "934e52d6-05f1-47f1-a629-3fa050c53d76", "value": "12288:eIeztATb0LMntQk6lOwKRtnMJnlue8LzzpF1jQ3:reRK0UXw4Inlx8f1jQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664194824, "uuid": "181c0272-9640-4679-bf62-69ef254ef837", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664194824, "uuid": "b52b333f-c32d-4392-ac77-f15b7709b076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664194824, "uuid": "5de1f1a8-e953-4632-b725-f2cdffb82f5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e22fd15-3d76-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664181330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181330, "uuid": "f540a322-1f71-43ce-b88f-da52e5128302", "comment": "Malware payload (RecordBreaker)", "value": "7f5b7b10764553a0c2a36dad6b39181b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181330, "uuid": "dd454a73-13e7-4055-9c1c-fd0b7fe57d93", "comment": "Malware payload (RecordBreaker)", "value": "debcf6875b244e45fe0c79c6e076af1994b09426048c22118791df5fb466a949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181330, "uuid": "8a4031c3-8044-491b-9db0-28dff5692dca", "comment": "Malware payload (RecordBreaker)", "value": "d41500ea386109f56c4aa7f7694ec9edf64ebb1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181330, "uuid": "56217c8f-21e6-40fc-9ef6-2473f267790d", "comment": "Malware payload (RecordBreaker)", "value": "1b0a4e92bc5feab39b7e584183436edfa5e28fdac4125c72077d21b6b1b8bdbbc9524ef91cc2ec7f9fe667388d633ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181330, "uuid": "c5bcb1e0-1c75-485b-ad4b-cfa7a8d0892f", "value": "T179E3E1117B90EC72C41056B10835D2E2AEBFFC2246375A4737186F5FAE313D2AA7A359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181330, "uuid": "c24c01b9-57ae-4a44-8fce-a16f5589e3e7", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181330, "uuid": "8d223503-7f52-4d7d-8b7d-034478b0ea6a", "value": "1536:YZYHVrtGwPvzrG5VsRKyAnUORKj9yjBq1xmZd758TFYZ9oZJvqIOraHKSwNjYj1O:YZylG5FUeKxf1xmZPZs5EOHKaBWT5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181330, "uuid": "304edee6-5f1d-4b2e-8fad-70ac6779927a", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181330, "uuid": "f4ba1a14-ea86-47b4-9096-0b53e1083ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181330, "uuid": "94ce5741-f002-48d2-8621-f036e9064b51", "value": "7f5b7b10764553a0c2a36dad6b39181b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a38c6a9-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664180196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180196, "uuid": "f318f79a-f3c3-4840-ba4d-1e58ca7c9b35", "comment": "Malware payload", "value": "c6e93c2fb6d3c63eba9ce632be096558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180196, "uuid": "97dcf14a-3d40-4431-b02e-e083227363f3", "comment": "Malware payload", "value": "dec34332b37f42f5830c69ad6db723d5a80040a15e0ac9f0cc2c70c24ad4237f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180196, "uuid": "32c5c734-631b-4aef-a7a0-3f8dd1cb5d0f", "comment": "Malware payload", "value": "683d02f3ef9be898398ad69fc7b92cc1982e9d60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180196, "uuid": "d9b99fae-ccf8-4fdc-a18a-ec83fe37e0a6", "comment": "Malware payload", "value": "2d436fbafc882120390a1df9d55972c4a61ac14aa9051f1e12627742202c51659dbb23abbf5b2bc75ed5d7cd13d52ae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180196, "uuid": "21785d14-0e13-4ed4-84de-3210a19bbc6b", "value": "T199563363124532D5E1E4CC364637FCBAB1F6526F85C2ACB490EE9FC026125E6F602B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180196, "uuid": "509c4a16-ecde-4795-97e4-4205b288c4fa", "value": "d812527b5988192695ea156eae610de1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180196, "uuid": "08b8cc94-f3ca-4b13-8c6c-d0d1d2652b02", "value": "196608:z8KcQUBqVMEygJPH0YC9tR8GopZhDJcm+h6Q:ozqIc0YC9fqhDJcBUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180196, "uuid": "f09c390e-41b7-4e96-8814-e29e283201b1", "value": 6359040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180196, "uuid": "67982f67-ca06-4487-967b-4cbaa1a7848f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180196, "uuid": "1d4cca25-fdd6-4797-8f35-29008c2cb618", "value": "c6e93c2fb6d3c63eba9ce632be096558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37c740-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213138, "uuid": "61ce43f6-1f07-4956-b632-bec385d48ed1", "comment": "Malware payload (IcedID)", "value": "d7d4dab27a95d5774f8dffe75d44802e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213138, "uuid": "b033fcb0-41ff-4a8f-bc11-263cd628eea3", "comment": "Malware payload (IcedID)", "value": "dff04640f0895983445a91d46d359606f5dbfaed3abc5593bcbe5fbfd2f1c318", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213138, "uuid": "f8a1ad7c-146f-458f-8b9e-ccd2160e1a2a", "comment": "Malware payload (IcedID)", "value": "91556736beed79fc3cb09898c4a006fc738d8d1e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213138, "uuid": "62feaec3-2ab0-4a54-bebf-2bee424b630d", "comment": "Malware payload (IcedID)", "value": "c8e0e8f832fdc29c196edb188e2f336b4fb381432583947214b94c341b20ddae9e949fdd1cb3dee87f4e25a0bf0970fa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213138, "uuid": "da948475-a869-41c1-9bb0-00f45235448b", "value": "T1BC15F105CF00206BF00B693E371765D7E9621C2B708AEE1E6B86512E1AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213138, "uuid": "8755b591-172e-4009-aba6-5c2a87310a6a", "value": "12288:AgVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DENHNxISzvi9L6dt:BV2jUeQRI5wPN/eHTza9Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213138, "uuid": "0126d035-938c-4dd6-acbf-0e5d66895115", "value": 887292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213138, "uuid": "41285b87-0eca-4c11-a1d5-faff41faf91b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213138, "uuid": "1ccea296-eaf7-47a2-b8c9-8bdf6de86a3e", "value": "newportfertility.doc.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971ccdaf-3db8-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664209853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209853, "uuid": "aed7dd95-b029-43ff-a937-acc5ac575a24", "comment": "Malware payload (GCleaner)", "value": "55ab1755a30084df19f309a539b86c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209853, "uuid": "0a4fd707-9a2a-40ea-aafb-b3abe83422db", "comment": "Malware payload (GCleaner)", "value": "e07c3908b91e048d96c65c0a8bef011652d331e6126c4f20495f9a7e9f30a92f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209853, "uuid": "197a2937-3099-4bc5-be06-d88357fd0fad", "comment": "Malware payload (GCleaner)", "value": "36c082f06b6b02a845b283eabfd36e2a6d0b5367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664209853, "uuid": "244c70a1-bcf9-48fe-aace-e8b9d4b71dfa", "comment": "Malware payload (GCleaner)", "value": "5f936e01ee5b2243e34900aa2afae3dd66e6dc92444865d1e42ba1cdaf115ba51c0c907318eb8623a10bbd737bcbb6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209853, "uuid": "ee52c53e-89a5-45fc-b4ac-5fd87a2b56e0", "value": "T127340151BE40D932E46AB1B1C931E291527FA85121361D41B3B83FAE7E33B816B353DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209853, "uuid": "4a2dcb5d-d59e-4585-bec9-89ce50efc5b8", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209853, "uuid": "84675c8e-1368-421a-b833-5c1914e0b7f8", "value": "3072:wR+8hkTc5Gytm2vHP7XJpUmA/Rg98ChfCsWc4QsszE1tdAjNqA9BroldQ5B:y6ytDfb4mA/qCTO4QssE1tdAjNLrqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664209853, "uuid": "35416520-4d71-4401-95bd-70a49fd84435", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664209853, "uuid": "37d6b6f2-0d52-4044-a209-351e9d55bad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664209853, "uuid": "9637ad89-8aab-4375-81e5-05ffcbcb6c26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8c1a1e-3da9-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664203396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203396, "uuid": "6cc4e8fd-074e-4cad-8a2b-3fec90d5944b", "comment": "Malware payload (GuLoader)", "value": "eb2349317846a6d68db4d3dc6feeab8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203396, "uuid": "939a1478-46fb-4f35-abb6-3858784c78a0", "comment": "Malware payload (GuLoader)", "value": "e0d472d5ee893be2d67f69a2e45953a8551f9e15c57d4a062609a8ca0c9c6368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203396, "uuid": "ebcbbd24-448c-41a6-af3d-ce778d8a2b84", "comment": "Malware payload (GuLoader)", "value": "dee78c07bcc617c96bf67abfceeba3ba0de5aee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203396, "uuid": "9d788b91-aa99-4db0-a25c-8852f21216ad", "comment": "Malware payload (GuLoader)", "value": "f85c9b52ed9ed372a83f6e0543c22a71f0ef73acf07ce68b67f88146d5a9ec10f3e517b7a364af60b0e6356b165861b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203396, "uuid": "2f0534c4-058b-423d-b2c6-d990c384d6b6", "value": "T18274D0F2BB96D9E2CA65677041ABE373412F9D2565B00CCF0AC67519FFB2082503B19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203396, "uuid": "8bc1d61d-5f6b-42c7-a892-cf24463cef4a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203396, "uuid": "3e7d0e0a-82f9-42e6-a15f-9fa4612f619e", "value": "6144:lNeZ986ODE4GKwjSIs7mxFST/XWVV7lxkrd+Yo:lN2pGE4GZjS+xFSTYur2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203396, "uuid": "52fde168-2e1b-4f74-b3fd-8bccae9d1118", "value": 338512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203396, "uuid": "eeedbc2e-1bbe-4efc-b673-151e141ce5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203396, "uuid": "fbd38b4b-1352-40e5-8501-5f98755b3dae", "value": "new needed order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00caeaf2-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213896, "uuid": "025192fb-8242-4fe0-a7bc-cb518a2060af", "comment": "Malware payload (IcedID)", "value": "413eac826de2f8b0dc1ce1fca00456d6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213896, "uuid": "32a73e36-fd2d-4ae2-a853-8f1ff4dcfe15", "comment": "Malware payload (IcedID)", "value": "e0f330fce3d6e226cc531b6b943a3ca33e81ee683f3068d0ae5a8e7553e20df2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213896, "uuid": "2ffa6ca5-ff4b-4955-89ea-7b7135edeec7", "comment": "Malware payload (IcedID)", "value": "a66bf80b7c875e3a4814a20966def67978594425", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213896, "uuid": "1d546314-f093-4896-a257-ee28d28500fe", "comment": "Malware payload (IcedID)", "value": "1d7bd3074c0faa3f531f91aa446e3a16dd68ec176d1fbd6752d8be449dbb86f459e7a514888a2158698c71fe6d08894e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213896, "uuid": "626ad967-6c94-4930-aa7d-c5e44d8091c4", "value": "T10615F105CF50606BF00B293F371769C7A8661C2B348BDE0A6B96112E1AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213896, "uuid": "4261d801-fdc3-4d12-8f1c-012d29e986c6", "value": "12288:HVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE7M/7lT/+TeD:HV2jUeQRI5wPN/jx+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213896, "uuid": "e6719f3f-2297-4045-b352-7aad73d8aa10", "value": 887840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213896, "uuid": "9d8d6160-5405-4ee1-859e-ebf9d2e3d02a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213896, "uuid": "09283a68-1583-4882-86a0-0a6a79b5d19a", "value": "linkkerz doc 09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7578afa-3d7f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664185506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185506, "uuid": "13de3011-faab-4552-ac83-3b792c900c52", "comment": "Malware payload (Smoke Loader)", "value": "63274fb12e63968d04b4c3cec67b0a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185506, "uuid": "554f07fd-05b2-4063-9a88-b2612b526858", "comment": "Malware payload (Smoke Loader)", "value": "e13908e1c4ffe89552b6787855e9c53c85d2437d82d0bf91a046471c1cdf8af2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185506, "uuid": "73862e4f-4968-4f6e-a114-24c567575cd2", "comment": "Malware payload (Smoke Loader)", "value": "b0ef5a5b9d4657faf6270d217b3155131c56e263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185506, "uuid": "2c31da75-4b96-42d5-a124-edb14ca12163", "comment": "Malware payload (Smoke Loader)", "value": "a7330000afc482c53f4ac336791af15a644e987fd1377aa15814eb686944b030e12f2746443ac81d96e23d03fc14d6ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185506, "uuid": "4d294966-3929-4079-9dd4-99a5afc96957", "value": "T180E3E100B790E832C41144B06875D7E2BA7EF82512369A4737586F3F2F327D16BBA34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185506, "uuid": "3eebc4df-f039-4774-8521-2468f6257d57", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185506, "uuid": "b08faa82-db6b-4075-8e17-a9a5b7ca0022", "value": "1536:agpYXI1GP0HPRUz5yh3asp10Rb3EN3rVdHF2FlQjerzb26GZwr6xnIglXHajXqX7:agplmz5lI1E49BPerzyyxTBS5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664185506, "uuid": "4e596965-3025-4f6e-b432-f30b052338bf", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664185506, "uuid": "fa51352e-9e48-43e4-9dff-7cd90bf76b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185506, "uuid": "fa7645e9-4770-46e8-a5ca-a41270e2ea47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a603ab5-3d48-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664161728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161728, "uuid": "bf7ce21c-e63c-4a9e-b099-fd288bb942a9", "comment": "Malware payload (RemcosRAT)", "value": "37ec18056e185e5c76bb4fee8628ba53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161728, "uuid": "22b02e99-e397-49b1-9e9e-67428200244c", "comment": "Malware payload (RemcosRAT)", "value": "e226014240563c1bb381a65e2286163d01091ab0c41f6ec7d71d5a2178fabba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161728, "uuid": "feab24c0-eaed-43fa-b93c-6fd654244c3f", "comment": "Malware payload (RemcosRAT)", "value": "3f9a6a73a5ea83556f975f70aba802f141195dfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664161728, "uuid": "71bbbdbe-067d-420b-9b77-7c288c1d6328", "comment": "Malware payload (RemcosRAT)", "value": "6932eea2f88ec9578c2e53709c3a21a1975a64c5601f481ecc9525f06e5c7f9aa1bcc7d638f6b7a3a03cdefbc841144b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161728, "uuid": "893b83a6-695e-4cbf-9874-78267d9cbdf7", "value": "T1A245BEE71BC5F442C1BEB3B172792868D3B682D7C5849797108C41EABBB67C538E2493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161728, "uuid": "79da9b72-105f-410d-9e50-97122282c5cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161728, "uuid": "d03d9eab-4e7a-4d62-993b-073e712cf58c", "value": "24576:41+VC7b/lVwHsOzj4j85M1hUQDAxzJX44AaCK9SM:41+VKesOzj4jGM1aK4FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664161728, "uuid": "943016a4-0257-4ca7-9d8c-de6be5e646d5", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664161728, "uuid": "acf9c3d7-e947-4e38-9e11-9747b5bf8492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664161728, "uuid": "c4fc7548-4c75-49d0-a925-72a412744fe8", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.23237.21800.16663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bc595f-3dd8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664223613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223613, "uuid": "d13c36b5-d338-4620-a4ab-d41944f76933", "comment": "Malware payload", "value": "6a2be3c13be20df40607f1f5347be91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223613, "uuid": "a2b86ecf-ac85-4b8e-93f3-dd9e8fce61db", "comment": "Malware payload", "value": "e22e7bcf823ccedec93f95a59928921cafc981f273ac0a9c072a91e42ba41a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223613, "uuid": "86b474d6-01c1-4d92-a3b2-61490722abd3", "comment": "Malware payload", "value": "f9dfacf52d601a97e7017d04b06803a0c9e2b692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223613, "uuid": "5a2e4a4e-80fc-4e17-a785-376ac84e8e17", "comment": "Malware payload", "value": "31f85d6a6eda4b25615060549bc4ca2f3f83806515127853a1f2e54d0a0b00c658a17d92827ba8e1e8980cecc03a8bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223613, "uuid": "c83099b9-8a2d-4223-aea0-de8788093aa2", "value": "T138D3E1407A50D432C42766745830DB40AE7F783226B95A86BF983AEF5FB13D25F3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223613, "uuid": "253e503e-e130-4856-9138-ab11d4418019", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223613, "uuid": "b90e9769-8386-425e-af80-d87f170992f6", "value": "3072:xBUT5533mqRGL3XGn8/bmpvDH2wD/tbKng5B:2tRGL3erVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664223613, "uuid": "d1c17f15-6e92-4a07-9286-ff54f11c67d6", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664223613, "uuid": "aa261738-65db-423a-a8cc-fd673c4e70aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223613, "uuid": "4c9cef6b-3918-465f-9c07-ac948eb2a36d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7588518-3d73-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664180353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180353, "uuid": "d62bf313-0017-4647-a0cf-b2228db1fb4a", "comment": "Malware payload", "value": "3d21551b8cc5a109b19e187599ea6d7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180353, "uuid": "dd0a4244-2d43-4fab-a01c-e1cad93895ed", "comment": "Malware payload", "value": "e232ed6f9fbf9e132e338f1723cbdb193680d9c7026f8abfd7f7d60849c9474e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180353, "uuid": "e4380bb5-6468-44b7-bc04-2cf1afcebb1e", "comment": "Malware payload", "value": "e6438a935eca882fc34924cce6288cbd3288b746", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180353, "uuid": "7fcd6eef-2bde-44cc-a563-74551e76260a", "comment": "Malware payload", "value": "93a23befddd195af4c55cd4e234f9aeb4f877299080b3615d34fb769267b32e2dd15229a214ab4dfdc597807f527fd87", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180353, "uuid": "69d5184f-320e-44a2-a175-8e66649d2e10", "value": "T18C442A85EE40112AF8FAD274166EA321439DEB311B61E3CB154867DAB9F48C15B34BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180353, "uuid": "3786cfd7-328f-401f-9737-edef5e93ea22", "value": "6144:ey3y5+HmvWMM0pFqk4gX4yH4i4v3kMMUCc7k91FjXM:3ygHmvWr0pFqk4gX4yH4i4vkVUJk9vjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180353, "uuid": "74e8274a-644f-405d-87ee-bb1a1d91aad5", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180353, "uuid": "3dfdb333-6e38-4914-96ae-b91ec49da486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180353, "uuid": "2a47b7c4-bfc8-4298-8ee9-d1ef90767c4c", "value": "SecuriteInfo.com.PUA.RiskWare.PEMalform.260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025bf17f-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213899, "uuid": "ee6b4ab9-dc1e-4c09-8c80-fef59f339fc3", "comment": "Malware payload (IcedID)", "value": "55656aac9077222bfb6c1f9329430a62", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213899, "uuid": "cef37028-514c-4d9f-baef-b665255ec5d7", "comment": "Malware payload (IcedID)", "value": "e269a681bba217da4d23d53a8cb44c19d502af3a25b37c416e0d5f273caf589e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213899, "uuid": "9431bac3-5f36-4c62-9eb8-721206de28ad", "comment": "Malware payload (IcedID)", "value": "b437d4442846fb0605eccfe55644c715dd4ace4c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213899, "uuid": "1f9ebf71-59d0-4dbf-9126-5cf9d7d28080", "comment": "Malware payload (IcedID)", "value": "894de0e2d9498629fd24357534ddc7b8493fded9a782999c06d9a71f57fa177fa93a15bd6d981748d1d19f01a6074739", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213899, "uuid": "b869ccfc-a257-425b-9d10-2b8304715a6c", "value": "T16715F101CF50246BF00B693E371365D7E8661C2B308BDE0A6B96116E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213899, "uuid": "eb1dfed6-a3f8-4ef7-8937-40377d7624a6", "value": "12288:XevVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEuXmu5GYAH7og1ANO:OvV2jUeQRI5wPN/hmu5iEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213899, "uuid": "11bdd149-5fb8-4665-a238-59c879d43936", "value": 888015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213899, "uuid": "ba873953-01a1-4f1a-a3a2-2421e20295d5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213899, "uuid": "e82ee5a5-a87d-4061-9198-92774acc74b1", "value": "lightlink-doc-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36526e58-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215274, "uuid": "b54eae99-fb52-4a1a-959c-3bc12d06ac67", "comment": "Malware payload (IcedID)", "value": "b1799c80394e1da12afd9f38d3293f90", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215274, "uuid": "d879bc2e-d331-4e56-91ac-083ecb180d30", "comment": "Malware payload (IcedID)", "value": "e2ba042f4194826bed8a8ba388dd26755cb76d5e82811f86e418f377b6fc3791", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215274, "uuid": "7f2e9d02-2440-4e3e-a0a7-732f89da3b3c", "comment": "Malware payload (IcedID)", "value": "3cef24ba7115e6f83071a4d951d189fc961d3337", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215274, "uuid": "838fe0db-4d05-453a-89f5-526c4498da0d", "comment": "Malware payload (IcedID)", "value": "c5687e96d568aaec42496ce5f45c0e660a30fbb68961a7b76aeb9acc5e1bf5ee653d53c1d51bf12b678355ce39ac7904", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215274, "uuid": "b40bfcfd-aa8c-4729-9f12-646a82f0fe48", "value": "T13215F005DF50206BF00B693E37076587F8A61C2B308BDE1A6B86512E2ED7F60ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215274, "uuid": "cda557db-749a-4c1e-9992-eb7b79bcd053", "value": "12288:g2VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DErPFhhhJ3sJAibNfI:rV2jUeQRI5wPN/wP1hJy/ZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215274, "uuid": "e9cd51ab-9794-41d3-bc3a-1ac29c71d242", "value": 886661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215274, "uuid": "c21ca8fd-960a-4044-8045-fce37be9dbcb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215274, "uuid": "b143b104-f2a3-45ae-8766-aa6f9c3a9d3a", "value": "jhazle doc 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ed9c67-3d63-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664173289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173289, "uuid": "4d4594ae-b50f-4e8f-82f9-5efb3d554e05", "comment": "Malware payload (Mirai)", "value": "72595b3279314569e1c88644150a3670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173289, "uuid": "7403d18b-ee3b-4278-b562-4a60a06bd083", "comment": "Malware payload (Mirai)", "value": "e2bd4b942552d84a65ee9c95605df3759c60fce2f61a2e6655f766a011f3a438", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173289, "uuid": "61661181-14b8-4c54-9c77-ed1b07be178c", "comment": "Malware payload (Mirai)", "value": "3e2050da50256237b9da6748c71fde79b6dd4405", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664173289, "uuid": "ba23aad8-46b1-45af-a8dd-2796d44a79f2", "comment": "Malware payload (Mirai)", "value": "684fbc57806ca366b7c1e4171a5c5cfb71a6bf97979e9e41783e75cd2f4801b50f58e1f64b5079e068afa6680f9b0a87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173289, "uuid": "1bd5a32e-58aa-46a9-baa6-865a889535ae", "value": "T1953302C1A0DD2865E7311D339DB8422C78229FFCC1B76064761097987E9CB4ADA7EFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173289, "uuid": "be603c55-3d65-4d46-b93e-face38c5c49f", "value": "768:A6/QvItLCctyRMfTp9EEeEtJWaSzMZrArzeVCnzKzxQz8GwVzjftPns3Uoz1Tqke:A64QC+lT8EVWx8Ae6+08rVPwz11B+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664173289, "uuid": "b49fdeff-71c9-4d87-b656-97cc947a2369", "value": 50368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664173289, "uuid": "59829d05-b1db-4d5b-ae29-272d810210ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664173289, "uuid": "35f9d1eb-3af6-4e7d-a617-e11878dcfd39", "value": "72595b3279314569e1c88644150a3670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658de39b-3d98-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1664196026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196026, "uuid": "236a4934-3707-4142-bcb4-632851c67458", "comment": "Malware payload (Quakbot)", "value": "07f46935f9ea6ee92ba3d2f6c6feb945", "object_relation": "md5", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196026, "uuid": "5a007589-02ac-4ce2-b699-90e3b35df7fa", "comment": "Malware payload (Quakbot)", "value": "e3130dab775404ad2fdeb6a295b3b68ff46e5d1ee05df35efeb5348e837f972a", "object_relation": "sha256", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196026, "uuid": "39216a59-dc2c-4399-82b5-a84cfc6f18af", "comment": "Malware payload (Quakbot)", "value": "01099a281a3c2124eac9344756a317cf3900aa95", "object_relation": "sha1", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664196026, "uuid": "14cf15c1-b20b-45b1-9e2b-8474efe9aa9b", "comment": "Malware payload (Quakbot)", "value": "b7e9f5a59092533c46830953fc3341b613551e035a8b6c8552be4757c2d10e668395884836a3b3eb8f3c15cd18ce07cb", "object_relation": "sha3-384", "Tag": [ { "name": "1664184863", "colour": "#3DD33C", "exportable": true, "hide_tag": false }, { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196026, "uuid": "1b1c10ac-6d6c-4868-a500-135f3f323d0c", "value": "T1670523075F35B8DF497C117D20FA2F090CE2C944D803B9BA119015EE5A9FB15EAA92EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196026, "uuid": "be312e9b-956d-4547-8ff8-48681599b0a1", "value": "12288:DGOAmnH/JI6j87U5TkqCJbI0wFq9IeV2Igy98xQVhQKfKnPivlrss/2kO+1IX:DGqy0TzRFqSY2jy97VhH99sgIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664196026, "uuid": "a8e3519d-6b58-4143-982c-4002669c2aef", "value": 811125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664196026, "uuid": "1c5a4fda-0c95-42c4-a28f-32b2bd8f8797", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664196026, "uuid": "0a0c2857-dbc4-475e-9ce7-d82977bba576", "value": "inonctnnIdu.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a7b18a-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215077, "uuid": "51d12d41-20f0-409b-a306-c3f6a4a85f52", "comment": "Malware payload (IcedID)", "value": "140735529ff6a04e908c6d366d84ee23", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215077, "uuid": "d7caa913-3a9a-42d1-a014-555b18e1e427", "comment": "Malware payload (IcedID)", "value": "e32d11d7b62d509c8ada08864a4938bbf92e2b7a4f5cb93cf9a387daa20fcf5c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215077, "uuid": "7c25c2c4-aa08-482c-ab76-7d12f4c9c2ec", "comment": "Malware payload (IcedID)", "value": "c6f819b74701d5600dfc9346fe309498a2b0fa78", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215077, "uuid": "b9169c4e-7a44-4b39-8c20-4e33bf818466", "comment": "Malware payload (IcedID)", "value": "3ebb892b4d21c5006f0377addef7eaf5ce7b0636ae022959c74a9e10786afdbf8e3321bf1c0ac747633db0e9a65f5f75", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215077, "uuid": "0d0b8559-4b5f-4fa1-95f9-6ef2a0a28199", "value": "T19715F101CF54206BF00B693E371365D7E8661C2B348BDE1A6B96112E2AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215077, "uuid": "23332da6-51e9-40a9-a53c-769784765299", "value": "12288:C+VE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEIWmu5GYMuuV+qe1GIaqXOg:rV2jUeQRI5wPN/Kmu54VV+X1xsNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215077, "uuid": "fb682bf7-3260-408a-83e8-10202907344e", "value": 888144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215077, "uuid": "5b58f568-e06d-4de1-81a4-dcd3672111c7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215077, "uuid": "e1d901aa-8a84-40cc-87f9-e6399322afb4", "value": "localnet file 09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38af60f5-3dc5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215278, "uuid": "cf056eed-8037-4e6c-b947-d7e2f38ab918", "comment": "Malware payload (IcedID)", "value": "954807b4560799b78739a0c930e81079", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215278, "uuid": "d9ee18a9-d897-4f1f-8ea2-6b7cca509e62", "comment": "Malware payload (IcedID)", "value": "e3887579686027793f881b42efdc407dc6c928a950e67fdd77ea56e2345b0bb9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215278, "uuid": "961bdd94-281b-45b4-a6de-e60b6adc6c9c", "comment": "Malware payload (IcedID)", "value": "92c18b53713048e8cb460f6d064aff015e62d87b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215278, "uuid": "c458371e-a5b1-43b1-b2ef-7757fa3c25d8", "comment": "Malware payload (IcedID)", "value": "e6e4f9068a927ae8cf1bd99d30ab3f5dd056cc4cecf59ec444ce3161b6b4e6533bd062fa667032deeb12e0b24619d810", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215278, "uuid": "e21cbda5-af35-4e2c-9952-06b11d9c9cc6", "value": "T19415F105CF54206BF00B693E371329D7F9661C27308BDE0A6B86512E2AD7F60ED36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215278, "uuid": "82d45cf8-cc1d-4c52-9a14-9986d179f65a", "value": "12288:0LjVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEMaG9OgdQs6kFtBhYc4H/o:0vV2jUeQRI5wPN/hOfsnFtB9Yca8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215278, "uuid": "f7b75a71-90c2-4197-9754-849fd1ae5850", "value": 886532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215278, "uuid": "665fff0e-2151-4e04-95a2-d2cce75abfb4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215278, "uuid": "7dd98d23-0174-42f5-939f-df4589c0d1b2", "value": "meekadesigns doc 09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a45de1-3d52-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664166206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664166206, "uuid": "b79b821f-2265-4ebf-8d0a-0026d5735f41", "comment": "Malware payload", "value": "b4760cf277c8cb9b60a5d98c928df8f7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Ereser", "colour": "#DDE32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664166206, "uuid": "5f1678c9-3a31-4a88-9a52-a2ffa673ee88", "comment": "Malware payload", "value": "e466295ec19b77ec5121420dbf07f059859a462cebaadf7bd32779153baa1890", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Ereser", "colour": "#DDE32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664166206, "uuid": "6119a259-db19-46d9-bd1d-80f6f7e1f144", "comment": "Malware payload", "value": "3fa325889c558e17ef5e067d015af409c6c32e05", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Ereser", "colour": "#DDE32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664166206, "uuid": "020434f2-fe23-4eeb-8a4e-2a4bb20c542a", "comment": "Malware payload", "value": "4184fa068977325cc98e9de6ecdc6ca4b72e284a23db39071883b4fcfe1b3814c3e5322711fb97f650120f8ef8f17f0c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Ereser", "colour": "#DDE32A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664166206, "uuid": "e55c9fef-e564-46a6-8a1d-966bc60a4759", "value": "T1238423BDFA0CD1E7858BDD1B081859746D897A116C8F8CF9AFD921BBC160D7E2C09B18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664166206, "uuid": "1146dc57-6176-4168-b2d3-2dfed8cad687", "value": "6144:qTKtlOIe8Cr8Rs3zica/By0nnpUaZAxNsvvKGGZ8dS/Lk+tF7m78m:0m68u3uLfnGaOxNsvvKjnfsom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664166206, "uuid": "00b1c79b-deb2-48dc-8c85-1cbbcf93228a", "value": 392010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664166206, "uuid": "e17dfabf-2309-449f-b1a3-8c1f80139a6e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664166206, "uuid": "bfd20337-fde0-43c2-9094-ad06ac0cafa4", "value": "422c767682bee719d85298554af5c59cf7e48cf57daaf1c5bdd87c5d1aab40cc.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f8f497-3d92-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664193319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193319, "uuid": "b97f4432-9e68-4b2e-9a48-3df52d960425", "comment": "Malware payload (RecordBreaker)", "value": "ce4714131156a80e68b6b9f0dd85063c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193319, "uuid": "c392cb4a-3c9a-4062-bbdf-08d4086547ee", "comment": "Malware payload (RecordBreaker)", "value": "e4f6744d7f1e36f89b82b1f8eded42d906d469b5275f31f428dd4c7b9c72a456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193319, "uuid": "ab13366f-6944-4972-a928-c21cd91958ae", "comment": "Malware payload (RecordBreaker)", "value": "8b3824f3242cc278a4a0f4b9ad4409a5c4a4a9ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193319, "uuid": "fdb7e01a-8566-4885-92d2-23dbda250c66", "comment": "Malware payload (RecordBreaker)", "value": "dc89e097683ea913a98776a1bf319012c0afc021cc217c55cd954173f41b2c665f3d124d2b9a93e04a9a64afa5b32ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193319, "uuid": "1952f69c-df57-4369-8dd5-3f94d9ce0e6b", "value": "T1A8E3E0017B40D8B3C12684785429D3E1BE7AB86255268D87375C2F6F5F323D2AA7235A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193319, "uuid": "fa63215e-33c2-423f-8ddd-61cfeead6bb8", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193319, "uuid": "114ba7d4-8c7b-430b-bad5-8f1850d7d69b", "value": "3072:Y/plmz5+xZobHGS7i0z4kN/lXhBEyv/u5B:O9ZoLfi0zHPY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664193319, "uuid": "24c07c4a-96d8-4960-bfe8-27d2310518c8", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664193319, "uuid": "5a1c8060-0b0d-4af6-bfe5-88ef60377c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193319, "uuid": "aec4fec6-43a9-4dc5-826a-a85e5b1deb37", "value": "ce4714131156a80e68b6b9f0dd85063c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963cbf11-3d68-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664175492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175492, "uuid": "c39e74f8-8384-44bb-b4b8-42e33a783552", "comment": "Malware payload (GCleaner)", "value": "b23c023dc0620d336d56306be76b1821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175492, "uuid": "8d19943e-4665-4218-a9f6-3971bfef050e", "comment": "Malware payload (GCleaner)", "value": "e5f5f8d78bff01b614314b9a4165d71e4c6daa4561e09f5951a26228f07040af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175492, "uuid": "7f177c5b-f88c-48db-a0d6-4d49380fb25c", "comment": "Malware payload (GCleaner)", "value": "ffd6a24f5a0aaa571674fae0fb13eb2859a235c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175492, "uuid": "3be97af5-c8fe-43bc-8e68-6ac855871052", "comment": "Malware payload (GCleaner)", "value": "97894fbad1eb950a8d54d94d5e0a456a1a3d6ad53a2febb6546bc259b9a723af83594ffa370a3c7ff8daf1da5bfeba2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175492, "uuid": "72e331a0-25b9-4bd7-a8df-81866810e263", "value": "T1A63402417F90EC32DD18B4B1C8739AE16ABE68115676460377782EAFBD327912D383D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175492, "uuid": "4616e664-2150-4907-9305-6d138473e2c9", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175492, "uuid": "6901bced-60d4-46db-adfc-60ff0783796d", "value": "3072:Bs07G5DjG9S1ONADSZGgBS3xFsw3GBZichVSj5tktpRSCMlI/PHvuwsv5vEwciBc:EjG9SwaSM33EmGSbcMlI/PHvupBkHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175492, "uuid": "606b022f-c23b-4d78-b7a6-e8464c688278", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175492, "uuid": "3af7b023-d6fb-419d-9d8b-51942fe0c6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175492, "uuid": "1758875b-7e72-489c-9bf3-7976f65e6fd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3975b412-3d90-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1664192516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192516, "uuid": "b3ccc9dd-d279-47c4-97f5-9d55a140c4b1", "comment": "Malware payload (Gozi)", "value": "7886d8f47267fd9170c03b8ab0b40e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192516, "uuid": "e565a503-1002-43e5-8e5b-eec8c3bb2896", "comment": "Malware payload (Gozi)", "value": "e5fb9bedbd2946535e021c0f80493b1de9fbcb1d6b18be30d3a9ebd74828e49e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192516, "uuid": "e52fef76-8d99-416d-9d0c-e6baf8e95707", "comment": "Malware payload (Gozi)", "value": "d878a9bdc974330c77440f356fc949d3ce0de7cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664192516, "uuid": "c2f8eff2-0df0-4e91-abf4-0f810e61cdc3", "comment": "Malware payload (Gozi)", "value": "2243bcf3adaa0668b89aa131749d5234c2242e1603c7bd8f8de05c45715d09b5e4494bc08bf5b6d7554f4df716a51359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192516, "uuid": "c8f5573b-6068-4c4b-bef3-38bcc2a0a523", "value": "T1FA344B6AA3E51995E96BC6B9CD53D217EBF334492B14C30F53B0CAA66F17722B11C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192516, "uuid": "3fa286c6-a94c-49d5-9c39-fc20d8c036fe", "value": "3072:35hinZgCo+NjJWSsznC2OCyzjFIz4V1T/JDR1vGBB78C752cjjA5eBd:3+nZ1o+NJWbn2CMFIzSTRDR1vGR5Qgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664192516, "uuid": "6fadcae4-6d61-4fb8-8b6b-0a3f948e1f87", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664192516, "uuid": "02849a75-fb09-4f79-9558-193dfc5a49b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664192516, "uuid": "5c964947-68ba-458a-881b-97b320460e43", "value": "5860000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b74601-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664180434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180434, "uuid": "0cd25695-01ae-4212-b4d9-6a72e9793011", "comment": "Malware payload (AgentTesla)", "value": "59b4d8f0a5a9d0e1642355700426e8fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180434, "uuid": "6e7f7db4-0267-4522-92ed-6a3af96e4bf3", "comment": "Malware payload (AgentTesla)", "value": "e757719aa05cb8fab7418d02f6dff68cb495933f225472a633a2510e987f7ba9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180434, "uuid": "896bbca2-f136-4448-b341-e0e74340feeb", "comment": "Malware payload (AgentTesla)", "value": "6e7aaa33e2c34946074896cd4cb54f412c8b8319", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180434, "uuid": "4928f3d4-a8c8-4435-b025-7e55ec3ad40a", "comment": "Malware payload (AgentTesla)", "value": "eeb9f00749ff41a48632faedf117cd9e1e7667c86ae66b87710fec61d08d824052fcfffd7979339c13c3fa29a5680257", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180434, "uuid": "d9b9f2c5-e36b-4682-98bc-1ffa9902ca9f", "value": "T16F21740B692FF582C9EB3311B4D6570686F4074272BB268A3850C990AB9DCDC86E46A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180434, "uuid": "60682f38-5689-44eb-ab4d-1314dae9ff1f", "value": "24:RZAZHYZ0AZFlecjyLuoRWFHbuXz51nA0WO6FrNIyIkTDuQjjipOFdAZMguZcdgH:RZOHy0OOcj2uQWlbuXz80w1NIyJDuQHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180434, "uuid": "af0123b5-d5d8-406e-a21b-be2dd4cef01f", "value": 1193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180434, "uuid": "534f221a-bc0f-42d6-a5e8-d54fe4a612ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180434, "uuid": "240667b8-8b32-48f1-9921-2ef16fe5405e", "value": "doc20220926073500.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c913e5a-3d52-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664165839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165839, "uuid": "2b9c3bea-64e7-4388-a5d2-63dfecb150af", "comment": "Malware payload (Formbook)", "value": "780958d2d7daf79013ab0ca478a96900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165839, "uuid": "0b480451-0817-4063-aab5-5d270d95812b", "comment": "Malware payload (Formbook)", "value": "e8911ed914364aaa1dbffcfe55c53e2932e9f38ea490523a8bcaf8e13633187a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165839, "uuid": "1bfd46eb-0bf3-403b-857b-719ea9eb738a", "comment": "Malware payload (Formbook)", "value": "b96c2d0f1ce891f701fe2753d3c42f4809fe7e66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664165839, "uuid": "e537084e-5fb0-4044-9761-0deee672bba3", "comment": "Malware payload (Formbook)", "value": "c6334d5c1d3ceee2fc7d00cb5b39018f8da6eaddcfc13705f36d0356f00ea297301eca2b02510b58d0d770724597c89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165839, "uuid": "e0ae7cb1-1b30-4873-9c92-e3ac0b5db036", "value": "T12F25F1370BEA8B07D105767894D1C2F6A799CD01E567C39BABCAAC1FF09A435DB60324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165839, "uuid": "1eeff7c3-5a07-4a04-a973-6a57f9dcf41c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165839, "uuid": "cd4507d8-7e92-446f-bc28-d72dda6a7da1", "value": "24576:FPzdvNQuvHLATEQIawZNUVX+oqxdSrjE/6aEypKin:BZaYr4uaYaB+o6qISeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664165839, "uuid": "fb319491-0340-41ab-88a1-a0a6404495a8", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664165839, "uuid": "7c145b47-1d41-4778-b295-e193e61b5872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664165839, "uuid": "83b5f0da-b8d6-4007-82dd-cb40dc23ab33", "value": "SecuriteInfo.com.Win32.RATX-gen.24096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cca02c9-3db0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664206239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206239, "uuid": "9f586711-0f98-4a28-938c-5ee1f6b0b796", "comment": "Malware payload (IcedID)", "value": "7b0dff7f5bb6fd419cf93ba48dc5480f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206239, "uuid": "9699405f-ced8-43e5-8e0d-163a0c09baaa", "comment": "Malware payload (IcedID)", "value": "e94a2ce41231a353fd2eb7eb1d259781b54321657bbd799b380e550cd0bfd9bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206239, "uuid": "3fe6913d-ad4a-43dc-bbe0-133de411ceda", "comment": "Malware payload (IcedID)", "value": "bae1bd20f114d25e67a53fa6a6202ca4dcfd3dfa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206239, "uuid": "f6e29202-5caf-4695-b189-31f3e2a1332c", "comment": "Malware payload (IcedID)", "value": "084c55ea36f51edca19fb3c62c534c4bdddefbd6fa517699072db78a8ce3458904807740494bd46c17e760ecd3b721f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206239, "uuid": "53c89b92-12fe-46e3-a7f6-f4af00e02585", "value": "T17F6408D9B792B0A6C3E37574403F010BE27B6E91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206239, "uuid": "3c8681d2-0b91-44c7-b96b-6d89698d9e97", "value": "591e93c0276c7f6b587ad25fb1904529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206239, "uuid": "24c3a624-807f-4efc-8bf4-cea82046f36f", "value": "6144:iiaIMPl3fdywZzWsIRhcY2EmQ77BkP7+sPI1AF1:iiaxP58X2ikP7U1Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206239, "uuid": "40379f8d-b340-4c53-aaec-6ad1d5c6a738", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206239, "uuid": "dc661454-b9de-47ec-b930-052ef4aa6017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206239, "uuid": "8a42f2cd-2572-4c95-bafd-49ae87bff4e6", "value": "7b0dff7f5bb6fd419cf93ba48dc5480f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a137b3-3d9e-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664198682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198682, "uuid": "384186f3-ef1b-4e9b-a909-53f74ad1bf95", "comment": "Malware payload (Smoke Loader)", "value": "97ac2b935a69b5d7c296c073227490a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198682, "uuid": "11710dc0-0a6c-4ba5-b92a-8d5d161a49e7", "comment": "Malware payload (Smoke Loader)", "value": "e9ea778b79e035d007fc5565ac1b4fea4c55502fd822038221bd177b41b8a1c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198682, "uuid": "c7e0aaca-1aac-4e52-935b-d8eebf9f083b", "comment": "Malware payload (Smoke Loader)", "value": "13a61edd4c0ba19c06e50f0c2034ab899cd2b841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198682, "uuid": "e717a792-0db8-40b2-b70a-4225c86d40a0", "comment": "Malware payload (Smoke Loader)", "value": "f201276378b8e5706b068f07260f5b27b666b8944b39cff466eed334396784d4eba7007bfd01cba97b88ca6e6537edb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198682, "uuid": "5a847cee-5dd4-4b06-9603-6652ccde1c6e", "value": "T1CEF3D0017B85E9B3C15545702C34DAB2BA7F7D21507A198B3B9C2E6F6F322D186BA307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198682, "uuid": "d9599b36-4eb4-4d0d-ae0e-bac027915f9d", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198682, "uuid": "3b0d9d19-2ba7-436f-9539-8716db5d460d", "value": "3072:urP6TF5te9YxLRLOQgGb0mrSwgC1BlTy95B:bbdtrKCN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198682, "uuid": "4ae9ca10-60cf-4e6f-8e7b-18bee669c10d", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198682, "uuid": "f323a4a6-4ffc-4391-baef-85e6734e544b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198682, "uuid": "9c43eec1-d3bb-41fc-8fba-caf08c46cfcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3fcfe8-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215876, "uuid": "d25925e7-fe84-4de0-8d80-219df9db86dc", "comment": "Malware payload (IcedID)", "value": "5971fa63da7aab926fc419ea95dff008", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215876, "uuid": "13995204-3e52-425b-a57f-456b7f66dca4", "comment": "Malware payload (IcedID)", "value": "ea153aab8f9073d6bc3552d78cb0d0fc57a80cbdb437d9d9ffd6e3629d63b19f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215876, "uuid": "7bff4cfa-78c2-4d22-b43f-24228b942be6", "comment": "Malware payload (IcedID)", "value": "e0cc4870870e167928bbc655215386407e08771c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215876, "uuid": "bc06f1c1-0d64-493b-9bbf-d851f6663393", "comment": "Malware payload (IcedID)", "value": "c4fa09914cc3130a727fc9bb52843648484222d18f9fbc868dfe2ac5bf044b7ca002efa0cadbdab03b26fb6f5826408f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215876, "uuid": "719966ea-d809-4155-8527-84fae6307092", "value": "T10015F005CF10206BF00B693E371765D7F8660C2B708BDE1A6B96112E2AD7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215876, "uuid": "3d11bb41-d97b-437d-9ce4-14fe5c34dbf2", "value": "12288:uVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEJHNxCSzvl9WDD:uV2jUeQRI5wPN/2Hpz994D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215876, "uuid": "903ebff4-d187-4298-9334-ea7e17fd8cec", "value": 886929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215876, "uuid": "a03792ad-b464-47a6-b923-fd8b4543a801", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215876, "uuid": "c38ec3de-2601-49c4-b64d-6a2074d3f2b5", "value": "midwestorthotics.invoice.09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5016cc40-3d68-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664175374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175374, "uuid": "0875094d-3a26-49d4-8794-15ffa32097ca", "comment": "Malware payload", "value": "5b27a69d6e0e36dab7d926e7855a70c2", "object_relation": "md5", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175374, "uuid": "ced72126-b573-4b9c-a28a-e206df4654d3", "comment": "Malware payload", "value": "ea204957c9706c23b0f133679c74e390fea708fa59cb2e146fa2e0b31bde5461", "object_relation": "sha256", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175374, "uuid": "48726457-f983-4d62-ae72-ae533b63efff", "comment": "Malware payload", "value": "5cc76af7abefe36cc5a10c1ecea2d274d079653f", "object_relation": "sha1", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175374, "uuid": "29b445df-ccf4-47e6-9737-77c440cc4e52", "comment": "Malware payload", "value": "4563635ac6101784688cdd9589e6ce8f320d468ba5ceb8f80c0c21d169bb9be5463bf4742826b082a09667fbb11cc1b4", "object_relation": "sha3-384", "Tag": [ { "name": "95-213-145-101", "colour": "#BE06A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175374, "uuid": "aa3c88fb-85bb-43be-a128-a3ce4dcd2478", "value": "T1A9C41DD4A366FD6ACCA7753FF1593F2AC1511F2ADDF944C46AD0B4080AE8E4A90D098F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175374, "uuid": "8735bd95-1509-4681-94f3-80b65656728d", "value": "12288:mL6akhm4u9lnHAxxXHiic/kHQFet40mMs3:fPIlHq9HGeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175374, "uuid": "4bd92562-55e3-4d2d-86c1-879a26708ffc", "value": 545912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175374, "uuid": "4ce04ce2-c619-4931-91be-91194e287081", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175374, "uuid": "05f9b7ab-173c-48c6-af3b-2384a77e05d8", "value": "encoded-20220925222752.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faad5999-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (AZORult)", "timestamp": 1664179526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179526, "uuid": "c4b0cd61-5fcc-4b51-8f9c-7cd51d554189", "comment": "Malware payload (AZORult)", "value": "c42bff2b027d01641cac47b363eaef63", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179526, "uuid": "d0c0cdbd-36d6-4968-8c38-5886e69b2f8a", "comment": "Malware payload (AZORult)", "value": "eb165382dbcc999a719a7f61a2c23b823eb2d89fc7648330065983586dc9a869", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179526, "uuid": "04b9dd6b-648a-44b1-b213-3bdc3f7ef151", "comment": "Malware payload (AZORult)", "value": "deb49ead9c64f834db57f7a5704321a7e684346e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179526, "uuid": "2bcacbfe-1b15-4c5e-a636-d411bb3d598d", "comment": "Malware payload (AZORult)", "value": "883badb222c6914ff6a3a76267fc6fa6bd7102c55f5a82a089acf7a2f923ec6bd380f7b82b7e8a96ea30970d68bb9d9a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179526, "uuid": "b466d927-e36c-4887-9570-4a0b035a0c34", "value": "T1E014CF8673E89B07C92BDB3564C2404106B1FE67BB43D24675DAB33C0A953EA7A4E4C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179526, "uuid": "5b174330-7e4a-4220-9315-039f29eb9cd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179526, "uuid": "1671f0a0-4a94-425d-9877-8cd9d6966482", "value": "3072:yjFa0SeOyAVq3Vlfv+ZODb4941BVrJsQqe+/UajFVpCxBVOzyVjq:ASyAVEVGqkS1hsQqe+/xrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179526, "uuid": "eba6de61-f859-4b1a-ba0e-97fe90e40977", "value": 190960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179526, "uuid": "614ec7ed-564a-44f2-afb4-d244a99534ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179526, "uuid": "1c4f3dd4-fd3d-4937-9b69-8ba18c638979", "value": "Order R04-T4077 TBA-2022, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff78bb96-3dd5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664222484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222484, "uuid": "26224305-a464-4fb8-a3bd-a4fc11d3001a", "comment": "Malware payload (IcedID)", "value": "7de7d68ac040e38455949527846f8064", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222484, "uuid": "df950d6e-f8ec-4db7-944d-0da1e22e118b", "comment": "Malware payload (IcedID)", "value": "ebaa68738173a87e2dbde383c8879facc05def85da47be4e8be6fc369e7f232f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222484, "uuid": "3ad16d08-5935-4a4c-8502-3cf1ffce031c", "comment": "Malware payload (IcedID)", "value": "6322e5b14a4d85b45365f0f6950868422e8e29ab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222484, "uuid": "f40e483a-1505-42d1-8e02-56edfb462142", "comment": "Malware payload (IcedID)", "value": "bf72a4314f135c8c42c7928418de6c5d227dae48a2f447cae464833afd61ce6f74196bf499a3f551ce4df53bd99c5608", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222484, "uuid": "3e67d6b2-9299-4ca1-bcb0-d4214b9dbebc", "value": "T16115F105CF50206BF007693E371365D7E8661C2B308BEE0A6B96116E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222484, "uuid": "8e466c9b-cdf9-4af1-97c0-d72491c3c121", "value": "12288:/XMVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEnifnslvYX6htjos:UV2jUeQRI5wPN/VnBVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664222484, "uuid": "7662f0e1-709c-48d4-af6e-389d00f3b592", "value": 887080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664222484, "uuid": "bdd608f9-e0d7-4e02-87d8-50e7fc63e282", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222484, "uuid": "9626ee6a-a0f9-4677-829f-03683acfdfdf", "value": "mildjs.file.09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efadc9ae-3d33-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664152879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152879, "uuid": "920bc4b1-2a95-46fc-85a7-e9b0488861f4", "comment": "Malware payload (GCleaner)", "value": "1e5f9d2f2e43d61295bc8c57b159560d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152879, "uuid": "fc2fa786-ce9b-40ae-b904-c949a4e8aa9d", "comment": "Malware payload (GCleaner)", "value": "ebc1471ed86d604d2af9cb52e890145c49fe664fc55b952db1863e564c23cb92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152879, "uuid": "5df1fa8c-7703-4819-8ad2-942f8e17267b", "comment": "Malware payload (GCleaner)", "value": "b8c85ad540fe60417d5aa0600fcb9b0d76e401b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664152879, "uuid": "a63a061a-5d72-433a-b24d-66349c63569a", "comment": "Malware payload (GCleaner)", "value": "506f017b33e9bff3f0d045072eb27909c1223315bec70d4fd7cb43beba589cf5f2613318b2a66c6b296fd13a8aec3e32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152879, "uuid": "42165946-3e79-480c-b43f-76a9ba14b9f1", "value": "T10F4401527EC0E872DC99B670C872DE6067FEA85112614A4A77F82A6F6F203E15D303D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152879, "uuid": "4a516c60-0cc8-4e23-956e-8ed90cbc4c01", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152879, "uuid": "086d1314-6595-4041-884c-00d096b0b917", "value": "3072:tWu/aEcW4F8z5YzfEi6XsaIcqJT/SqACRodbzpFu6mS6qTY7xMElBXsud5x:f8JzfEi6XEXTqYo1NcLqTYNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664152879, "uuid": "73eda457-3ca9-46b0-9ca3-838a27019f3c", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664152879, "uuid": "17b3eca6-c2b4-4498-8d42-8700230170d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664152879, "uuid": "49d8b40f-c434-4d90-bb04-08b0677fdd02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79196e2-3dc0-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213451, "uuid": "5d4e9043-e747-41cc-8fe9-c9a1cf67ba60", "comment": "Malware payload (IcedID)", "value": "09683a8b9f5600528584daa56ab0dc71", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213451, "uuid": "ece80f0b-c043-410b-9a32-d828820e95a5", "comment": "Malware payload (IcedID)", "value": "ebc3abd89547ce79d0f33ec18ed216750317fa53cd1aab40fad24f7b19736ebd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213451, "uuid": "567ade49-29f2-4a60-a070-94bf160acd09", "comment": "Malware payload (IcedID)", "value": "695c099986c12b2185559c944b5ffeeb1f05beb6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213451, "uuid": "e4f4a7fa-c617-4854-9fd8-c613f15c3709", "comment": "Malware payload (IcedID)", "value": "dd69296d63913980cd7d9794dfde97d0f733def82c1e9f07dbc4b00e7863c8db816627c3123da57b24cd50a6413d35dc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213451, "uuid": "6c06aa25-5323-4ad2-86f3-47e67a9bc3ac", "value": "T13D15F105CF00646BF00B693A371365D7B9621C2B348AEE1E6B86116D2EC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213451, "uuid": "734fa6a7-1da1-4ab5-b124-2ba7687f75f1", "value": "12288:U9iPiVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEmldHNxbSzv3/PXSYqSI:oUiV2jUeQRI5wPN/JdHyzHPXSYqSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213451, "uuid": "6beb6479-d84b-4b7c-8b18-811a90631f7d", "value": 886792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213451, "uuid": "51a819a2-01a7-4c48-b7b1-266439bd50d2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213451, "uuid": "b0fa142d-f73c-4bda-9312-9ab9c455e11f", "value": "motherhencateringdocument09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba27754e-3da2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664200463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200463, "uuid": "932d1cf7-615a-45c3-8df0-3a742f558eeb", "comment": "Malware payload", "value": "dad500128123a0494e25a15669d397b0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200463, "uuid": "e9b59d3f-9b99-45b9-a903-c33f8c79f5e1", "comment": "Malware payload", "value": "ebe417ece947bcaaf83cb3c40ed9637b4a135a137614d2228b69e41e3f907d3d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200463, "uuid": "1e8eefd6-d3fd-4a04-b74a-766d5f4cdf6b", "comment": "Malware payload", "value": "a30abe1f02bf281460ee7752a6caa87f37f16725", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664200463, "uuid": "2dc0da31-6922-4add-8b70-ada3a8b3de4b", "comment": "Malware payload", "value": "b309230574cbcc02d80f37c7e68ae31ebcc247d03e3df5bfb7a2f8f83c80af72baf23d053c41d46ae489c0cd467f39b6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200463, "uuid": "6af38d0b-d19a-42e6-b51f-ac8c67b34c12", "value": "T16AA2BF22EA2D5D63D3537BF486481B4AE37FF019D0A3565B3D8539DD885103E0A62F1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200463, "uuid": "40d52a05-d1a6-44e5-becc-80bcee352ad6", "value": "384:0YokcLUojx4kFn73wnwemKF1BPd+I+wAxPAVDgyFeixWQP9L/CLX8cdWPGk8pDP:EkcDjWA7uZtFvE5xPFywiPlLK4c6GkoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664200463, "uuid": "9680f2d1-e033-4ce2-814c-77c85973fe8c", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664200463, "uuid": "f04cb453-5762-4a24-b99f-c26d5ac4b378", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664200463, "uuid": "728da120-f266-4579-ad2b-a7e341fbae19", "value": "Untitled attachment 00002.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17eb89a-3dc1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664213870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213870, "uuid": "f19f2557-bb76-4799-bbde-dcf4dfdb0c1a", "comment": "Malware payload (IcedID)", "value": "cc0bfeb8de5ac64632ad639d8d31a9c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213870, "uuid": "5536c41b-cbe9-4c67-ba33-1e294b267f00", "comment": "Malware payload (IcedID)", "value": "ebf4a084e6d4a5f9799da0d09a670ed79107193f35907a103f339471d65a9125", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213870, "uuid": "0d766864-ef8e-45fc-8d4b-912d9bcacfb8", "comment": "Malware payload (IcedID)", "value": "0cb08482da4b7789ac12d38c17dd287402420510", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664213870, "uuid": "f9e049bb-9aea-4cbd-83f2-65ebc5d7dbe3", "comment": "Malware payload (IcedID)", "value": "dcb702fe6cfbc1492441ec870caeadc6ae1a71a81466dcbf44a791c32fc0722321242926b5af8c33e4b32a777d822b44", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213870, "uuid": "eb156a28-f1f4-4dcd-a7dd-3cdc52eddf1e", "value": "T12115F101CF44216BF00B683E371765D7A8661C2B348BDE1E6B96112E2AC7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213870, "uuid": "ddcc07b4-b3a9-4e87-982e-5bde660ba191", "value": "12288:JhVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEJA10y6x1Gc2rvOxtUlB2:JhV2jUeQRI5wPN/lXW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664213870, "uuid": "0df835b2-9fa9-4dd0-9e53-6ecc89447665", "value": 886900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664213870, "uuid": "cfb816e7-edad-4763-a387-b18260719ba8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664213870, "uuid": "d2c99940-8aa9-42ad-959f-d4efc4c28ea5", "value": "irpinc doc 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6edc8c-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214665, "uuid": "9c17879d-331a-4f89-b7cd-0daaf008452e", "comment": "Malware payload (IcedID)", "value": "fb04ab5da032babddd908e18bff60391", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214665, "uuid": "7e7c1384-cf74-41d4-b948-d310fa10e64c", "comment": "Malware payload (IcedID)", "value": "ec11467a9beb27b6329e84a19e90f4563d9720ed8ec1f3c1ae013783061062fa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214665, "uuid": "2361884e-a85d-41df-a5d4-6b3642af1998", "comment": "Malware payload (IcedID)", "value": "8d1a1d32c6b49c41ae8ede82ad728ca471f2b1fd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214665, "uuid": "907770de-b1b5-4746-88e7-f5c2abff0f2b", "comment": "Malware payload (IcedID)", "value": "b898bc8d0d69eae53fa58b28b187669421a912938c40f3043931ba80d6a182fb8c1e5175de7c87e7940e83491aeaa3ef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214665, "uuid": "d107d0d2-a9f7-4bfb-8869-6059caf98044", "value": "T1B115F101DF50616BF00B683E371365D7B8661C2B308BDE1A6B86212E1AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214665, "uuid": "a63747dc-079f-4b74-b477-b446660f1fe9", "value": "12288:ApVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEWIesySlS3P9:KV2jUeQRI5wPN/Bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214665, "uuid": "5eecb85f-a52e-4ee5-97ff-f8b45e877794", "value": 887990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214665, "uuid": "e99855f5-e535-4b47-9906-21aaf19e32ad", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214665, "uuid": "f20487e2-fc95-4048-b083-81ced21f4588", "value": "lunawebs doc 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a32d103-3d9f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664198933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198933, "uuid": "f3339547-7ebe-4c5e-b689-c7b97e85199d", "comment": "Malware payload", "value": "c4ade9ada25a960ef20f95db35246421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198933, "uuid": "5a4cfa98-12f1-4c14-9952-b74ddaaaa555", "comment": "Malware payload", "value": "ecb7917f419a956cc0ff7354395ce6e7991d2495555892784eb57c20a0faa300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198933, "uuid": "6e00d229-9c5a-449e-9f2e-d638aa216234", "comment": "Malware payload", "value": "0577a02fb6d403a23e5956893993598197b61cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664198933, "uuid": "1b901395-d575-4ef8-b7b5-2a2283726c86", "comment": "Malware payload", "value": "f838539631cb149184c2cf5a2122552f758aee003a7a74fada8c67ae4bc73f45a8218647cc6a2760678f2c842d3268e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198933, "uuid": "4681724c-61a3-459b-a387-18abaf536270", "value": "T16276330776F19BB2E4460831ECE82FEAB674C0114A315F8393A5195C6F7CAADD720ED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198933, "uuid": "f026dae1-1d65-4c0c-b625-76ec2b918a7c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198933, "uuid": "bbbdd292-1557-4ad0-961d-4b8a1afedd66", "value": "196608:91OKmskGELcTD20GY+a1xIoq7TEVI2kxN4rscuQ3p:3OKzkvcGNFa1xIvV2kx0snW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664198933, "uuid": "1b50c7ea-8007-4d96-baac-6cc3caa8bc33", "value": 7637095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664198933, "uuid": "4e079577-6c55-4e2d-9503-12f9355f22b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664198933, "uuid": "40477d9b-5df4-47c7-8c11-2d3809f723c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c407ca8-3daf-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664205996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205996, "uuid": "10a3db72-28cb-40e6-94a7-0ad964f63c28", "comment": "Malware payload (Smoke Loader)", "value": "b6d51870789665016bae3c590c855afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205996, "uuid": "aa093f18-a48d-4039-893d-0e1a8aeeb206", "comment": "Malware payload (Smoke Loader)", "value": "eccbd25bba0bfa52c611b387132b63a7f4d871fcc9dbb543a6580f5cc6ee1d32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205996, "uuid": "e690014e-4a4b-4c4c-98ab-344879dcc16b", "comment": "Malware payload (Smoke Loader)", "value": "027e77627424a15b5eb2cb26e3bc4e1427d74684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205996, "uuid": "3c6de732-7c16-40d8-a1c3-1d104b1124c6", "comment": "Malware payload (Smoke Loader)", "value": "ef3fc06fdf06820d8c5ac11810f24bd616677db9110154404a9ed871f90482c1bdd582d93b543a305b5de5a2d62d7afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205996, "uuid": "6835dc10-0e15-48b0-9009-64d201b272a4", "value": "T133E3E111BB84D833D81955315838D7A0A67A7C20846B8E873B4C3E6FAF723D26B79357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205996, "uuid": "3f439d6e-0566-4cc7-bd47-42877ae3a98c", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205996, "uuid": "21abbe33-abd0-4818-8f23-528e83f5c483", "value": "3072:dwWQGTc52JaAlXYtMX4t/TM4TOACqpGaaaaaaapBDr05B:VUEItMs7dTJHpGaaaaaaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205996, "uuid": "6406dbc7-9218-45e7-b58e-86ea7077731b", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205996, "uuid": "191bddfe-db23-443e-9f1b-f9e7d521b4b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205996, "uuid": "81d1ff3f-729e-426c-a971-6e54432ee45e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8219cb14-3dc7-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664216260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216260, "uuid": "c7cf91f6-4fb6-4ace-965b-e55675fbd421", "comment": "Malware payload (Loki)", "value": "64e10f0feb194632de8fe1f0b528cb7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216260, "uuid": "d8d92f98-08b5-4aac-97b8-88d8cf89a8d4", "comment": "Malware payload (Loki)", "value": "eccfc5888449406657ef83575ad83259be5452aecd19f38b98f9f80ddf1bc3d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216260, "uuid": "ef73e642-85e1-484d-a753-0c52c05f0bec", "comment": "Malware payload (Loki)", "value": "413e3036220aacc94d98dfd2f8d140a7d690053f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664216260, "uuid": "bd1050c2-b859-4d51-a8e7-35bf04792d03", "comment": "Malware payload (Loki)", "value": "1f757b6b0c25bedbe459dbde199709ae28d68ed52f0fd004011ce9d40de82902dcc2b684a2909a387d49aebcf565e8bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216260, "uuid": "36028aeb-d284-495b-af0b-28ac56cd9721", "value": "T199F4AE14176DCE06C879A570CC93E1711BE76DD4836AC23B4ADABCB7F236348E993261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216260, "uuid": "86b4b969-894a-4b44-8513-83cf91863baf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216260, "uuid": "ee9624fc-a50f-4cea-b939-0a165c02e89b", "value": "6144:jIsfih0m+3no6/PNLfGbde+ZL6mbsMAue/467FB+aVMlXJt2B71RC4oRuoMYXYXU:8dey6mI8GFt6Ls/4RaYoXwTk8oCsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664216260, "uuid": "4ec06c79-8171-48c9-bc59-c4b77ae15cf3", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664216260, "uuid": "8583bafb-e92d-4f15-a5d5-dcb6a8fe934e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664216260, "uuid": "f1120083-8c96-4b7f-823f-fadfc16a0c12", "value": "S.A.R.L. MANCHE ATLANTIQUE-EUR46,783.17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf21a41-3d5f-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664171448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171448, "uuid": "b64eb600-21e7-4393-b806-1792e5d12984", "comment": "Malware payload (Stop)", "value": "2ded1c94095192fe4a80b936fc23b8ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171448, "uuid": "05a708b5-70fc-4626-a304-13bad22b6604", "comment": "Malware payload (Stop)", "value": "ed09ef7ca783ef12aed593f11e5904b449d2e9744217b1e4abb27a0c2e186eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171448, "uuid": "229df630-9883-432f-a79d-d809b2457e4e", "comment": "Malware payload (Stop)", "value": "9c55887b9430de35df58b9f50d85f9f429d83d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171448, "uuid": "c41b666a-e076-43ec-aef2-9ee3c87e68a5", "comment": "Malware payload (Stop)", "value": "8db8a469546c88489b079675c784e816a41345918beabb9cb183f09d8469ec5eced47926e596ad6da3a3c0210f39c2b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171448, "uuid": "1be1ce20-900c-4c14-b194-76d3fe3de903", "value": "T1E1E423517BE1B875D14145F11029E3F0DAFEBA201A821A8A3A599B2B3F733D3B734355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171448, "uuid": "b07837c3-df27-4350-a1aa-d64858899c98", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171448, "uuid": "5747e5cf-f1a3-45be-9f60-434b4a9e624a", "value": "12288:NK1aeB7ndkYYSdFUQ123dtlCrBJuMwGGgcqOZnwwcVQGEeVRnjKQV98w:NKc47nfbrvGHqOZnwwcIeVRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171448, "uuid": "fb4f6496-592f-4038-aa58-322bf5d637b5", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171448, "uuid": "d5c2f342-251c-4dac-ac6a-a3f5e3bb23fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171448, "uuid": "7bfe0c17-928e-4548-86fb-f9d5ef1cb930", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f012252-3dbd-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212014, "uuid": "1014fd10-e2c6-4ff9-b176-2eaa6b3b91bd", "comment": "Malware payload (IcedID)", "value": "d26f2d21583aaa72c8e2545aac62257c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212014, "uuid": "94bf048e-ce0d-4b86-8e64-018e8bd92f9f", "comment": "Malware payload (IcedID)", "value": "edc11aa4b1212f620cc1fc0c12d79dee23511467a7fd955e9afad88ed250e765", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212014, "uuid": "1e91c42b-a5a3-4918-8275-459b7e5f3c95", "comment": "Malware payload (IcedID)", "value": "44da404bb478c2a6fa5c205a12a4cfb81b558f91", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212014, "uuid": "92d2b213-27f2-4c7a-99a0-191fd9507b2d", "comment": "Malware payload (IcedID)", "value": "db63c896bcec6328298f2347125d32ae3e2bf2e549cd8b07b588a1978b7d0e61fd3f6443a4f629584e5648a492f28383", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212014, "uuid": "55106141-905f-4e30-bc51-1c87119fba5e", "value": "T12015F101DF40646BF00B693B371365C7B8A61C27348BDE0A6B96112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212014, "uuid": "5b54f110-0d66-4127-9450-38d71f1e3bf3", "value": "12288:FmdVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEtv6UgJWjpruMms:8dV2jUeQRI5wPN/giUgAiMms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212014, "uuid": "a0152293-4372-4a3b-8c7f-3b4ce270c742", "value": 887165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212014, "uuid": "8e7bd931-7c2e-4866-a147-8854ebe591a4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212014, "uuid": "5a8eb199-ea8b-4ec3-b17c-28b2229ab343", "value": "myfairpoint-file-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a4128b-3dd2-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1664221075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221075, "uuid": "2dbc68e6-f29a-4be2-a1af-1e099bf53457", "comment": "Malware payload (ModiLoader)", "value": "6048b7d63c1d99c4b6d1732fc6d941ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221075, "uuid": "173cb8a5-c428-4c50-86cc-19f7f709f4d2", "comment": "Malware payload (ModiLoader)", "value": "eddd07b69b4942f144f84ce2f03c6785b8c770a6f226c5d0f31c47bb147e7367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221075, "uuid": "9991de70-e237-4bfb-af28-7b3ac5243777", "comment": "Malware payload (ModiLoader)", "value": "524a1d0da58ad8bae9cf5f07a219985679013377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664221075, "uuid": "298c1a1a-3c01-497c-a32d-2231ac071883", "comment": "Malware payload (ModiLoader)", "value": "547bcfc1f1e5c5ef69697cf79d2c860f9dcb7bee0c9f82d83c6163f3d149f2cda659fda17b562cdb76d587ff1108268a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221075, "uuid": "27d08372-85aa-48fd-8272-dfbe188c499e", "value": "T156256C21EE92483FCD331678CD36F6A9941E7D102868EC8AAFE55D8C0F3724D7825697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221075, "uuid": "1addadd7-fadd-4ee8-85a8-9ae5ff9a5960", "value": "bb071efdd9e5c0f4b6a51f23cc10db13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221075, "uuid": "b68f9b5f-77f2-4171-b26f-966c5fbab54f", "value": "24576:VkUwSu91iUJodQ/UbMV2i4rpNXeaqnjD:Vw9tyi4NXeaqnjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664221075, "uuid": "29fe321c-4583-46a3-8e16-c1d6245484fc", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664221075, "uuid": "ec3a4a28-161c-4044-8095-b9f96d0a53bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664221075, "uuid": "58fefe08-6143-44f4-99c3-95d15b219d77", "value": "FCL CARDLOCK INVOICES - FORM L503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8fd804-3da5-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1664201517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201517, "uuid": "c574292a-0253-41e3-88de-d4af9159cbce", "comment": "Malware payload (GootLoader)", "value": "a272b01b579b25bdfae1f908732c2946", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201517, "uuid": "8ecbf766-a6c0-43be-821b-90131a37bbfb", "comment": "Malware payload (GootLoader)", "value": "edee70cd7c81d57f16195b46f6fac52be21eec34b70178e375062a89f8241fe4", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201517, "uuid": "6081c36f-fd90-479b-a968-5da243d2c538", "comment": "Malware payload (GootLoader)", "value": "556613fe370c9459a29daf9189e762d65b5e4022", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664201517, "uuid": "0abdf625-f2c6-4825-9e47-9cc65ac0224c", "comment": "Malware payload (GootLoader)", "value": "b414253cc6848c7556e30262a709b5c0c34ba98bdf66126575106b427d87a1c8bd6b84c8128e0d68bba8a08df5006618", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201517, "uuid": "3c642d28-3bec-4749-a9bd-9c720c12984e", "value": "T1D1B4A40EABEB332AC51371799F5F9004A535840B661AEC1D7D4C93880F5863D9ABBFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201517, "uuid": "48afceaa-31aa-4456-baca-96df9238f231", "value": "6144:iWrQ0CSTWulaxl4khEfD5xA7siagmd4iLAmWR6TFI:xDKhEfD5xjiagmd4iLAmWR6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664201517, "uuid": "ec5a7046-66e7-4c21-98f8-00e34a7a5520", "value": 495541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664201517, "uuid": "5ca911b8-a3e6-44a6-9016-77dc96f991af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664201517, "uuid": "4d846715-cb94-4ace-9fa4-e14b87d8b985", "value": "Divorce_after_separation_agreement (pnlhh).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5835c4-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1664179265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179265, "uuid": "1c273a17-98d9-410b-b767-da945499aa2b", "comment": "Malware payload (RemcosRAT)", "value": "c8e4087e3aaf79e41559ac959d075c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179265, "uuid": "4197664a-d3ff-4cce-bcef-c434b6c6315c", "comment": "Malware payload (RemcosRAT)", "value": "edf9ac7b5f34212d1f8868cda2909fd6394eb6f72d82e7690d5ea9f18b5a70f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179265, "uuid": "c4fc2cea-4388-4c76-b0ea-03913e7f5c98", "comment": "Malware payload (RemcosRAT)", "value": "0db98271715c0e58578ecd52d0bac163fcb67112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179265, "uuid": "91e75af1-5a5a-4eac-8485-72edc0bb63f1", "comment": "Malware payload (RemcosRAT)", "value": "b20dc50182b918d686d8cd5b1135b3cdc6d0edb7be604bb75bab13f48860bf64647f390c4842d0a4b598d10004245c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179265, "uuid": "a85e59fb-5d2b-4315-aaba-5a06b475bbc2", "value": "T146D1C501AF8F4733CDA51B7EECA347C1527CA6239953E7AF8E40611B2C557860A42EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179265, "uuid": "46dcd24f-b93a-49a0-b708-a2d821046c67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179265, "uuid": "ae7e6d3d-7985-44a4-b6db-a52df0fda3b4", "value": "96:BvtcM3Mdc4T3RXLIsJcWjeCmx2pIwVj+UG8lnw9QBEtrcFnU:0MM39IPLDxoVjrw9QShN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179265, "uuid": "a62bd2e4-2c10-464a-9d91-01147b0cde68", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179265, "uuid": "f8f52454-d9b7-4b4b-a0d1-0e49bc11f85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179265, "uuid": "f4546c09-bfab-45ff-99a1-a569c88ebd22", "value": "Quote 177108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88bd88a-3db5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664208621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208621, "uuid": "ca63d3b5-6abf-4911-bc07-001477eb6fd1", "comment": "Malware payload (Smoke Loader)", "value": "7bd537a8dfa91ec83e264ceefe3f0e26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208621, "uuid": "13355f34-c616-455b-87f9-958fceed4fe4", "comment": "Malware payload (Smoke Loader)", "value": "ee0129de26021b66dcbbd902963e1f4dbef5688c76984484a124b0914f8681ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208621, "uuid": "91ec0328-481e-405d-ad9d-db3fc17550db", "comment": "Malware payload (Smoke Loader)", "value": "b1ffa33c2760f23d4de2900907273c9736f82557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208621, "uuid": "725684f4-adc3-4d93-8450-a5386cdb2a15", "comment": "Malware payload (Smoke Loader)", "value": "423df692f006cd8053efeed58d457c92dfb4c5567848b0921b602032c4ced1aa463646f7b65a582781077ccab4a0155d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208621, "uuid": "6a1b7517-958c-4ca1-a047-a5eaba217999", "value": "T106E3F101BB40DDB3C02685B54835D6F1ADBB78615A2A594737882E6F3F313D2AB3E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208621, "uuid": "65c3be83-2970-44a4-9fb9-7a0b3166d3fe", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208621, "uuid": "7bc6869b-8c5a-4516-b682-432db0781dff", "value": "1536:U3SgqQYcZsSPTyGTc5BZOsv0sCXhlJpVTbXQ5VEPl4SknT5jmFQtjYj1Ei/WV/Jz:UCgJfJTc5TZeXFTbXQAGSc5+vBaNl5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664208621, "uuid": "762c85b4-ab31-43a8-afff-8faad58eed4d", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664208621, "uuid": "7a2e08f2-e759-4447-8d9f-072a75dbb27f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208621, "uuid": "320183bd-c675-40eb-89f6-294c0b10e928", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75943012-3d83-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1664187034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187034, "uuid": "fe124e68-5293-42eb-ae9a-4df3175efb55", "comment": "Malware payload (RedLineStealer)", "value": "6c036f7df37445d3befcb8ba355232cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187034, "uuid": "84deda7f-00c8-4da3-8464-709c66c3fade", "comment": "Malware payload (RedLineStealer)", "value": "ee3c294f01f655f4613e6fd01bb1f04d9cc310fcd67a1993455b4722184fc92f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187034, "uuid": "a86f002c-fcc3-471f-8636-32396f8162fe", "comment": "Malware payload (RedLineStealer)", "value": "07a884e03e28ad819c4d05ee468c889ac17a4b02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664187034, "uuid": "ba92af47-4f4e-44d0-a925-343efb6692c6", "comment": "Malware payload (RedLineStealer)", "value": "6ef486164399db055393c2ec341779ec526fc49a6b0d57c4452d385bffa59bf99fe93187d99a1b0c9a7d3e2380ec34a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187034, "uuid": "19081d4f-bc31-4de7-bb76-aea88f38bd5c", "value": "T177E3E001BA80D4B6C42651B51C26DBD19B3EBC11543A9A873B54AF3F7F313C26A7B31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187034, "uuid": "0b362b71-2b5b-497e-bf87-3803be166f5f", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187034, "uuid": "46ce6c6e-0814-48d8-aed2-5d7baa177c41", "value": "3072:+d+Bz5Vc4tqvHp9CcZcZQ63gUBt5iky5B:3c2qvJMcZs3g6ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664187034, "uuid": "13b79ded-6535-4f12-9dfa-5c08bc480026", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664187034, "uuid": "4078c23e-8550-4724-ab1f-6aff75cb4465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664187034, "uuid": "2797cb6b-46f6-44f9-bef0-9535a0fb6906", "value": "6c036f7df37445d3befcb8ba355232cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a3229a-3db5-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664208369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208369, "uuid": "bac8e27c-219b-4e27-942a-8edda6e95911", "comment": "Malware payload (IcedID)", "value": "b5da433a92cf5d78f381a18b0a3765b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208369, "uuid": "886b5a99-b883-4e13-befd-af5ef4bf5e52", "comment": "Malware payload (IcedID)", "value": "eeb435fb0f0109b20bb9e984d4c05ea0aa3e935d9ed61531ed036a5d23fc3d3b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208369, "uuid": "e8bd611d-42ce-4ff5-b847-cb5f631adda0", "comment": "Malware payload (IcedID)", "value": "089cc900b9e9a7167c9bcc276be3e8e587181b86", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664208369, "uuid": "78c02fe2-6e3e-456c-897f-5ed65812e08e", "comment": "Malware payload (IcedID)", "value": "2c23b33ddc1e79e0d23065b5ce9e2171a5c0585907455bd574d1dd5a6ebe092431f4e183df1cc18076068c52e8203095", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208369, "uuid": "c29c3720-8099-4a8d-81c3-e25c465c59bf", "value": "T1376408D9B7D2B0A6C3A3B474403F110BE27B6D91B84DD894E146D5D02DB8A9E807BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208369, "uuid": "8b02cc36-e1e3-45f2-b186-ba0e4e9e7a4d", "value": "43477103f62b5dfd408bf7b94c0e3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208369, "uuid": "f2c6db9d-c228-4ff9-9847-656ad1540c3b", "value": "6144:jJIId9kP7+sYAdo9ZvHsJge7lfh+mQVri2VrpgEhBvx:39kP7I/sm2lfv29pgEhhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664208369, "uuid": "1569e868-7a5b-4dd8-90fe-4d5138074652", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664208369, "uuid": "6d61f083-04e5-4eaf-8f52-5f14d8261055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664208369, "uuid": "8a772118-8d33-4443-a4e3-05c7338232ca", "value": "b5da433a92cf5d78f381a18b0a3765b4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cec368-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227217, "uuid": "3eac77a9-54a6-47ec-85bd-ea3a9289f9e0", "comment": "Malware payload (Mirai)", "value": "2c5909a2322d3051a170f8da2ba232ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227217, "uuid": "23a1b13e-78d4-4875-ad7f-2176af6f30ff", "comment": "Malware payload (Mirai)", "value": "eecaf2385bf30deee3894d05538e5b541efab78ee4c50b8c8778151ff49a7b6e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227217, "uuid": "009a2502-f827-4fd5-b5eb-0f87b892b4fb", "comment": "Malware payload (Mirai)", "value": "ac829ac0a8af1937c451356a250968520b8c8a1a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227217, "uuid": "6c99e620-b8e6-4710-a611-7e1be939b274", "comment": "Malware payload (Mirai)", "value": "2356b9148c341849c566534750d7c1c790bbd58cc2877255fbdb590e0d98b9e1ec55b81665ee82ad3e4ea7b4ceb1fb0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227217, "uuid": "92f9aab1-46d0-4464-814c-cbd27b51bf11", "value": "T1EE13F121B747EDE281D216B3C56D068BD9720BAC58BF761692705BE6348207B1DB14CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227217, "uuid": "7db190c9-5e8c-4acb-ad75-14d99bb3d9f1", "value": "768:0YSYg/vwr0PQoU+2XhSC/BMlUr9RXc25Od58j0qFB8gqoZp7ITkTnF0TKfc9q3UW:0Ye/Ir0v9OhJ9RXc25O360qDVZp7ITeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227217, "uuid": "340d453c-6689-4ef7-b05f-15586598ed76", "value": 45264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227217, "uuid": "74379bb0-c612-418c-9d77-1b94812a9697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227217, "uuid": "ca7342cd-8b3a-440d-89c2-1fd8d3853863", "value": "bk.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a570490-3d88-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664189082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189082, "uuid": "8bd0dd4c-a746-486f-b5d7-2a783707ab38", "comment": "Malware payload", "value": "2ff3e6c9244ef965295aa60879d1aa6b", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189082, "uuid": "9f50a982-f5e3-4fc6-8821-8e098ccc6582", "comment": "Malware payload", "value": "efa5b49bdd086125b2b7d4058d09566f1db5f183c2a6332c597322f85107667a", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189082, "uuid": "e2986fe9-2234-4a95-8402-a9d78eb5f60d", "comment": "Malware payload", "value": "4c813ad68f2f1da6b2c59d11ad983cfa65e1a187", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189082, "uuid": "6c18b7eb-d351-4e27-bef0-24c7344caa31", "comment": "Malware payload", "value": "c3534990a578cad43fd6924f9616216e668f4e3dd99367e42167ddaea0f661443b1cfee2223064a5d80f73c677bdb047", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189082, "uuid": "2225eb6b-ac57-40a2-82cd-9b33e0d4ce5e", "value": "T1BAC36C0B77A540BBE1768179C9A30A05E776B8115B21DFAF07A4425E1F373E09D3EB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189082, "uuid": "9d72db42-ecce-4842-9a36-131d43f29ddc", "value": "ed5ab7c39c2b933b81af0bb927d75905", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189082, "uuid": "893416e2-d71e-40e4-98e1-7264a71e3bcd", "value": "3072:BUvPPcrQq2YWLrtveOOVtuk+kLWWKMX7bL8:B7QqUJWOOV8ksW7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189082, "uuid": "8c7a807a-c2bf-42e3-838d-394855371ab6", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189082, "uuid": "fc3d7cb0-7d25-4026-a218-9841362578d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189082, "uuid": "5df4fe52-87c8-45a7-badc-3b8ea916850c", "value": "IMAPI2.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b006cb39-3dd1-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1664220632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220632, "uuid": "abcc4478-9aeb-4166-aae4-1d3234491ba0", "comment": "Malware payload (RecordBreaker)", "value": "0cbb51177f5f2fac1a47cbef4f0fcc05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220632, "uuid": "84932084-87e1-4e73-ba00-8be7f65aa418", "comment": "Malware payload (RecordBreaker)", "value": "efdde7ad07e1f9ad68057cac1c1b35569288be07eca765b0118fff931bd8350d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220632, "uuid": "3795ce48-63ad-48ff-aedd-dafb126691a9", "comment": "Malware payload (RecordBreaker)", "value": "182c62f35bf0fff944a286c565c7280bf0cb551c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220632, "uuid": "45776df0-35f0-4247-a529-030f760916c8", "comment": "Malware payload (RecordBreaker)", "value": "5098a97b902f77d0a6dcd8902a56b070ff2aa4f60209d9982db08eb0d00992e92a94bfbbaf556b577837e7350ac3fbe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220632, "uuid": "7c677aa0-2a5e-46e1-8071-059169fe5368", "value": "T16514CF01B7E1C876E322F6704864C7A16B3ABD5F5B7448B73754262E1EB3390ABB5306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220632, "uuid": "c559a8a0-cfe9-4c79-a34a-4ecc1556f4aa", "value": "07721271df7f5e49288f4614c6aa862a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220632, "uuid": "80d66499-a646-4fa9-95de-690a0d279aab", "value": "3072:sUzLKw8wV5/4zJJTybvq0VihBh/EbjtUWV+Wu/N0wipTTnpZa9uD6Vdyhk:JzL18wT4zPyVEsb1V+R/N0wgTTnwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664220632, "uuid": "17c05871-b190-42ca-bb14-8060cddfafd9", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664220632, "uuid": "a5fc8161-ca50-48f0-9fac-1dd9eee3afdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220632, "uuid": "15db95d6-dca2-4d0f-aec6-af7399fc396d", "value": "EFDDE7AD07E1F9AD68057CAC1C1B35569288BE07ECA76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc2f77e-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1664191534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191534, "uuid": "a4787401-0c95-4ed3-8c9d-0e79d3b51493", "comment": "Malware payload (Loki)", "value": "43c71839df68519d641f67883c2a0967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191534, "uuid": "63c45d75-4a5d-46b0-927d-7cfec567c8fa", "comment": "Malware payload (Loki)", "value": "f0c82cb9c1277e853db8f265702e18d7c875289935e34f26e459c3d16de4f82c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191534, "uuid": "37ce5ab7-b5a8-4723-addf-1cef229395d0", "comment": "Malware payload (Loki)", "value": "ae10b646fa7539ac6f158516caed6ab26a8baada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191534, "uuid": "db23f976-dc76-4b0b-b8d0-01686863f4bc", "comment": "Malware payload (Loki)", "value": "8e624ac2623bd78a9929730b8f3df03ffdb5248061defb6303db875e6e78b41bbe0ed8be3a173344db149bf19757bb3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191534, "uuid": "65caae6d-e034-4417-88b6-e108e114579a", "value": "T10134CF11BB90C573C8A607315AB247656776FE606A52170F2348BF6F3E737C1483A2EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191534, "uuid": "99c779fa-38bb-443d-9462-fed021e1168e", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191534, "uuid": "48d8e58f-fc19-48c2-8ed8-60c4a64d8dbe", "value": "3072:Pkhohwq34yuQzQWqrJKZKbRXCgx4zrneHoXxeEdPggEv0u1QvuyD62Pfm:sIw3I8RXCWyeHoAEdPhEv072Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191534, "uuid": "e0d818c3-4ee2-47d2-b44c-1f1300a358f9", "value": 235304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191534, "uuid": "6e0e5e0b-064f-4e1f-82bf-8f9537b9f3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191534, "uuid": "f0c27466-0cd7-4d8c-83a6-b32e3df019a7", "value": "Sosialisasi Bidding Tender 26 September 2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf61a8aa-3dc4-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215075, "uuid": "e9af1fa0-e26a-406b-b1f4-ab4c4a187db9", "comment": "Malware payload (IcedID)", "value": "88007b0a9fe81f81d5cabb9d39a301db", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215075, "uuid": "384512c1-e56e-4f25-9f94-4f2cd26ed499", "comment": "Malware payload (IcedID)", "value": "f0fe9a6eb424f7e7c63ff495b7576cfcf29676ae9dc5b8539808f5ffd763be5e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215075, "uuid": "09100950-63fc-47c6-bab0-2b2567b70720", "comment": "Malware payload (IcedID)", "value": "de1b4ca520bd7c8d98b879afe8ffe2efc2f88c19", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215075, "uuid": "eb9308e1-59b0-4252-912f-776ab697cdc5", "comment": "Malware payload (IcedID)", "value": "93368a39216a6868b6b2428f8ccade9334addcbd9b3ad03df7a82e624120dc89179c2cce1eee9adad9cf266e253c648e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215075, "uuid": "05337855-6562-476e-82af-4a22d20ef31f", "value": "T19015F105CF50206BF00B683E371765D7A8661C2B708BDE0E6B96112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215075, "uuid": "2573ba24-74cb-4f0b-a9a7-c6f4872e4289", "value": "12288:rfHdVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEv0y2aRtxzFZjFc9:rfHdV2jUeQRI5wPN/H8ZHc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215075, "uuid": "a8cec66f-4048-4303-82bd-908edbe07f0b", "value": 886893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215075, "uuid": "5458d38a-36d0-400e-89a6-a23e5c889248", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215075, "uuid": "d59f0256-1f1a-406f-8929-dea526121f66", "value": "joejeterfile09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9ee2b1-3dae-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664205734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205734, "uuid": "55f7d461-602d-4a1c-b1c7-959089f3cdbd", "comment": "Malware payload (AgentTesla)", "value": "77295f43fe79935461630fb56171e065", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205734, "uuid": "73bca689-b622-401e-b842-edc23c6b581d", "comment": "Malware payload (AgentTesla)", "value": "f1a55c7e52c3009f36f058f704279b35eee54bcea92010f883b559f44db7ae23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205734, "uuid": "992e77ea-520f-4ba9-a90d-b8fec6c5606e", "comment": "Malware payload (AgentTesla)", "value": "316c1b75f66a769bbe392475d92f482700e0c4ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664205734, "uuid": "69aa5cda-7ec5-45cd-8065-56e70e791991", "comment": "Malware payload (AgentTesla)", "value": "c8916c4b8d3693a29f2706e44f6832c7b3b9c0d256b65be198336dd9cfff65830e7e633d63f36eb2e8ddd67c4b5f5aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205734, "uuid": "f2d2ae6e-cfbd-4cc9-af53-1db4f35ebbc4", "value": "T1EE25085831E6329EF46BC6B58FD87CF59A56F272531F5177607302898B2ED82CE80872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205734, "uuid": "5de88a71-21fb-4936-84ee-4092fa4008c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205734, "uuid": "bd01c933-eb7e-4fe5-854f-632df0a00aa4", "value": "12288:PIo2BKATEygQGo6pxq8ZfeFjnF3L9lMS/maF8IqjJ5nggi5ZWmeqOFKUtVQIja96:PIfBp8FteBB9K9m8Ljrgy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664205734, "uuid": "85092d1c-202b-4072-bc1e-c14a6a00a96f", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664205734, "uuid": "f4ad403e-6ea2-4616-bbf5-751ca865acd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664205734, "uuid": "a8a550b1-6889-4034-841e-516c6c056340", "value": "AtKchJOWoiymT6A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4ec051-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214670, "uuid": "8b9dae44-e2d4-407e-82d7-e837a9140505", "comment": "Malware payload (IcedID)", "value": "b60773f08e36964d7613ec7e24e7f11a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214670, "uuid": "33f96ee7-fbdc-478a-828f-4fb1fc886c29", "comment": "Malware payload (IcedID)", "value": "f21f2c15e99a4701452813233b3b5b8a20caf54e6185bf25d4dc733b12eb6426", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214670, "uuid": "6f63a539-5e76-49cd-bce0-c7fa5fe0f21a", "comment": "Malware payload (IcedID)", "value": "9ff60d3f1100b7d368b7f72d0b7c56cd7afd3cb3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214670, "uuid": "f648120f-f7ae-45d5-8367-1f28d3988b28", "comment": "Malware payload (IcedID)", "value": "0dd3edc6c3cf20c06a6da95f378285de3a08714853f104eea45ec0d2c703d65c49454dce6e11c1c535be246b354b993d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214670, "uuid": "d3a37467-e13c-410a-85ca-7604479b1870", "value": "T1DB15F001DF44216BF00B693E371765C7E8660C27348BDE1A6B96112E2AC7FA0FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214670, "uuid": "3f79bcb0-39c9-482a-9f90-a67818e5a55c", "value": "12288:lgVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE28huuV+/3P6OOssaxso:mV2jUeQRI5wPN/DYVV+6sNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214670, "uuid": "a0ba1bdb-026a-4329-a097-d0915454acee", "value": 887925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214670, "uuid": "d1aa1118-ffb5-440a-b29c-6f0fb9afd53e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214670, "uuid": "9b41432a-e3b0-4e2f-85bf-0ede9b0eee40", "value": "koppdesign.invoice.09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b696d20-3d4e-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1664164280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "7bea2f4e-1032-4ebe-83db-5eca4dc6d329", "comment": "Malware payload (TeamBot)", "value": "be78e3262b53856b77411b5b70640ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "2b0d9e9a-799a-4fa3-887b-1e60ecb45171", "comment": "Malware payload (TeamBot)", "value": "f2546acba0eb0e80d433af9ac4bb4aaf22dece0c9f86dc2abd5287046934aa53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "c32d1fd1-d95f-41da-a71a-9f7760546a88", "comment": "Malware payload (TeamBot)", "value": "9d68f5a87d24ed54dd99a33817d50e834482a07e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664164280, "uuid": "05dc68b3-5d1a-400c-b0d1-3d7a709983e5", "comment": "Malware payload (TeamBot)", "value": "24bf8a9da7014d0b2309e471fb67bd60661d5c644e022655c53d6e15bba6517384a15b33938530293dab8e6bfb1081a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164280, "uuid": "d10cc5ad-76af-4317-9dd8-45ea28ce1fd5", "value": "T1C4E42340B7D4E031E9811EB12835CAF499DFA4514A37295A37842FAFBFB0282977937D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164280, "uuid": "f79bd21a-0b7c-4509-9091-261f9ccfa6a4", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164280, "uuid": "9f9e79e8-4edf-4c5a-ba74-f8445f9ed25e", "value": "12288:0agfP/GGb8B4R2AFq8/1z/qwDcsa/xc0yIpCagTX8mQrv:438BrAL9bqwDs2lIEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664164280, "uuid": "b74162be-0e81-466e-b2b3-e54f246fe0e3", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664164280, "uuid": "af8b8e18-b2a3-418c-a5ca-082e88a7dfe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664164280, "uuid": "94256708-f473-4994-accd-8109345c8836", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a08c91f-3d74-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1664180411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180411, "uuid": "002d0cb4-8308-43df-8387-3aab70b14f64", "comment": "Malware payload (GuLoader)", "value": "acb17c80f75aad05a4af797173b95f09", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180411, "uuid": "1ab3e54a-1650-4838-8692-e203ef80a23c", "comment": "Malware payload (GuLoader)", "value": "f258b776d8b7b53bf49b27066278a25b97fbd813003b5ec14179e3cf90cb7059", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180411, "uuid": "e339cbe8-34dd-4abf-80be-049cf39b5e7e", "comment": "Malware payload (GuLoader)", "value": "a5855742e633ca37fac4738c2c476a86df352eb6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664180411, "uuid": "48806559-9b47-4f29-9f7e-16d1990b5403", "comment": "Malware payload (GuLoader)", "value": "db57fad74fc1bc39315d01edf5a526f28c7a07437c5a05de7bb10ff183cd59f529accf460d73e128750e8cdb18b11a1a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180411, "uuid": "db4b4565-5174-4964-bba4-5281fe3d0723", "value": "T11E14822F8D10EBE0F31DBF7EC3422E69804C911683A119AFF65B54ED6B9130487959EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180411, "uuid": "4870333a-0857-4511-89d2-20fcd47bbf4d", "value": "3072:FK9MWT3/1suNY4FHLYHZHZzxgwpbErevM8K4Ec5CqT:FK9N/m6H8HZHZGwpb4e3Ecw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664180411, "uuid": "28c23497-437f-4776-b331-bff2aae3c972", "value": 200407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664180411, "uuid": "f5ac75d8-e3e8-4bd1-9a47-dd6c66605caa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664180411, "uuid": "72620ade-112b-4404-9606-9499346c18d1", "value": "195727592-042128-sanlccjavap0044.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b5c8b0-3d46-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664160920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160920, "uuid": "347fe00a-58be-40be-b1d7-44f82fe84c54", "comment": "Malware payload", "value": "3a062a0e4b394022dca336d3cb0ccc2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160920, "uuid": "05725dec-5a31-47b5-9de9-2a4d247d1af8", "comment": "Malware payload", "value": "f2734d702a76fddcf1f6683b289b3d68cbece905ec6a4951ecf500ef8ee966ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160920, "uuid": "f3639f27-196f-4b97-b894-a361f45e1c90", "comment": "Malware payload", "value": "b03abe820c0517ccef98bc1785b7fd4cdf958278", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664160920, "uuid": "964c7633-fa0b-4940-8412-03e1e7ee6042", "comment": "Malware payload", "value": "4892d28f58a9a66fcc5443a2850cfbfb08ffcea3ebe051b5f291639d1eea9c1b744ff08718618e5f8c66a3c94eed70d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160920, "uuid": "d6d00efd-46ff-4f91-b5d4-d74cf9bf9084", "value": "T129736C0136D591B0E4BF0A3914B88A020BBF7D32DEF19C5B7B95154E5A706C0AB39F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160920, "uuid": "d6ebe1a8-010d-4f30-900d-d3ad43ec179c", "value": "3ca0f398d5cffd32f05575c1f2675de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160920, "uuid": "4022383c-d055-4c00-b670-1fdd0ea48a3e", "value": "1536:JUoXz4z/NWqX9ZUY2rMwz0TTXTU4sHc+KGsWjcdex2:JUoc4eC0g4OCex2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664160920, "uuid": "beb48de5-9b34-4862-b8db-a4ea880549fd", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664160920, "uuid": "34c2ba9b-cc5e-415a-944c-a71722047258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664160920, "uuid": "5ecff25f-4900-4fc6-b2c2-389d057fa909", "value": "f2734d702a76fddcf1f6683b289b3d68cbece905ec6a4951ecf500ef8ee966ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d423f3a-3d69-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664175692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175692, "uuid": "2c7b5863-f979-4efd-80e2-70fd3e3f7c53", "comment": "Malware payload (Stop)", "value": "6db6406b162cbe871336865236fd3ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175692, "uuid": "88e78bcb-3b66-4f0a-a1c0-e64ed0e0aa83", "comment": "Malware payload (Stop)", "value": "f27e3782071b9d5fc1ea33fb2509a9c0c8f19ea66e88d12d5ea01f27cd14a44b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175692, "uuid": "bb60d857-9668-4d65-9691-26311fc0dcde", "comment": "Malware payload (Stop)", "value": "199be15296b2db97bb114c9ae685b3647af2e684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664175692, "uuid": "b0073737-e01d-4cd2-9d0a-0b399ab385b4", "comment": "Malware payload (Stop)", "value": "1484b75bbccc0dd75843b2ae91fdf8d0d37cbb9fcafa32d1d8fd3bd9f201f007cf636ab30c13a0334d0a010cb446d5de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175692, "uuid": "af15f585-d948-4fcb-928f-ac9fb0bf7739", "value": "T1DDE422547745EA73C4743BB01D39C792E835B85109236A92BF282D7E9E310E0E9E7726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175692, "uuid": "b2a32956-a2e2-40ed-bf91-4a8a06e46724", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175692, "uuid": "baaa3887-43c9-4f71-8f5e-9f1ea582d44f", "value": "12288:Epple1tTKr4UnsbO1j9imJyq+Ny7rNO/mnBoZpopvSPR:ELc1te4UgOGSiNqrQmn2Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664175692, "uuid": "f62ae216-3171-43dd-b9d4-d04b289b4815", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664175692, "uuid": "b14a5385-4cd3-4c15-9b95-0affff496298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664175692, "uuid": "9e205c99-4e5c-45c8-aec2-e746893a5d3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654d5c90-3dc2-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214065, "uuid": "43c8b25f-2c84-4e2c-a54e-f0ab386aa9d3", "comment": "Malware payload (IcedID)", "value": "3a705c0798cf3011538bd453891d63be", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214065, "uuid": "eebdc042-4fa0-45d5-b534-853f79dcccf2", "comment": "Malware payload (IcedID)", "value": "f29e633a2bc1afed5f4dbfb62d82e47754d8f0d31dd247f62febd8810e1fe881", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214065, "uuid": "7f53bb13-a5bc-434d-9890-48959f2fe65d", "comment": "Malware payload (IcedID)", "value": "08f21a92bd739931da58913a3f16863396925b0e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214065, "uuid": "5888ba77-66bd-4117-97d1-2e1450845c2d", "comment": "Malware payload (IcedID)", "value": "70ed25c8079fb638f6119fa0af8ff289a9d7a79144f6f8e69fc77b6ad0749f7e90d0c7819ad596583d5893a81f29ccff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214065, "uuid": "57cd925f-3add-4afd-8e63-68ce9fd8727a", "value": "T1AB15F101CF50206BF00B697E371369D7B8661C2B748BDE0A6B86512E29D7F60FD39C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214065, "uuid": "035de673-d313-45c4-a86b-16e969022199", "value": "12288:bDVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE3Genh1IM4H/kaD2G4:bDV2jUeQRI5wPN/7Q1IMYcaDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214065, "uuid": "d360a231-df81-44a9-a1b3-8cf013d28764", "value": 886645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214065, "uuid": "0a127b3b-8422-4603-9236-a2160e536b80", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214065, "uuid": "28c88f71-1890-4f24-86a8-ca3f1c24c330", "value": "kaamila document 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24ee6b7-3dd5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664222435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222435, "uuid": "9e2ba71f-83ff-4d7e-80e0-d4a6d27236e1", "comment": "Malware payload", "value": "b7352ac59ff8521214f0805e9cb7404f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222435, "uuid": "8b66868b-141b-4f5e-b0ec-9507ecb12d27", "comment": "Malware payload", "value": "f2bc3cadbad4fd812ac6448007a28c1cae57b751b4736608a58c695fa3064c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222435, "uuid": "d0757a4b-ba6e-402c-b0e8-0634ebfa9be1", "comment": "Malware payload", "value": "0552a507d084ebd13447bb2221c99ee1a2649388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664222435, "uuid": "bb790eb7-3483-430f-91f1-e9afb4036944", "comment": "Malware payload", "value": "820e1af2a635ec6f95aef3a53314dbd84b3198a0e7678726851e67d3e9555026ce560e2010cc1711bd8a92b0f098c401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222435, "uuid": "270e0840-36c4-4da3-9989-3ae14e66a78c", "value": "T14776338BF4D78876F01404738AF99FEBF170845E1E718653AB6D3124CEBA188D791E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222435, "uuid": "eee36791-a2c4-4d7c-8f78-51a03c80629a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222435, "uuid": "b84b3da8-68fc-4548-95bc-2b87f6e7f3b5", "value": "196608:91OQmdH8vnRRPYK4XKlZDqVBHI55+jIipu4YO6cuy3/Arua:3OQmdHAlhtq7o5UpFx6cuA/AR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664222435, "uuid": "26f40ab7-4289-497b-bc95-27fafa25060e", "value": 7605240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664222435, "uuid": "e1ee4c23-94e5-4b13-aefc-58548b1655d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664222435, "uuid": "e1c6f0a4-b562-4e19-973c-f2f9af4fc83d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d17388-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212859, "uuid": "39106c4a-e2e8-4908-bb68-15a50d538eea", "comment": "Malware payload (IcedID)", "value": "8a43c6076901915775b9bbc1c353dcda", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212859, "uuid": "aaa5b615-4f41-4e1f-b960-d1ea780beb6f", "comment": "Malware payload (IcedID)", "value": "f30b9c09e25075a6b67aa88252440cc0408b1d5ae3335648dc36bc441f3caacf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212859, "uuid": "0d755d68-cfe4-47c7-a8dd-d455e00c40ec", "comment": "Malware payload (IcedID)", "value": "fafe67d696bca1ae14da5ad73369b7258264da54", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212859, "uuid": "61823a5b-c698-4c82-95c9-6db990337fde", "comment": "Malware payload (IcedID)", "value": "9a11fd9eb502dd15d2449567d7f00b57bdd305bccd6959941fb7603ce9835283c84e75288570e44016cc8ac43ee6e01b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212859, "uuid": "43c3a1ad-7601-491e-8b48-7c16085025c8", "value": "T1AF15F101DF10646BF00B683E371365D7A9621C2B348BDE1A6B86112E2ED7FA0FD36D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212859, "uuid": "cb93e8c9-ffac-4791-ad06-ceebada68127", "value": "24576:utV2jUeQRI5wPN/ENuZb9oPGshPXSYqNa:uD2jUegISPNEud9oZQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212859, "uuid": "289a25c3-dbcf-497e-8d2b-727c8ff7897a", "value": 887087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212859, "uuid": "df84b238-83d6-47b0-ad0f-a846bf76334a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212859, "uuid": "927266bf-3c51-44cd-8ab2-fd7ddcbd31ca", "value": "mobilestyx doc 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c106d8fa-3d77-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1664182006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182006, "uuid": "83ca59b9-e066-4337-8f70-b3f1d63fbe28", "comment": "Malware payload (ArkeiStealer)", "value": "4c22c20fd816c11a3670100a40ac9dc0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182006, "uuid": "f1f2d84f-0f8d-4018-a7b3-f004587bd08f", "comment": "Malware payload (ArkeiStealer)", "value": "f33a6585faa522f1f03b4bacbd77cb5adc0d1ad54223b89dc8f6ebb05edfe000", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182006, "uuid": "71e28e57-10f1-45f0-a460-1a77be7fd6fa", "comment": "Malware payload (ArkeiStealer)", "value": "19b937654065f5ee8baee95026f6ea7466ee2322", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664182006, "uuid": "c93de94b-062b-4c10-820b-60938d0e1089", "comment": "Malware payload (ArkeiStealer)", "value": "0ce563e54f1a00cd92053fdb93b8f7b97406509c903982c1d1c679616dd5247f4784e11030e283a38db5de55bb69ab00", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182006, "uuid": "34d7233e-ae26-4297-b5e7-9b0eacc60d0e", "value": "T16E049D11B4D1C4B2D622243016F4C6344E3D7E610FA599BF7B9407BE9E312D2E736AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182006, "uuid": "8113c6c2-030e-419f-8687-29511bef89e7", "value": "511053e45a1ea09e3a5f640581bd0a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182006, "uuid": "2f9c5e30-1f41-4c6f-87c6-eb32e05e9bd4", "value": "3072:Y8S6mF4saj1M0WstmJDd/osAytLOHDxqTqYMia0ZNfo+CEkuRux4Kc0VrOR952St:Yg1saj6AfygD6lMitZSUux4N0VrOzuqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664182006, "uuid": "ead1a2f1-4da3-4e07-82e4-5eeec860402d", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664182006, "uuid": "6f870d3a-35f9-43bb-9907-1ebadd7c64c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664182006, "uuid": "ac7a28ed-3789-423e-af9a-13f4cf5fed4e", "value": "bfd72bdd4ab311acd0e05211cb01f8671d358540201eb200f613fd80b62291f0_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff114f1f-3d30-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664151616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151616, "uuid": "122e7262-d4bf-43d4-824b-c836185a43e8", "comment": "Malware payload (Stop)", "value": "a65be3921407ec716da90ea477995cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151616, "uuid": "6ba93be7-6608-44fc-a8f3-588e2585d5d8", "comment": "Malware payload (Stop)", "value": "f3c97dd29a8a8dbacbeba0f3a626aab4c37f9383dbfcc49f9a710e0759d0ccc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151616, "uuid": "db938ffb-30ca-402f-a981-ced83c914e7e", "comment": "Malware payload (Stop)", "value": "d23b7d30c7769d17ca4f92e0b014625f2e2de16a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664151616, "uuid": "82469048-3d67-4135-8b1c-1b57f1e1677b", "comment": "Malware payload (Stop)", "value": "cc3d078595ea90fb1649e17dde9ba837ae766b2f81326931d72039288f23183fd8c8282601d9479c312e3fc0bf74e83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151616, "uuid": "2a4da520-e554-46a5-acc3-ff81e4bad4a4", "value": "T12AE422007680F471C0952E70A4B1C5A667BEAD93A1381393776C7F2EEF723C163B9696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151616, "uuid": "045bfae1-e75d-4ea0-a0c5-c731d8168ea2", "value": "3a7d8752e3d4e978a9fe1fcd2ce3b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151616, "uuid": "8b8f4de4-89ac-4f88-a7cc-66ce1a1eb853", "value": "12288:ZL+eHjqfSBVFGMPvts/pgAgff9hqOdffc0ucsmWDJfHsA:h7Hj5BVFDPvOgbj7qRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664151616, "uuid": "85a4b174-9a56-4b6d-99af-d9629077c603", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664151616, "uuid": "e0a0671d-ccdb-4993-b27e-35da211ebbf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664151616, "uuid": "343b4d35-6219-4367-b396-a6df1cef0a54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c7af42-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215869, "uuid": "5f50953a-dca4-4e5c-8ac4-92aea74b0df0", "comment": "Malware payload (IcedID)", "value": "2ad6fc021be76e7af000d28aa8a03450", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215869, "uuid": "addb93d1-9638-408b-8de5-68999edce740", "comment": "Malware payload (IcedID)", "value": "f3f1ad731286fada69df12ede0a3e1b419d0df4ba18b17f49ac134b4664d34ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215869, "uuid": "6fb7458f-4d49-467a-8b2f-4240eb3f3b0d", "comment": "Malware payload (IcedID)", "value": "435395c801e712500931a735b50b65fba8594117", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215869, "uuid": "51e880c1-427b-414d-8e05-20b037311433", "comment": "Malware payload (IcedID)", "value": "d75be8b77d8d024d60bbf9203abf11339977e907dca6fe2a8f2731a32e3d6d343faffb6aa7bee48cf53ac27a5b773699", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215869, "uuid": "ac84b714-e61f-4c64-89c3-c071dfe49d53", "value": "T16115F105DF10216BF00B697F371366D7A8661C27308BDE0A6B86112E29D7FA0FD36D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215869, "uuid": "c30410ed-3047-4693-a614-0c95ae33031e", "value": "12288:MgyMkKmlVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEJ9d/+CFz5+b1nsmv:MgrkhlV2jUeQRI5wPN//Y5Ysmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215869, "uuid": "9def4188-97e3-49f9-b8ab-bfad241ba4c9", "value": 887141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215869, "uuid": "fbf19d6f-eea1-4723-85bc-c38ca8171c04", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215869, "uuid": "345e8b19-dc7a-4e43-a70b-cff90b89a282", "value": "nckcn-document-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2b3673-3dc3-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664214479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214479, "uuid": "1f0fccbe-87f5-4655-b9d4-4ef712ed4e2d", "comment": "Malware payload (IcedID)", "value": "621fd319c105b948a682c68bd86f970d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214479, "uuid": "4e83ced4-767b-4ad5-a12a-6028d26664b2", "comment": "Malware payload (IcedID)", "value": "f4273d576c6c363c06646c8c39fb5090b51289e181203d09997244b673ef899f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214479, "uuid": "2403a905-e9c4-4956-8526-9bc790f4ffea", "comment": "Malware payload (IcedID)", "value": "1cb7b34338364a0a4468eeb4ed71cdbaebd1ae85", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664214479, "uuid": "8533c94a-a621-4d9e-aae4-09b16745e3cf", "comment": "Malware payload (IcedID)", "value": "695c8371b5156c577b5cf061c44733b750434b105c57e6e108019608fd0db9fc0a0f214b158fe387bc727e47029b7c98", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214479, "uuid": "4d6432b4-9a41-4097-bf6e-0965fddef3e9", "value": "T13815F101CF54616BF00B693E371325C7A8661C2B748BDE0E6B96112E2AD7FA0FC35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214479, "uuid": "493d7a85-cad5-4294-bfe4-55ac36d6157f", "value": "12288:mDmVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEyM/QuuV++HfzPA3:mDmV2jUeQRI5wPN/QQVV++Hc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664214479, "uuid": "7c9c1c10-7404-4342-87df-6e21c3ef4c78", "value": 888418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664214479, "uuid": "7a63d421-ef1a-4768-91c0-dea9abc48cfb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664214479, "uuid": "e54158d6-347f-4687-ae12-e0d8d8f6a6d7", "value": "localnet-doc-09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d802f3bd-3dd1-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664220699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220699, "uuid": "20d86b95-09c1-44fb-a076-7707d3b114a0", "comment": "Malware payload (IcedID)", "value": "8e7bcbb33d896f70960bb5d86e0922ab", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220699, "uuid": "b835fe7d-20bc-4f20-8c21-0fa8eccba335", "comment": "Malware payload (IcedID)", "value": "f42c62d9eba4fffe26c0ee87116c53cc91610f98b9c3625819d60c8502b74986", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220699, "uuid": "04c42ea7-0b07-43af-a420-6c07ead0f3ff", "comment": "Malware payload (IcedID)", "value": "9f9176c2b7d1f502bd2c41aa65d5a1f9d66a26f4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664220699, "uuid": "30bc8873-7851-4554-a7a7-92d5e172929e", "comment": "Malware payload (IcedID)", "value": "6a3ff5e5c383b00da767c087553e985e8ec5b1db017325784929149662f6379b8082300752e59c9d8518a16c532b793f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220699, "uuid": "8abe984d-e47b-4305-8edc-972750ef936a", "value": "T11D15F105DF50206BF00B693E361765D7B8A61C2B308BDE1E6B96112D2AC7FA0FC35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220699, "uuid": "0001020e-5aea-46b1-a2b4-e614ea6f5d5c", "value": "12288:qVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DESSBdXn7f+GxZBT2Wcc:qV2jUeQRI5wPN/SHfHXT2WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664220699, "uuid": "111e317e-1a9d-43a1-a48e-8168d3159799", "value": 886633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664220699, "uuid": "edd91a91-c6cd-4e7e-864a-1925fc0bdc7f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664220699, "uuid": "c923cb2f-f988-4d2c-9cc1-8985c45827a2", "value": "jnrcom file 09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51c5eae-3d5a-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664169558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169558, "uuid": "760295b4-8281-4963-8b82-3f02c4e1666e", "comment": "Malware payload (GCleaner)", "value": "0ea4a71734b2589794b4e8db9eacaa5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169558, "uuid": "59988697-62ef-4171-a660-9ec6e6e534b2", "comment": "Malware payload (GCleaner)", "value": "f441f7ee4c4db0542a290bcea78386d8ac19595a5fd816bd6c585119b6ce6121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169558, "uuid": "b0f0d121-2dd2-4e4b-9993-904a60d56a32", "comment": "Malware payload (GCleaner)", "value": "f5071b18e4a01bba3915e818849d89e0a2102268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664169558, "uuid": "03f8a9bd-0308-4a7a-a82e-72f0ed43b4cf", "comment": "Malware payload (GCleaner)", "value": "42d94c01a2808e153ff283906b3cda728e8018fb14200067eaaa458ae0916b33f53b0a5facfa8a1886540666bc0f1d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169558, "uuid": "61a7d036-bf87-48de-bfed-c98557e55c97", "value": "T1983402613D50F931D918B0709473AA9619BFBD61463A5E0277A87FAB6E323D12E703C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169558, "uuid": "9ede543b-a27d-42b0-a575-bc8d53341014", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169558, "uuid": "77d49991-0aea-44d7-b780-3eb46f38b0c8", "value": "3072:d3lTZG5hD3+3cREGgqvPMsr3UXHpSc4r/QalEGmR938HKBP4AV5x:WrjzvPMUm8Qa+G5It", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664169558, "uuid": "3d08a734-5379-455a-8e13-c260afec2c00", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664169558, "uuid": "f05c73f2-a959-407c-854a-34cb890a4b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664169558, "uuid": "183b98d8-0143-47ba-aafc-48a46e8b4c89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bb2d8e-3d5e-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1664171226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171226, "uuid": "9d5b7fca-da55-4be7-a986-4d7163680dd3", "comment": "Malware payload (Formbook)", "value": "594d4280388ac4be11809fb256223522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171226, "uuid": "5918afa6-a619-4b2d-9886-ac7a1c46486a", "comment": "Malware payload (Formbook)", "value": "f5079aa9467fb2854be80b49fa4cb761b8e4bbd0166ec958aa367258219894bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171226, "uuid": "1e92f148-1057-4ac6-b4f3-20bb9afa277c", "comment": "Malware payload (Formbook)", "value": "344ee798efb0a64491e516e72e41f1041f676989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664171226, "uuid": "2839db15-1bba-43a4-970d-8ab81b28aa37", "comment": "Malware payload (Formbook)", "value": "a34c779d7881b64323be2510e35c76744e781b39dad6517f6dd0b10b14941dcf1184a35a0a54a21f2910677e82073ad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171226, "uuid": "98fbe26d-d627-4fac-b35f-a685803731fb", "value": "T14B35F1320BEA8B0BE15175B8D5D0D2F6A3A9CD41E467C7DBABC96C1FF08A465DB60310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171226, "uuid": "368a300f-4f53-4926-8b0d-e2f49985017f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171226, "uuid": "a4f7a23b-860d-425e-bd34-7a1a3d255155", "value": "24576:0Qx013ZlUwqZL2cB5QB+nShHB3ekFwsw:0QelZSZic5QwShHBXFwsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664171226, "uuid": "f89cbe50-3e5d-429a-9601-a66450f19781", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664171226, "uuid": "ba9144f7-e6c1-40d2-8be3-a8d06b3804e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664171226, "uuid": "f7bf2131-9db9-43f8-9004-38186aadc759", "value": "SecuriteInfo.com.Win32.RATX-gen.17717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984bbb9f-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664212862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212862, "uuid": "4f71a189-b318-4b65-ba8e-d52cfb9bfaba", "comment": "Malware payload (IcedID)", "value": "05b14e14069d9fff62bf315cc8290d31", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212862, "uuid": "bd73db0a-b179-4ebe-9dd2-dc78779624ff", "comment": "Malware payload (IcedID)", "value": "f59f47970092e69c7fe1d8473dd57c3fd946eccd80b67ab1131a0c82c1aa025d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212862, "uuid": "8327ac53-c6a1-41ed-b068-b74346d99845", "comment": "Malware payload (IcedID)", "value": "a28d8b01a36233eb66ccb48b79349ccfc3b6e5ec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212862, "uuid": "37ce01b8-942f-486c-83a8-46396620615f", "comment": "Malware payload (IcedID)", "value": "c8a73668bd5961d4e081c384e996baeba93f2ddeaecd0170bef54e82edb3344783fd25b3bde7e3ec9b7e8bac5d0a8241", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212862, "uuid": "4f14455b-5585-432e-9afa-7b1df8ff1a77", "value": "T12F15F101DF14616BF40B693B370365C7B8661C2B708BDE0A6B86112E2AD7FA0FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212862, "uuid": "40f85166-1e5a-4669-a02e-50e60b820cd9", "value": "12288:erVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE8pcVU9gnDuZhF1:erV2jUeQRI5wPN/XcVZnqnF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212862, "uuid": "1a3dc045-d7c3-4cfd-a2b8-2b89038cac5c", "value": 886654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212862, "uuid": "a4d56888-0618-4a40-acd1-e783a3af8f4a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212862, "uuid": "cfa7004f-72d8-4ea3-bc79-752d9527202b", "value": "ms-cubed document 09.26.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb362103-3daf-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664206075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206075, "uuid": "81aabaa1-c1d8-411e-8391-6bd4383fa6b2", "comment": "Malware payload (GCleaner)", "value": "b233bb713b5a59cd693936a7396f367e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206075, "uuid": "50849a5d-3286-4a2f-adc6-10798d262d1a", "comment": "Malware payload (GCleaner)", "value": "f67074e4d358e51cb1971e87cd5d7850e6b0a3187a7ecb07551aa0bdcd606ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206075, "uuid": "860648b2-29fd-41b3-95f4-9512da41eb7d", "comment": "Malware payload (GCleaner)", "value": "f8e243f857bbcf2352455ad4b914a5a2ae9f588c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664206075, "uuid": "0d413b42-0a87-4a21-af99-72983ffefb70", "comment": "Malware payload (GCleaner)", "value": "e2b8e7786bdd5d95c8207f12dd2817e1df749fe3e9445c179456aaed2478e9cfc93733c88b0271e0517689aa45a66e25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206075, "uuid": "3abba5e7-c633-491a-880c-f02455a55886", "value": "T1B83401527D84ED72D81632714972CAB1ADFF7C5644231903B7B82E2F6E327D26A34386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206075, "uuid": "e6bc425b-d366-4165-bfd5-1356c03ece0f", "value": "c3d42942666b0e1aa4b91cf861b5e7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206075, "uuid": "cd8ada84-341b-430f-9041-5f2fd657acf7", "value": "3072:0d1cTc56KUhplmi3+o8XDDofi8pI/oIC7Ay6FcVGk84tX/ztGMjBwP5B:8UhGwaDnS9ccVGQtvJ5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664206075, "uuid": "2fb80c0d-5aae-4fc6-840f-3259c93c48f8", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664206075, "uuid": "6af10881-aa83-4568-8177-9e4d46c48370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664206075, "uuid": "5e677f78-081f-4c1b-84da-4528d28b4ad7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be10a08-3dd7-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664223095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223095, "uuid": "a1b01a02-604e-4724-83ae-1b8a0563e7bb", "comment": "Malware payload (IcedID)", "value": "904644c8b87dc2b49e5587bcfff6c7c1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223095, "uuid": "0740adf0-008b-4c91-aecf-5a76f7209dae", "comment": "Malware payload (IcedID)", "value": "f6c3820c214d02644fd1194eee8d3ed23eb18a2e9c85851197556f7bbc068503", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223095, "uuid": "36d5aeef-e4c9-4baf-b3c5-1836be1935e9", "comment": "Malware payload (IcedID)", "value": "faa9071aa7b21dd765f54a0f55db9bfe568bb29e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664223095, "uuid": "9d1ecf1a-b0c0-4913-b276-16f96492ef11", "comment": "Malware payload (IcedID)", "value": "0966fb9c6fd39c089fa17eac6924c4ae2c6c08bf8ee2237dd18039117b1268d5b8f9cd4bec240c22421653ce018f91f9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223095, "uuid": "5c5f4ff4-3744-464c-8396-54406f8d3bca", "value": "T15715F101CF50616BF00B683E371765C7A8A61C2B708BDE1A6B86512E2EC7F60FD35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223095, "uuid": "71029375-379b-45f3-8dc7-0ac6471f252a", "value": "12288:2UVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEmvnjPCx7trX3sJAibexZx:2UV2jUeQRI5wPN/vj4trXy/Kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664223095, "uuid": "321df2af-ff4f-466d-a593-eb7dca609526", "value": 886824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664223095, "uuid": "00b8a1c3-5d2e-48d5-b832-1ff91cb77bd2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664223095, "uuid": "dd9cecd7-3033-459e-823a-869490df6a04", "value": "ishihara-sekkei.file.09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a96c9b3-3d4b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664162802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162802, "uuid": "61146f43-0b22-4ae6-a750-d6d19f4a9b1f", "comment": "Malware payload (GCleaner)", "value": "e72aa3bdaeba4b143cd3a4a05665adb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162802, "uuid": "56128a09-b8eb-48e0-853e-9f134a3f3dfe", "comment": "Malware payload (GCleaner)", "value": "f778ab48c15c763851f9ded15e8e1d820cfeab44201e0cecee97a30dcbea95bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162802, "uuid": "37b3f4b8-af39-40ad-8d3e-56d8835c7ac2", "comment": "Malware payload (GCleaner)", "value": "13bf4b4bfc9e69f86869b96b69867ade9dca2284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664162802, "uuid": "255f8aa5-7735-42c1-94e1-ba3cd00ea948", "comment": "Malware payload (GCleaner)", "value": "bdad8739047644cedd55643974a82a5823a35fdbadf3e9c9468684be0472a865dfce6c3d989c85b97faa62ebfb1fa4d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162802, "uuid": "00fa7b35-5910-4f4c-9a74-b7f0f3d4b30b", "value": "T19F4402127E40E532CD997071C4B2CBE519BEB861052155077BB82E3FBE317C1AAB53CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162802, "uuid": "515feb19-0704-4e34-b3a4-cc3494e8dca2", "value": "6e82603bfff5065173a467b43e40d430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162802, "uuid": "2be5d3bc-e192-41ee-86c0-996d64c72077", "value": "3072:IPLSoWcF4+x35agV7BMLjvrNX0GpZO2fPNUsurmY4tbsRZKER59tcXZUQcgHO+CT:+CfS7BebrPDmsA4tbUR3uWQcgdsc3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664162802, "uuid": "5b9454a8-17fa-41ad-a83e-da167fe3bf3b", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664162802, "uuid": "233e756f-4130-4019-8665-542f86125f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664162802, "uuid": "4be2131d-0204-4879-9199-7f658aadac2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738405ad-3dbf-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1664212800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212800, "uuid": "c66c2f8d-9764-40bf-9d79-092efdfadb2d", "comment": "Malware payload (AgentTesla)", "value": "65fb5481e44dd64f17efd584f4fbd0e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212800, "uuid": "a326718c-b594-47a4-aa5e-56f0686450d1", "comment": "Malware payload (AgentTesla)", "value": "f781fe6b1d1132dc722a6e2853fc7131929d85c66e651099d003dca7c5c9b39c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212800, "uuid": "2918030c-e8d6-400c-8aca-5bd9aa4f1b0f", "comment": "Malware payload (AgentTesla)", "value": "131f2de16ddcc19026b9df0a6d887a5ea822ec76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664212800, "uuid": "5a4e7407-a781-4ad3-827e-096b9d79bf6e", "comment": "Malware payload (AgentTesla)", "value": "d5ddd7f828934c418bcd1a34a16a12495f67c17f282ffffef2a7049433076ca096b207b0c8f05f6c008d5000d432e153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212800, "uuid": "61a0237c-8341-482c-a35e-1e9f59ec581f", "value": "T1910533E1B9276587ECE51DF20F1D3829E0894BCF9248E62FAD75149E83FE35A864143C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212800, "uuid": "0b749c68-e357-4b16-8eac-4e3bf47e45da", "value": "24576:AX4919m7z0mXkvFQnIerKLlQ0u3q9T9Wi4:ga19mcFQICKLlCoT9WX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664212800, "uuid": "79ec9448-a49f-41fd-8a5f-ceaf32420e04", "value": 856934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664212800, "uuid": "b6aeabbb-496c-4635-a65f-edcf8df22f59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664212800, "uuid": "aeab2785-f524-4805-991b-580323d56929", "value": "transferred copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af74a3e-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215873, "uuid": "328892cc-5bb6-4692-92ac-4156243effa8", "comment": "Malware payload (IcedID)", "value": "dfa4f8109eb641da0946ddf08bc955ee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215873, "uuid": "dc6a987d-1229-4d08-affb-40653e9b4df5", "comment": "Malware payload (IcedID)", "value": "f7da1b974bbb5d89b09ec477b235e50b0f3035211a969c9b09f6fcf7df9ef675", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215873, "uuid": "7f1ad231-6b01-4e4d-ae06-03e5bb1f45b3", "comment": "Malware payload (IcedID)", "value": "25ed8077a9417943248ee7b142530ea63b445f4f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215873, "uuid": "40d0f669-85f0-4d3c-84a8-0300921bcd35", "comment": "Malware payload (IcedID)", "value": "9f68fbd3e1a701fe427b472a730989eee593b5ead8059bc8d4477669a8277e0e513542643af3d47301a8b79a946c296f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215873, "uuid": "ae436e03-bc83-4d8d-bdb8-e54db15dfc30", "value": "T19415F005DF14606BF00B693E371325D7E8621C2B348BDE1A6B86116E2EC7FA0ED35D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215873, "uuid": "4293a9a0-9fee-4cf1-b0ed-959ae9b2675b", "value": "12288:NVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DE74gb9oFp/G7obA/PXSYqLAA:NV2jUeQRI5wPN/4Zb9obGsOPXSYqNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215873, "uuid": "4a71fb27-fc3c-4df5-bfec-ccef26508768", "value": 886844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215873, "uuid": "866f34f1-6706-498c-9d50-5f6e80644d92", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215873, "uuid": "d9e711db-9b70-420f-86f4-4be55cd272aa", "value": "nearshoresurveysdoc09.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8fdc01-3d92-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1664193676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193676, "uuid": "6e279f50-f162-4189-b022-8095015f2723", "comment": "Malware payload (Stop)", "value": "43b91e3b00b5d390ea9d75fed577d8d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193676, "uuid": "9dec17e3-f17a-485c-8e5f-f270de2420b7", "comment": "Malware payload (Stop)", "value": "f878559b06f262967a6adf2f8e520cbbc4803bab046f10bb0d58e448fb939387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193676, "uuid": "6fdfcb88-25f9-4ab9-b984-904e5a9ebc73", "comment": "Malware payload (Stop)", "value": "280d99b744e919d058b738867954833056392414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664193676, "uuid": "779448eb-62ae-41f1-9c1c-e42f079a3844", "comment": "Malware payload (Stop)", "value": "d3c47e89b263c427c5d548cf4e41ec326951d76f15d4b2d4430325bbef874d6245adfde73605630fe889e995326c4515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193676, "uuid": "a8dc16e8-92df-46f0-9904-98a7520c898d", "value": "T145E42342BA90FA31C41763B02431FBF1BEBE94268139CA4937551D1F9DB87535BB8389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193676, "uuid": "d8f0c76f-b6b6-4425-a7e9-5db2c72df6c1", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193676, "uuid": "7a97cddb-c8b4-4a05-bf4d-b0607d608fbf", "value": "12288:NO/O8Abf4fCcnPIqrC6hshcShIb2zmp9xIIS+q1Biav9q+:NOG9bf4acPhr9hsOShS3pYIS71Mav9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664193676, "uuid": "fd979235-04cc-488f-a28f-af2c22cec177", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664193676, "uuid": "f550297c-ca3e-4a21-8cad-eeb2aadec92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664193676, "uuid": "8999380f-efbf-4c53-a899-f034ebe8e244", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2358d4-3d7f-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664185192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185192, "uuid": "a9c32cec-7272-4cee-a3a4-ccffdabbdc90", "comment": "Malware payload (GCleaner)", "value": "c8d1e8f1983fd0e4d419dbdc6cafeff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185192, "uuid": "f552ea8b-3a00-446f-a23e-b2afb977edf7", "comment": "Malware payload (GCleaner)", "value": "f879d0035ee6a0276141b78824a27591b9cf82c0285f2e25c698962474ae1153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185192, "uuid": "d97d3eb1-f3da-4f00-ac20-8f4df32f7471", "comment": "Malware payload (GCleaner)", "value": "62ec1f2743bd125cbf68080cc86a31d82d04d290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664185192, "uuid": "ba27336c-7ea5-4387-a6df-b7bb241831e6", "comment": "Malware payload (GCleaner)", "value": "e011a559bc813eb379938495b9dc0afd6936e13e536bbd8655348c7977e09b52e917169ba8ff20578d1cbe5bc958618c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185192, "uuid": "9eabf39e-2cea-4d77-9204-fc0c205817ab", "value": "T1AE34F1807D80E872D41D71719472DAB5A9BF6C6212126E06B6E42F2FEE317E13B353C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185192, "uuid": "486d71a0-909c-44f7-a56b-6cf3d8a4d034", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185192, "uuid": "b4074414-7df9-4630-8724-6395b08328b8", "value": "3072:g9qtz5KM8sC1OyZaVn4AgA378C6kuU5TUHHvtn6eHq8J3sqj9SuacBL65B:587JaPgk8RkuOUnln6ed8M1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664185192, "uuid": "793e7b53-1835-49b0-9bc8-ca0d7b66a558", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664185192, "uuid": "a8ca4fb6-d541-43d4-8b31-8ae8a1d0b78a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664185192, "uuid": "2f48a0d5-8536-400d-abb7-ad3918a900af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45df74e-3d8d-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1664191541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191541, "uuid": "615a98f1-4153-4988-b358-e8353e5308ba", "comment": "Malware payload (SnakeKeylogger)", "value": "1583833b3e1a25dde189f672199abba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191541, "uuid": "25f82e5f-f38c-440b-920c-5e2f28eb5a68", "comment": "Malware payload (SnakeKeylogger)", "value": "f8fc4d82f7bc953465b7b81e86a52e14f02bac9df7aa1f921d046fc71861b050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191541, "uuid": "3ada915b-49ae-4d32-ae7d-536507dca54a", "comment": "Malware payload (SnakeKeylogger)", "value": "5398f1b2f1c6ac880cb34bcc4d268c437eda164f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664191541, "uuid": "b467dbe9-b896-47e1-94d6-95c0041a4a3e", "comment": "Malware payload (SnakeKeylogger)", "value": "84ebfcf5985f415b334cc59a4d174dfdb4db0912a01f4b49032e4cef9f8dbe1b45faec1f6e39357031c6392bfb7b35a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191541, "uuid": "b051e6ce-6eb6-4cf2-a959-1777f24370a3", "value": "T10F35F1331BEBCE4BD00566B888E1C7B193AD8D05E467C25B67CA3D2FF0B7126A661315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191541, "uuid": "89fd4399-85e6-46ee-9b81-8b7ef848554d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191541, "uuid": "f91ef2fa-bd77-4274-a268-2a5919e8af90", "value": "24576:ELoD+Q9hWST3kLcx2yZzxviEuf8a+q8bi3bA:ELob9oo0o3cUU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664191541, "uuid": "52c097c6-ab2f-4157-9d4b-cfae50aa91b9", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664191541, "uuid": "91a1c76f-0947-4d96-834f-615d4d40b61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664191541, "uuid": "ebba7839-4242-4315-ba79-7be251293792", "value": "scan_26092022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d7d87c-3de1-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1664227219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227219, "uuid": "d339a30d-2927-416b-afc0-c993515834df", "comment": "Malware payload (Mirai)", "value": "02b5a1afcc1a8a94a2903c06683b2ee4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227219, "uuid": "fe8f023d-f5d2-473d-a4b5-940af1ef774f", "comment": "Malware payload (Mirai)", "value": "f94ae93fa978f10788a00bc7181771747b4d48663fbe85015ffe415e486b3dae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227219, "uuid": "48c3d4ac-47c1-46b4-8926-8491a5b6f1ef", "comment": "Malware payload (Mirai)", "value": "77ee6e6c14675fed50c4a2a6e15be99da7300add", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664227219, "uuid": "488ba9bc-835b-4304-9a87-ab4762bb2f53", "comment": "Malware payload (Mirai)", "value": "447c8c33fedf036dfa0f4c31cf04cd38238f7dbe96d6b8612935e5c562f1872423f366e8b98721a7b8475fbfee022b0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227219, "uuid": "72604f98-41fd-4693-a71a-763bffabf65f", "value": "T174D2E1477148FC24F4B090395B3AD54EA3562BF8A7D4BA1218204635D6E6043B6FFAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227219, "uuid": "025fba6a-2ef1-443b-815b-3afeea419938", "value": "384:IRVCFOwnpY+BixRB3y6ICdPfWjnJmEeH1uTeKCQKYmJZxlDpXahymdGUop5hm:jpnppBixf3LvdHomPH1N7ptqs3UozY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664227219, "uuid": "7875c3b7-c448-42ec-8227-86fa4b93b3db", "value": 29336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664227219, "uuid": "fe87ba09-d340-4059-bb1a-839297dc5096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664227219, "uuid": "6a58ee3e-201e-43da-b131-0ea743a9383c", "value": "bk.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be8ac1a-3d77-11ed-9266-42010a9c0072", "comment": "Malware payload (Lazagne)", "timestamp": 1664181837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181837, "uuid": "851c815c-a103-4a16-830e-85253632827a", "comment": "Malware payload (Lazagne)", "value": "44f62cd09312d201ef8014d53d9395ab", "object_relation": "md5", "Tag": [ { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181837, "uuid": "aeb96809-1da8-46ca-8a61-5a2eac35976a", "comment": "Malware payload (Lazagne)", "value": "f976cfadb68d079d3190bb3b256e6a5e216f1d33ef0cfb4bd0639c062be690e9", "object_relation": "sha256", "Tag": [ { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181837, "uuid": "6a5ff31c-5da9-4624-8d36-e302571ea41d", "comment": "Malware payload (Lazagne)", "value": "dad695b0736d78e5edfc5d1c8a0e1463a55fbf47", "object_relation": "sha1", "Tag": [ { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664181837, "uuid": "b6d1ae8a-d955-48dd-8f74-4c42e50abb53", "comment": "Malware payload (Lazagne)", "value": "d69d97359fea97d92797c01325b9d7041383ad11d63f4aeb56f346bbb4e3880fd790935cd94840b68845ce0f0de490d0", "object_relation": "sha3-384", "Tag": [ { "name": "doncasmail-com", "colour": "#06E95C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181837, "uuid": "f06b0954-f283-44a2-bc05-75332af06fd7", "value": "T1DDE63385A2E409EAE0B66536885BD222C6B1BC550315C15F83C4A7B7BFE32D3ED72F50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181837, "uuid": "683cb1fd-d129-4a78-964e-f8484dd7b992", "value": "69eb46a9f63edcc604b0bdaaa8e0f2f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181837, "uuid": "d00f1fcd-d25d-4737-9761-c58b836234a3", "value": "393216:uxP3vaCncs/m3pWnKhsayGpa617/WBJHldsm/ySgimS:u5iCnrKbhsayJo7/0Ff/yhim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664181837, "uuid": "d113c2d4-d693-4100-b008-47d561e823f7", "value": 15062610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664181837, "uuid": "15de86f2-c4b5-4d4a-a21a-62671b6e8f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664181837, "uuid": "ffd21c96-ce48-4899-ae77-e2947cc7c729", "value": "laZagne.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9facf448-3dc6-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1664215881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215881, "uuid": "e4dd1d91-993e-446d-affd-9fda64783155", "comment": "Malware payload (IcedID)", "value": "85b189afdff301d576b49983c6114edf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215881, "uuid": "74b3b549-0cb3-4329-b079-ed9eba4d4020", "comment": "Malware payload (IcedID)", "value": "f9938f14df5d7889b1dfd3af2d529ceadf1017aa2f83337dad71ee67379d9a3d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215881, "uuid": "e687d5b1-08e6-4752-8f1e-3b4278c8a055", "comment": "Malware payload (IcedID)", "value": "1c21f0e116869c2e336038141997b65d5c4497db", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664215881, "uuid": "b1f0c590-1039-40f4-9a46-228d61abb97b", "comment": "Malware payload (IcedID)", "value": "e7647b5a2a8ff9155acd13e36016dee39bc9162e76ebd39628cd8f65401fb27ccca5e98a2727c399c97d777750c82d0d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215881, "uuid": "c79d4eaf-c978-4827-ae28-7e28f6666c43", "value": "T18915F101CF54206FF00B693E371365D7E9A61C2B308BDE0A6B92116E29D7F60ED39D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215881, "uuid": "f765fd57-7a05-4936-9e8c-2a66584e87f1", "value": "12288:HkVE9j2y+1JbeQbntrws6/GYzw6OFokpXfiiGef/DEEs9KH7oRe1GIaqUR:HkV2jUeQRI5wPN/c9cEk1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664215881, "uuid": "069b0cc9-a059-4155-a3d7-e2ba96b25308", "value": 888037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664215881, "uuid": "962dd920-ffef-4ab0-8aee-71e243d846aa", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664215881, "uuid": "cfcce86a-e331-44f5-8741-175d6f25eb86", "value": "lycos-document-09.26.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92590cf6-3de7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1664230032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230032, "uuid": "de08f7f7-2b1f-45e3-9837-1eef899ee05d", "comment": "Malware payload", "value": "6533a8642c67b2fd93048f52f6733e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230032, "uuid": "238e5283-1755-48cd-8191-b12e07dd5518", "comment": "Malware payload", "value": "fae1bbfb1f4da3308e6e59c536fc834f5ae5cc16eb24d61b2adb65097a483e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230032, "uuid": "aaf3e395-637f-4771-924e-b893d7de2739", "comment": "Malware payload", "value": "91d012c45704c70d759424a5f9aafb34b9540133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664230032, "uuid": "69e6b90d-bbff-42b3-8b89-7d474bfa12e3", "comment": "Malware payload", "value": "9bd40086af8c5f7b0209df31a6a5f1535784a7e76661bfcc4aee3fd9c3aa6df8f516cf4d2a6ba0e143b55d11d0d1990b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230032, "uuid": "9847f1bc-cc6f-4540-be85-c8870706e34b", "value": "T11424F1A27C508032E8BCB5348930D911267F78196AA65D93F7F8224EDF726D06F39397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230032, "uuid": "f7325a0f-859d-4d4b-8406-907eebc1444a", "value": "735552f96124e1320a895c8877aea692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230032, "uuid": "c0f22d63-8c83-4f6b-af7a-e2a4a4bdedb6", "value": "6144:YwiOFyYNNm5Zyoi0IE5HLKyM8pxRVXaHMHzA:VFzNSP9I8KJkXvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664230032, "uuid": "da58563d-6df9-4feb-bd04-741963e189a3", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664230032, "uuid": "e92fb951-c260-476c-92d9-5b032eb70139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664230032, "uuid": "48c7a364-3511-42a1-923f-b2cd7038fc93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a58e38-3d89-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664189716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189716, "uuid": "abb61589-4802-4f7c-904f-a4cffe49c1c9", "comment": "Malware payload (Smoke Loader)", "value": "85e183f142f0c4046281528a5cfc79f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189716, "uuid": "4a6d339b-efb1-41c5-b4cf-fe023972859f", "comment": "Malware payload (Smoke Loader)", "value": "fb2fa6d552fed68c6d37a7970d02396e4b88caaeb8ffba68d0985ad6dd181e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189716, "uuid": "4a466177-4f3c-44aa-93a0-4e31b9e31964", "comment": "Malware payload (Smoke Loader)", "value": "30b6e34cce3af597cec0cefb6f187c6c20c3d005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664189716, "uuid": "8b6faeb0-8c14-4065-ba6a-44d52da5fa06", "comment": "Malware payload (Smoke Loader)", "value": "2408972dc780061bd3630879afc670dedc96196ad7bc4dd78f233ef6c4588fca4f7fd13ac4f206f97fdefff60d76a350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189716, "uuid": "62309c66-62d9-4a53-804f-db80b0b51fef", "value": "T1C2E3D0417F90E873C01091705834D3A1AB7A7D51597E5A833B48BF6FBF322D266BA31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189716, "uuid": "898ceac8-a7bd-435e-9e15-82d6e8cdce31", "value": "69e9e49619cdb52628463403b13db549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189716, "uuid": "30127256-2c0c-40bc-b59d-aa20a4a12859", "value": "3072:OJy44z5jOVj5YbdCgV57qWOe+pNYR/B8tEz/tG5B:9+4CgLNfsEz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664189716, "uuid": "7343e6fa-4188-47f1-b665-f4a1f6174467", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664189716, "uuid": "8889d3c7-d2a2-47d0-a265-81e44edba1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664189716, "uuid": "1a9da7dd-7b23-443e-9689-f09666099ad9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff337ee-3d71-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1664179320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179320, "uuid": "00442019-bdd0-46b2-8a4d-d9697a1c2878", "comment": "Malware payload (AveMariaRAT)", "value": "3a44e1a35c0e98d6798060570ab974d6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Swedbank", "colour": "#656C00", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179320, "uuid": "dc4f6c05-9451-45cc-ab86-5ee5dde96de0", "comment": "Malware payload (AveMariaRAT)", "value": "fd12962a25adc412084d7041db1ef426293df4a73f2c55c23d7e37b021bb90e2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Swedbank", "colour": "#656C00", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179320, "uuid": "4652ace2-dca2-4779-918c-170de47a2469", "comment": "Malware payload (AveMariaRAT)", "value": "57d29684ab7258986d2adeb4f39d17f1aa94d8d4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Swedbank", "colour": "#656C00", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664179320, "uuid": "4b91a204-f46a-4d0a-a65e-8811fec93e00", "comment": "Malware payload (AveMariaRAT)", "value": "aa221ec17d8c5571a56dca2f96ed452c5bb06848a887be783b509e3d4b5aae5a464f6dfb039b365d3066102cbff08688", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Swedbank", "colour": "#656C00", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179320, "uuid": "0c7c53fe-f855-4454-b024-1c407c385a01", "value": "T1B725F1370BEA8A4BD011B5B895D1D2F6A79ACC10F46BC6976FCA2C1FF08A026D771354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179320, "uuid": "9e4ff460-9120-49e4-9925-dc0790963074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179320, "uuid": "3b0dbc54-9be1-4082-a4d9-7885a34cc7e0", "value": "24576:AV2rNPR/3vtMAp+tS0ofd2xNEQ9RMaaYcjq:nmN50k67Ykq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664179320, "uuid": "b0619e55-5f79-452e-b22c-2d8a3bd7ab43", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664179320, "uuid": "25b33f71-1032-4242-8520-87b325483646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664179320, "uuid": "062fb2bd-e97d-4221-8ebb-4d173a30c4ad", "value": "41050\u00b780 swedbank\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322f4ae6-3d6b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664176613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176613, "uuid": "14bfb738-71af-4abc-9027-8203bbfbdfb9", "comment": "Malware payload (GCleaner)", "value": "31a6b48dd3cab4eeafa05fc3cce7f2e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176613, "uuid": "97e0eb07-1bd0-4204-854e-cf722f8e9b0b", "comment": "Malware payload (GCleaner)", "value": "fdc2692d6a3856028f2656c595ee87e4c2e666b02c7efd91f7e6dcdebbf9eb9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176613, "uuid": "b2fc8903-ef7d-492b-b768-3316fc2ae59f", "comment": "Malware payload (GCleaner)", "value": "da012fe445035b6d37c865800bcaa69759d42520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664176613, "uuid": "76ce9bdb-8b3b-4851-8dd4-49bd3fa30f75", "comment": "Malware payload (GCleaner)", "value": "2cc5164910922d501690e908705f980fd289aad7f0e8cd0b7422e9e7a097834ce28551cc7dce5c76c9f89d6f1a75bf8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176613, "uuid": "e11456c6-67a3-43ee-9c5a-63611f147f8d", "value": "T1C43402427F80ED32E82871B58932C1A569BFBC1116265A4737B43E7F9C727D03A7538A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176613, "uuid": "55f47405-cb92-4618-9efb-67590e5d81d4", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176613, "uuid": "6c6805aa-46c4-4e08-b5d8-9ab6d5378d19", "value": "3072:E5qqG5b8x5559QDbtMfkFMk7ZPKJ8n0VJ4dGRakwkKjQycqONleO5NWFQjKM7iRD:9m8esFNiJQTGEBQJbH6Jsi6DzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664176613, "uuid": "b663f1cb-b3b5-4c85-920e-02b6e06a7855", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664176613, "uuid": "2d0a33b4-86e3-438b-8b3e-7c9855e0fd48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664176613, "uuid": "a0c18053-0469-4d7b-aa1d-88606d522b05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516cda92-3d4d-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1664163780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163780, "uuid": "6f334579-afe5-4adc-a963-3d4c3ef12540", "comment": "Malware payload (Smoke Loader)", "value": "79c8b139e8f08040bcfb19467fe01e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163780, "uuid": "5f17107c-b3b1-48d4-876c-43cb9b65c7b5", "comment": "Malware payload (Smoke Loader)", "value": "ff23b0cf1e786f92a62cb8e9816ed4d17a373a19dc1c3b2f1d876d5a280baa2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163780, "uuid": "d58e00b9-eafe-493f-9530-f0a1de722091", "comment": "Malware payload (Smoke Loader)", "value": "9d45c8a0f7747a3bfa7bde342c1248ff223ff559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664163780, "uuid": "4da3d947-bf43-4c77-abe7-a61ba226a680", "comment": "Malware payload (Smoke Loader)", "value": "7d564c28f1aca58cd4df8d27fea6a4989dbc79112dfc66d381a6e9e7f8d292ac153b0511a742e5db56f0c95c2ea4e400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163780, "uuid": "26431c9d-7341-4d04-8579-86f2037b3d0e", "value": "T1E8E3E0407F91E872C4019A740835D3E11F3E3835893A86877B5D5E6BBF713D2A2BA366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163780, "uuid": "2777247f-58f5-4ad9-92fb-4ece87d5cc28", "value": "56a3cdaf41d3763407f3136e7ac0e308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163780, "uuid": "118dcbb8-cda5-4447-a867-e59de1dc602e", "value": "3072:Z+TikCG5Hpgfo5u7E0jypl1zV9tR0OS6E2APBiXErL5x:sF6fEuo0G/zV9tRtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664163780, "uuid": "a644b7f7-a2c0-4342-8c66-b2a62ea0d723", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664163780, "uuid": "70bc832d-0544-4c5c-86de-57f8c83c0d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664163780, "uuid": "039d9789-258c-4312-82eb-271f9a2acaa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e2fc9e-3da8-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1664203115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203115, "uuid": "f0cef0ae-14a8-4807-ad1e-1be03c757421", "comment": "Malware payload (GCleaner)", "value": "f288f3774f523edbf11585a7430d058a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203115, "uuid": "1e6584d8-e8af-4939-99c6-5ac2801305f5", "comment": "Malware payload (GCleaner)", "value": "ffa60b84e4514cc69711ca0db1bf3afc622d4454cd648db3de33935a70e40906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203115, "uuid": "098eaffa-bc34-447e-9443-deb0236b7010", "comment": "Malware payload (GCleaner)", "value": "8e63f02ba1966566fdf425e556c4bf1d6f4b13a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1664203115, "uuid": "369ef563-3e34-4c45-831f-f81d4ccddb5a", "comment": "Malware payload (GCleaner)", "value": "620c3b62285028616613cb3949edc16512dcc5dd01e9cfae4cf4fc1f33286ee51df235e9cc3406bc8dd6bab1ee144842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203115, "uuid": "ba1a05f6-a037-4736-a02f-988e5a17f0cc", "value": "T15834F1503D80D832E8147571E832C6E136BEA95269169D41B7E83EAEAF337C11F793C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203115, "uuid": "1c3463fb-9b90-46a1-a14a-e588dc5c4a43", "value": "ea557b680f38ebe5261c0eea92d4414e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203115, "uuid": "34834793-a129-47c9-92fd-6cdd0f82a044", "value": "3072:AbKiTF5WQ1HWYh7w8Pc5xkfaNpamgH07pFupAcu6ivh7AovcxozIYCQg5BTD5B:/J4thM8PaM0pam/pFuJviNAovIZjQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1664203115, "uuid": "141eafae-b659-4965-9342-c5e585331551", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1664203115, "uuid": "c5dd47a3-b917-43d5-8fdf-806141c45ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1664203115, "uuid": "40866664-df49-43cf-bbd3-6a88e05e0eb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }