{ "Event": { "published": true, "date": "2022-07-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-07-26", "timestamp": 1658880182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5e20e2dc-323e-4fe9-a3e9-c684ff5145eb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe606cb-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843326, "uuid": "b4ef3123-700e-4606-987b-45f5617d60e4", "comment": "Malware payload (Mirai)", "value": "55da6fd33edb6f8d0eb668c08987176c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843326, "uuid": "a78ed5b3-c7fb-42b6-9a0d-1e4aeb5cc367", "comment": "Malware payload (Mirai)", "value": "003b4005bd9fc33b5c9a9bd953daec9b8ba3145ec3f478025841b789ad6d501c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843326, "uuid": "13b0e38d-19dd-4121-a984-3abb9d86b684", "comment": "Malware payload (Mirai)", "value": "7a886bc0a3f30a1109f1a084557ff9ae00a6a7fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843326, "uuid": "d445768c-70f8-43dd-8562-4916fc3e7ff9", "comment": "Malware payload (Mirai)", "value": "710b4a669bf80f51cae3c364d9eb396c7a9f750f1b14d6621c2820c76fbfc43b324b09ca97f9e88da4d266e5b86b6c6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843326, "uuid": "51a95453-033b-4810-90ea-fcbdb1c38501", "value": "T1BE332807B58185FDC4A9C17443B7B13AD462397E123DB1EA6BC4BE1A2D46E601F2D8D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843326, "uuid": "53b1f680-6a10-4db8-a4ff-e85149f99c41", "value": "768:ENUYvkxwSf0+fVlACmQwoM+JTXilBV3P7LGLcyUTq0LvifHOg6:iFMqwfVlDmQTM+JDiB93Cc/Tq0sHOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843326, "uuid": "622dcc4b-6c04-46b5-8a55-202fd8eb0f0f", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843326, "uuid": "ba86033a-2d97-4b47-b7a5-3c0915d70e57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843326, "uuid": "97a46dab-f10c-4be1-86a7-ba543f2530ae", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf05abf-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658846870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846870, "uuid": "71ebdf50-05e7-4d0d-b94b-5de84a8ec171", "comment": "Malware payload (Smoke Loader)", "value": "2cd1371c7a4582785f0fe4dabf7379ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846870, "uuid": "49af9216-d1a2-4362-9b8d-4167de0de754", "comment": "Malware payload (Smoke Loader)", "value": "01f7d82dc937af254b885cc7be7841da0245e3fcbbeccdd0db2a9c4460afca6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846870, "uuid": "11b59e05-5e1a-4b92-9df7-714eeff7b3f7", "comment": "Malware payload (Smoke Loader)", "value": "0d31a920cbcfa00772738a77cb3bdd0dacc6c260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846870, "uuid": "08261090-33e8-4aff-907a-928c8566ab20", "comment": "Malware payload (Smoke Loader)", "value": "ca33e413be68d1e7ee4838b74a3a1fcedea4db097fb7ac98ec03fad368104cb585d99dd9eb25f1ad72a79b404823083b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846870, "uuid": "9e4addeb-0d13-4178-9270-4a9acca05cf3", "value": "T152548D40B7A0D03DE07712F4797AC3A8B52EBDA19B2444CB62D57AEE56386D0ECB4317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846870, "uuid": "e098e661-e763-4cab-bf3b-fb6f82ff6e2a", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846870, "uuid": "84d00c6c-190f-48d3-aacf-e32125bd4c82", "value": "6144:NGzBzmxz8s5RNsjDX+14c/uomJX8aitA/y2bd/g:NG5/n+14c1uigy2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846870, "uuid": "01902009-6c7e-4b86-9667-399644083b89", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846870, "uuid": "f722f790-7359-4082-960c-47ca51dddfab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846870, "uuid": "43bfbb59-2da2-4edc-baf7-1a2868ffec21", "value": "SecuriteInfo.com.W32.AIDetect.malware1.11469.1787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b894f60-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1658849312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849312, "uuid": "c463491e-65b1-4e00-9664-0a22562b1d3f", "comment": "Malware payload (SVCReady)", "value": "02e8dc5942c0297296002e768920f664", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849312, "uuid": "582b1831-fa54-41fb-8ad5-4d768946d0f8", "comment": "Malware payload (SVCReady)", "value": "02521909209f8e6aaebccdb1b5e18bd6ac1801bb648899effccf8caabe0475ca", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849312, "uuid": "8b96d6f0-99ad-43b9-abbf-9a35b7ac0afe", "comment": "Malware payload (SVCReady)", "value": "712158ab3e3dd213d47a59d4ace3e9253af9d576", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849312, "uuid": "2ca31714-9982-4e39-9dfc-5556fddb10dc", "comment": "Malware payload (SVCReady)", "value": "3e664a34b9eddc8d2cbd055d35f040e093533eca9a726ab65c4759f592b1321c6d9f7a5774fa2733efedfa80aabcf750", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849312, "uuid": "d7980598-84e4-42c6-ab2a-bf4bf2fff864", "value": "T103F533D72BDBE197544CD53ED50B038B0A900B9B5E338CC2E5E30F5829AA6F6C7B8558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849312, "uuid": "a42816b8-fddd-4056-b7d5-d5918aa58251", "value": "98304:BA9oJbDxBhreowVnYckhdTwp3N7J8APQxyRIc06:BA9oVDxBR8qcY2X8bxiIcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849312, "uuid": "3ffbbc54-d53b-49d8-b1a1-6decb141a755", "value": 3535496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849312, "uuid": "0f6bd5f9-01da-4af9-a6f7-ef68821cca6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849312, "uuid": "eb4df292-840e-47e4-a206-6ebd77485692", "value": "alhena-doc-26.07.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ab2431-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848235, "uuid": "07689af5-564e-4d59-9ec8-a130d238b6bc", "comment": "Malware payload (SnakeKeylogger)", "value": "0507bb3f74549171291e592e7a29e883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848235, "uuid": "12efca5a-bbce-451d-b103-50c6f3cfae59", "comment": "Malware payload (SnakeKeylogger)", "value": "0311e79eadafb27a498d3c8ef9f91fe20e6dbcabe0035a2f814b809be3a02ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848235, "uuid": "e4dec814-d7d4-4388-9372-a46a3d4adc50", "comment": "Malware payload (SnakeKeylogger)", "value": "839dc2f6c20dba159d574e5a7b614c926925a72c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848235, "uuid": "8546cdc6-f085-4ace-a996-906e06275904", "comment": "Malware payload (SnakeKeylogger)", "value": "882c97a9a9363d55d3966e715ae7c2e3406f10ede5bff2de8a1f08952e1255769b5feaa1cd6be143f401146401458b04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848235, "uuid": "4e1ed35a-041a-4767-8854-4608f098695a", "value": "T12B259DAC359075DFC96BC6B9CDA42C64EA203476430BD743915386E9AE8DBA3DF050E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848235, "uuid": "1ecb43d8-9c67-4a1f-a87e-6e3093ab00bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848235, "uuid": "60a1464b-ee01-446d-b97e-ff7cd851e536", "value": "24576:qw4UZvybcv8vSP3zER+viVazxF7N4Jx0zHf:q6d8O6+viV2xFR44zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848235, "uuid": "93cb5312-494a-4ec3-bee7-a65a65b0177a", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848235, "uuid": "e2665e0b-038f-47f9-b4d9-3134a6c14a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848235, "uuid": "427d5ece-20ec-491f-b8cd-ab10a2af3131", "value": "confirmationlist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57bd822-0cda-11ed-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1658836873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836873, "uuid": "42fb3294-b046-4cbb-b103-bf619c0ccfa1", "comment": "Malware payload (SVCReady)", "value": "330b1f2f4183479441f25530c993fc41", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836873, "uuid": "d05b451f-a87e-44ce-9005-f85816382397", "comment": "Malware payload (SVCReady)", "value": "038167147ac824ac2ebbaee81b7c442694149368c2a40c99d7fbf630e3fda7a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836873, "uuid": "2abae8af-143a-42af-8352-4fdfb36c38aa", "comment": "Malware payload (SVCReady)", "value": "c35987c7062aefada74ae4dfd89c0e8798026299", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836873, "uuid": "dffa2fdd-b128-441d-b63b-e9984050cd6b", "comment": "Malware payload (SVCReady)", "value": "556c4ee50d8a5476e68c95fdd56a23153370e93929fc0547ff01d9797442946a64cc856c162410212b96e0d75e49c2db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836873, "uuid": "99b20888-2525-4fa4-a312-ce896c4dee59", "value": "T123F533BDC8DE9080D51D253420162747FFD89A536E6A6804BAD79D3736B030E2AFEF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836873, "uuid": "0de803c9-e0b4-4fbf-b327-9867708190ab", "value": "98304:NrrkU6XEq6ZRxfJnWOnF0wVJckEE5vyEK1UXsyB3n:dr36X4zjVnFhTdVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836873, "uuid": "fbb27f11-f07c-4b4f-af0f-0cc2fc3c3459", "value": 3534864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836873, "uuid": "f0b72388-79e1-462e-806d-7de17363944b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836873, "uuid": "d30e584f-96f1-47d6-9cbd-4b1f035d9b4d", "value": "technographsri invoice 26.07.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40351b4f-0cb2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658819523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819523, "uuid": "bbbf18f6-4e0b-48cc-a561-1fcb71ccf74f", "comment": "Malware payload (Loki)", "value": "54db07d27030a81011f3ecb7ea7d82bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819523, "uuid": "fc87a76d-77d7-47ae-ade2-aa395fd94b99", "comment": "Malware payload (Loki)", "value": "03cbd2e4a26c2482cd22f507d377c82b7497970f7bdb98b937e2f1267e13bc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819523, "uuid": "1297fa14-5292-4cc8-a839-86b8076a3bd5", "comment": "Malware payload (Loki)", "value": "a72d28c8ef9be51d380fb41d28de7548f2522f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819523, "uuid": "695ec65c-67b7-4e7d-b8bc-d96b708dba5b", "comment": "Malware payload (Loki)", "value": "75916f2cbe4892c15190a9a27d4f50004b49aff8dddfebad362d6ace4a1118c61ab73e6a88459c4db0f7fb2669bb3d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819523, "uuid": "7b828028-242a-4f7d-b448-fea803cbfa92", "value": "T195A401ACB22CBD17C23D8DF8A451958857F890577B83FBD94FC2A0B512C77681E026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819523, "uuid": "42a80ecd-b04d-4589-a7d2-18922f2a2719", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819523, "uuid": "491d3357-f5d2-49aa-88cd-cadd537797fb", "value": "6144:GwN30UDJKY0ozx19FUWk4FYmTdovfM+UHYx3b/XP1Zse8lPTEgu8U+g:jN30hCH9ZkgYmZovfbUHkrILlLEx8UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658819523, "uuid": "8a6ddd85-b697-472a-8360-af5eb57a66e1", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658819523, "uuid": "253925be-adc6-4f77-9a38-eb8118737e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819523, "uuid": "1a47bca0-f415-43e0-9df4-a129b9ea528a", "value": "54db07d27030a81011f3ecb7ea7d82bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e157e82-0cd4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658834123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834123, "uuid": "75ba4c56-9783-4c8e-bb33-dd13a56b31cc", "comment": "Malware payload (Loki)", "value": "fbb193e605f603dae34e5f8bd5f8f155", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834123, "uuid": "38cf6007-d9e3-48ca-915c-47d5ad3f4dbd", "comment": "Malware payload (Loki)", "value": "04c158a7c42725cef2fa8e74f611142f88b6a3e0269db98751de5cdf8376a9c8", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834123, "uuid": "bac654f3-e803-4da5-91c6-d18c1299e141", "comment": "Malware payload (Loki)", "value": "d795771b20e2a53134e27a0feea64d2df2cd150d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834123, "uuid": "668cd5f5-652c-4cae-acc0-631ccd5c48e6", "comment": "Malware payload (Loki)", "value": "c4563654e44a38ca99fabc1c552dbdb6784968c6d3507cb16ab7a9251cb5e683f85f7a918ae93032b7f72fb8538b3e77", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834123, "uuid": "727048fb-c9a0-41e2-b9a4-78260b4a9340", "value": "T17C14C471769A8715C49B0D30C0DE311C13A2AF866673E749FD8D33B94BF339A8946B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834123, "uuid": "4ecf2575-0650-4b20-8c59-0642f2554c89", "value": "1536:RqWrYA4MQDTqXmyZ/s1MmsAga87IomyHUXLzZaQ:AWrgd4s1MxaToJHUXLta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834123, "uuid": "73947c8e-72f2-48d8-b735-16016162f3b2", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834123, "uuid": "e1257900-c915-43d1-bc9a-bc4c583d1d63", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834123, "uuid": "81dc5924-31e2-4726-be49-3825b7d74a8e", "value": "Narudz\u030cbenica_(P.O_60463402)_ATINEL.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0107111c-0cea-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658843469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843469, "uuid": "99fa0df9-ca47-471e-8b5e-46955fab80b0", "comment": "Malware payload (NanoCore)", "value": "9029d9ac614e0ff44452afc9530977ce", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843469, "uuid": "fd1f0a2e-da27-46bb-9396-a9a0736fdc01", "comment": "Malware payload (NanoCore)", "value": "05cf49d4b99ba26c7120ecad40f8f9adce36e507514a4f1a9610848d22f2e507", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843469, "uuid": "1b1e8175-cb93-44e4-b87a-8b08f14e5508", "comment": "Malware payload (NanoCore)", "value": "87c53e7cb1db027ebc311906e65d3827be3fd20a", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843469, "uuid": "791858bd-0aaf-49ef-b089-a7510b333905", "comment": "Malware payload (NanoCore)", "value": "093ccec3763f285652c86913d1754bd6fa27fd7e6f778983932f9534ef00bfbe701047019b70283e21d79b901592c622", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843469, "uuid": "f5a25805-5db7-421a-841c-246849ffb8a9", "value": "T16E45121437A59B25C8BD4BFC5026274087F5F24AF201D74CFFEEA4D56792B840A60AEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843469, "uuid": "f39a8f19-a05a-4e44-a7e9-ceb99dc335e8", "value": "12288:XjfKv30psbrt/LF3S831Zir7kyGMW7jvYdh+axaCXMi9QIzx8:zKvEpSt/L1Sg2h1UvCh0iXzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843469, "uuid": "b51f40c2-ce1c-4e72-8826-5500ecb148bd", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843469, "uuid": "a7bd999f-eca5-4fce-891d-2d390c74bd48", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843469, "uuid": "a0032e40-45f1-49ad-b51a-7a936eeaca3e", "value": "payment receipt.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09ed2cb-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658854984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854984, "uuid": "58eae7a1-7fc7-4d79-a6e2-e3eac2695fd0", "comment": "Malware payload", "value": "2f5f271577208be939bde828e5dee66f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854984, "uuid": "5577c0df-3047-49e5-a4d6-7c26b047d53d", "comment": "Malware payload", "value": "060d39fb32f13a93db8ce84315b0cb66659d268c6b829df6b91c0c0f33501271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854984, "uuid": "f58daee9-7f47-4e54-bdda-51a7183f53ee", "comment": "Malware payload", "value": "30bc73aaf2a2b5a08a87cdff4d637c2cb827ab1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854984, "uuid": "7ed0482d-dead-466f-ab74-62f45b78f5f0", "comment": "Malware payload", "value": "b2d2b76ed83c39f4498c2181298b784e7607fbe42457ddf8a35229c69ffc80035709dfec8a13f6147664d5a38d5e0cf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854984, "uuid": "19d6b2c7-d59c-4c76-af7f-7fdbf30d9beb", "value": "T149F11008B1E8DF63E53E87FC4195130903B616671111FF6A0EDDA8D22A77FE609048AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854984, "uuid": "2e210e45-87ae-4161-a389-50e49a01026a", "value": "192:tAfAE+tltBtI8Shee0he8Oele8el8eHfieAeIF:tbtahee0h185l5/3dIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658854984, "uuid": "52045e7d-ac87-4c02-bc2f-fc679e14bac3", "value": 7918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658854984, "uuid": "0ad06a9a-7841-4639-b246-7ed21681eec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854984, "uuid": "75e8490e-5095-453c-9fe0-7f9c12fc703a", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22154.16188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ac28b1-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658851617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851617, "uuid": "d07283dd-02f3-46a0-8310-a052f4750937", "comment": "Malware payload (Formbook)", "value": "5d3bd8a99d63e0cbe343ab926549970e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851617, "uuid": "ac70d376-f62a-4856-9ead-ea0ec05e9df8", "comment": "Malware payload (Formbook)", "value": "0619d06bd956864677a71b2044e184c38050aaf55ec7fcd05376f72200502106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851617, "uuid": "dfe63f7a-53a7-4451-a849-b00e92d4a925", "comment": "Malware payload (Formbook)", "value": "75771251a3c5a008d6a226c713e7fcbe62ce7ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851617, "uuid": "2bf6b8b9-2f75-45a4-8a42-becb90834c51", "comment": "Malware payload (Formbook)", "value": "d2914dc5fe87a6e88af46926103efd2f354941bc4d12e9a81b5d8923b037e8e000a1360f1fc7902e2487c0ef5b7406cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851617, "uuid": "cb192d3a-2559-42c2-9e6c-e97a1d08f4cc", "value": "T17A45ADAC352075DFCA6BC6B989946D64AB2038B7574BC607901331DDAE3DBA7CE050E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851617, "uuid": "54bc74b9-2da1-43de-888d-195998fcd33a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851617, "uuid": "738a9832-d9e6-43c6-ab90-19f199502cff", "value": "24576:Pw4UZvybcv8vykqQO6fjuFae9/uoVVx/QZxQZHbvLe:P6d8bqQVSJAIVhQMZHbvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851617, "uuid": "1398f74b-d25d-4cdb-a1e5-d203abcf6681", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851617, "uuid": "ed9ceea5-e321-4d8b-8aed-0dbff224ff63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851617, "uuid": "3ae22a4b-0f4b-41ff-83ee-48e158982a96", "value": "SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c79040b-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848240, "uuid": "3eb32c00-745c-45dc-b9ab-03261c3f92cf", "comment": "Malware payload (SnakeKeylogger)", "value": "ce3697e3067c1ab2f639cab5c7e2cc2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848240, "uuid": "bf917fea-d3b9-44d8-ad11-c51ac316a6bc", "comment": "Malware payload (SnakeKeylogger)", "value": "079c1e54981b363c0ab406601c4c8cfbe9dd8075b3ea54625e362afa7e48c50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848240, "uuid": "af987226-a265-4d0e-814b-e97bf62e5f0d", "comment": "Malware payload (SnakeKeylogger)", "value": "e2f35a8994a15b8a9b1fd46038f307ae5077034a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848240, "uuid": "974f96b5-f92c-4584-8431-17038434a694", "comment": "Malware payload (SnakeKeylogger)", "value": "784be7b404f2a1f57bd1674cb6c525b1b40a3a298aa81a21acf4e4ca82ee42853ee1b4b80e6bae233a5e6002603a7104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848240, "uuid": "f5c32cdc-1e81-4125-9d01-cf8b08627822", "value": "T108C45B9C3692729EC957C4718FE89C64EA60B837970F9217942313ADDB2DDA7CF110B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848240, "uuid": "75b85a07-395e-4f33-8a0a-155b6db78dd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848240, "uuid": "9f0ec87c-704e-45fc-8772-d6d9cd3d5255", "value": "12288:S/t2iNDXR0q7bqN+CHgcSCGJdILINCatExR/kUkXs4FTrdlYV9MHuy:s1r1OsYSCGQI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848240, "uuid": "640bb9b3-2524-4293-929c-1512144abaf9", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848240, "uuid": "eeef61c6-bb50-4973-9469-32faecb61157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848240, "uuid": "1361df28-fcee-45e0-b58c-80dae1cd214f", "value": "RFQ26072022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9724a783-0cd2-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658833413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833413, "uuid": "9375567c-b2dc-46d8-8cee-1bd06cc1efee", "comment": "Malware payload", "value": "0b0e632dd06eed5e9031f32ef73f70d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833413, "uuid": "785b3c1c-6bd4-4fcb-ac59-f24a9cbb9488", "comment": "Malware payload", "value": "07cead2672f4a3631dd764d4b4f53bfa35029304fea1ebc6d8f4faa7391222e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833413, "uuid": "6aa19105-8e51-44e8-91c1-473c22e877de", "comment": "Malware payload", "value": "d86ce440e6da481873241d367b621565d60dcdfa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833413, "uuid": "ae1bcafc-9a84-441a-b2da-92a400b11ad5", "comment": "Malware payload", "value": "b27713f6ecbf6f69d6b324fb850052d3b53c3ef446e9bec3d891e3a6127d2605ac10aefaf59016c5e31a7b5bf50d71f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833413, "uuid": "da481306-c311-4de3-8f88-cdeb2ff8750c", "value": "T10E3493B237F990C8B2774A23EA37FFF14BBF7B596864C90D4D28618A0AF19A44541707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833413, "uuid": "96b34e08-120a-4f1c-8eea-2d41c06e1965", "value": "96:yDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDoDom:JNya9aMHw3lZt1oK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658833413, "uuid": "6013b504-7aad-4ae3-9df5-5553f3af88d0", "value": 236606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658833413, "uuid": "48721915-bf2f-4350-a2bb-2d284d5363e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833413, "uuid": "60c89c02-dbb7-4555-b3bd-8a7fbf36f9c3", "value": "PURCHASE-ORDER-NO3082022-23SV.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2a6150-0ccf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658831970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831970, "uuid": "7a2d6740-8b13-4f8b-ac31-fc8523d173bb", "comment": "Malware payload (Mirai)", "value": "93e3d43e40b7629d411d65838ca8ad36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831970, "uuid": "0957816f-9e9f-4437-ae47-03858f243a4f", "comment": "Malware payload (Mirai)", "value": "085adbea50f92bcc93970e0078c770fd073f87bec0c2dbed75a7a3b094d8de10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831970, "uuid": "a9ad588f-af95-477d-9d6e-ee52bde188c3", "comment": "Malware payload (Mirai)", "value": "6556ab0b19a267f5e7a4cf6bd0043f6439d91fae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831970, "uuid": "784c79f3-681a-4314-8e49-05462c572a43", "comment": "Malware payload (Mirai)", "value": "6b33c910f055b3a31779c5fd1c0bbeac6a80770d49e8a53b2f74e0b02633c97ebcbff0bccc64399cf7ae56e9ab219e37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831970, "uuid": "3d654c2d-5f55-46e1-909c-685cdec9a803", "value": "T194B3D84EBFA04EF7E85FCE3786D917152A8C550E21B83F357AB4C824F50A14B19E3968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831970, "uuid": "e7d4b5d4-a726-4f07-ad29-dae4b14b7165", "value": "1536:Bfkh8dyqigO7966Zu99Rh13nczqYylfSWhWtcNiHExfTDSWw8oD:Bfkh8dyqji96+Ann/fUodDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658831970, "uuid": "1e27cd7d-3e72-4a28-8ae9-0d2f58b0d89d", "value": 109280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658831970, "uuid": "08fdc51e-3208-41e2-8976-6cc3b79c9dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831970, "uuid": "a624fbf6-a203-4228-8542-ebd65cd39ee6", "value": "93e3d43e40b7629d411d65838ca8ad36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4c7c4b-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload (LimeRAT)", "timestamp": 1658854848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854848, "uuid": "2d4fe9f2-b0c5-4a26-9a63-bc1cfb3d0cef", "comment": "Malware payload (LimeRAT)", "value": "316e1649302c9aa2652086951d23c32b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854848, "uuid": "b06ca099-5c7f-4977-9ab5-40a50adadd50", "comment": "Malware payload (LimeRAT)", "value": "0931c4d9c3b9aa6500e654be85d3415d0fbafff6241c9fa2952e646cd533ec17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854848, "uuid": "f5f03ea7-fbca-4a4c-a91d-5e923d2bde4b", "comment": "Malware payload (LimeRAT)", "value": "454180c62d32ce43c805f7ef84d6bb90e08cc841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854848, "uuid": "e5c7529c-9e09-4be9-b1c9-67f1803952af", "comment": "Malware payload (LimeRAT)", "value": "897b79688664f0f9a08472023d1b128632630ae12a6ea5785658a49355c86adca5e35a4c7601f996a023c2c43aee5977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854848, "uuid": "888eaa46-d78f-44da-9e8d-390b68d831bf", "value": "T1A7B4BE1125CB7754EB39F73816E4A0606FF6FC23D215E92D2DA633968377EA04A32427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854848, "uuid": "ef36805d-fdd1-4622-9b7f-1a220f58a2b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854848, "uuid": "c5312c04-40c3-4fc0-a176-42978405d91b", "value": "12288:Nyo+8ZsZyZ/sdujjixgV2iND7RulSH6QRm79AZ:Nc8ZsZyZ/s0ixgV1F0cH6QkAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658854848, "uuid": "2681dff9-45fa-4b35-964b-adf0a92cb6dc", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658854848, "uuid": "f6469305-e618-4ff0-a4f1-a7fe6a819684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854848, "uuid": "ef02616a-4a2a-477e-92d0-1fc37710a495", "value": "Wire Transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a47c9d9-0cdd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658837928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837928, "uuid": "54405c69-d79d-4b83-a7f8-ed16120a78be", "comment": "Malware payload (AgentTesla)", "value": "8ea9211b86c9803c76365e3571eebd2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837928, "uuid": "a47d598c-b484-469d-a51d-c4745a98108c", "comment": "Malware payload (AgentTesla)", "value": "093d505361d9250f3b7aa96fccb0c269f85c53b8f752a29e268337c75c82427f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837928, "uuid": "85d79a45-88a5-4a4e-82e5-f88e504f6dd7", "comment": "Malware payload (AgentTesla)", "value": "540664e44760fab2afd28580d92eea4685721547", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837928, "uuid": "a87ec407-250f-467e-a459-672d9acb6d05", "comment": "Malware payload (AgentTesla)", "value": "153ea4c454b478d3dd217daf809dab7d0cfb25abdbe1c45222e218f18dda7e51e5236fc7ccfe755820da26089f30db03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837928, "uuid": "41f6c612-81f5-4a1c-8129-9152ee7dc001", "value": "T1C2E47C9C359272DEC917C4718FE89C64EA60B867970F9213A02717ADDB2DDA7CF110B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837928, "uuid": "d859ee3d-f47e-4c6d-84b7-7b94f7bfdbe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837928, "uuid": "2e5413f0-84d6-41dd-8210-7fe309ff3959", "value": "12288:wV6/2iNDXR0gP/qzdAvEvzD5HRrHkxWy/LwDs64AfR5nTtkAWMOxcC4ygqvrS9iG:wo/1rrVWX5xrExPs4U3ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658837928, "uuid": "fb6f855d-374b-4da3-8504-8961ae98312a", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658837928, "uuid": "989483d5-50ce-4300-9633-2916658b6da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837928, "uuid": "2d993f72-055a-4ae9-8063-2df7f3900d31", "value": "Overdue for July & August Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b25bf9-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849186, "uuid": "62dd707c-914f-4b91-a629-4d154323ccf9", "comment": "Malware payload", "value": "eb42030de0af665e345503837eb5bdbe", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849186, "uuid": "f198187d-46cb-4f9b-87c3-8668b627f7ab", "comment": "Malware payload", "value": "0ad03ad295a27a25238a485e099ee5abe38e4d795658a5290e015f07beea6f57", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849186, "uuid": "9c818ea0-a455-423e-93aa-fa652670eb59", "comment": "Malware payload", "value": "0f35941275a6f09a2b54a8e221862cef702a597c", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849186, "uuid": "44cb5604-ce89-4850-9f88-bbc37a5b6c46", "comment": "Malware payload", "value": "4a4561c7100e17127cfa1e9fa1019b35a6491300e9751d8e4bd4c9a5e03436b86df6be795c39100324027fcc2e4ae218", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849186, "uuid": "10f33eb2-c738-4a4c-9b4f-0420eb8b781a", "value": "T1EF43DFBC60E972C4FB8327F599C9F7A0FA246D275D4794C238F9723D64B28C8011B5A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849186, "uuid": "35436110-b446-438f-b306-b88343a66eef", "value": "1536:PUuUQV/GJgjLGgXQWLaSBWSL8shmr4UpDg9gsVACa9b:PnUQiUXQWLXB1Rhw4UjX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849186, "uuid": "ef4bbe3c-1c51-4ba4-8aa9-9badc8655c22", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849186, "uuid": "d27ca1ee-a756-411c-9dd1-91031129ed76", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849186, "uuid": "38e4197b-e276-46af-9247-4de0051e0df1", "value": "ORDER70127.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497af014-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877951, "uuid": "9686b96c-d235-48de-9cdb-96c3310412d5", "comment": "Malware payload (Mirai)", "value": "3e9b35640bef09ddfb6f8128f3400a16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877951, "uuid": "26e88fe8-fd22-4471-a278-c90b03afe6bd", "comment": "Malware payload (Mirai)", "value": "0ae02c7ecd108bb18bc928f9b850141dfb2a4ef76fd87573f1da452086461894", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877951, "uuid": "c01b1441-5279-48c5-8170-cf6e73263df3", "comment": "Malware payload (Mirai)", "value": "9928133a5f9f7b39e5a2ee06bb3196bb1c3d7a7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877951, "uuid": "1bafc05a-2137-4c43-bab6-c130473203fa", "comment": "Malware payload (Mirai)", "value": "1c6d960768b3219bf19a7bc9200a06b09926eb762452610f5699beb8e53e888142233d97583832e0f28c19504cfa980d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877951, "uuid": "31a531df-5911-479b-b5a6-3f263799e9c2", "value": "T15673F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877951, "uuid": "577017ff-cecb-4f86-acdf-c98f65ee0efc", "value": "1536:bppNb+R4xN2XaY4V6dtcmqIPU0ZNSoHDuYJa10:bppN6RuNeaYXs0nd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877951, "uuid": "149fdb24-66c6-4c61-9d23-7d10ce6c96ad", "value": 77336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877951, "uuid": "e2fba623-8049-4015-b38f-b2c4939ef689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877951, "uuid": "1d28384a-6437-42cb-824e-69d8466c8519", "value": "3e9b35640bef09ddfb6f8128f3400a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9a9980-0cb4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658820432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820432, "uuid": "5d454e05-1a20-4af7-bdde-6086e84d3b2a", "comment": "Malware payload (RedLineStealer)", "value": "ec2c3f3f748fd8b41a0e03506b21bd9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820432, "uuid": "fc040042-58c9-4853-816b-dd3f088b72b7", "comment": "Malware payload (RedLineStealer)", "value": "0bfd52730e963c22d4b4b6cfb98750cf831cc4be9fcda43d6b132f95a8a5ced9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820432, "uuid": "35181864-fc3b-4def-9d75-a7b9a605df5b", "comment": "Malware payload (RedLineStealer)", "value": "e34471dd6167407866e37516afea6abd8611f7ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820432, "uuid": "da2ac1a8-0061-4d3a-ba22-83620f5a1d72", "comment": "Malware payload (RedLineStealer)", "value": "113775349c1cece47260bc4ffe12b487b01bfcff60c0726b6eda51cc868dc5fe8b02feec971a22a35f1b7614024eee56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820432, "uuid": "a03661b7-bd76-4636-b1cc-ee8346f9c6c5", "value": "T1CE94BF44BBA0C03DE4B312F47979C3A8B52DBDA1AB1051CB22D67ADE56342E1ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820432, "uuid": "38b81319-c0a0-4582-962d-9e66e2344234", "value": "e6c3aa777d2861625d0bcdf9e9a3689d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820432, "uuid": "d7d8b5a5-e180-4daa-9b62-a7c5cb5a9eda", "value": "6144:tfkCassL2EJYPzZO22JutHfvlHxYw9lvevXijiJLQWiX6e1w16xlLI:tqFfMzZO22JutHlRrlWvSjipYs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820432, "uuid": "c97d069b-d43a-4124-907f-1ef74ad7ef3d", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820432, "uuid": "6d79d8c0-8e11-443b-b7d1-86ee52ebd9d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820432, "uuid": "ddff5cb9-22fc-406d-a9f5-4978ee913f6b", "value": "ec2c3f3f748fd8b41a0e03506b21bd9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1d76d3-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658817720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817720, "uuid": "541e6c6f-6e30-46eb-bd4d-87930bb86246", "comment": "Malware payload (AgentTesla)", "value": "8a1b8c82c0fd07cbd22265a679d90883", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817720, "uuid": "1540271a-676b-4013-965e-fa117f64f013", "comment": "Malware payload (AgentTesla)", "value": "0cf50f70d7c77e466dd5ce256f5c78800469977b1266e944da1cd06ba63add21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817720, "uuid": "940cdfa7-3f1c-444f-8c13-eca14de6a0db", "comment": "Malware payload (AgentTesla)", "value": "948784e5f192156ae6e99b55905bce02c8d2312f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817720, "uuid": "3c1fb647-91a0-49d6-9426-ff1e4d8ddd9b", "comment": "Malware payload (AgentTesla)", "value": "a9a2f1d86ff1721a5dce482a5e3b51ef1a994e340eb1b53e14e1389cd4a74cd28d2de9db54f4f67d5b9bb8e27c90cfbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817720, "uuid": "2b36ffba-f60c-4e43-af50-f46482461373", "value": "T14BB43340C85EF46F849B01337744AF08C93878DEE857D8A66F6FFA7F549B804B492664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817720, "uuid": "e7b8269e-820d-4320-ab6a-b59bad38d5c8", "value": "12288:erk0gqEH3X0jWHQFwX00KekNn70N+TgbJIB5:erkOEXXZ24BKf6+kdIB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817720, "uuid": "2fda8604-0704-41bf-93d3-34839c6d1adc", "value": 509243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817720, "uuid": "f433fabe-3f45-4262-8fc4-4a588c3e502b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817720, "uuid": "00af5cf4-e29c-4c8d-a836-9ed5b1a4e06f", "value": "Special Rate Proposal xlsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c40c795-0cf8-11ed-93bb-42010a9c0043", "comment": "Malware payload (OskiStealer)", "timestamp": 1658849743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849743, "uuid": "fcf3f241-7a74-4268-9bfd-5f7fd32d2f4c", "comment": "Malware payload (OskiStealer)", "value": "379ab7eebd100778e2605df3c32da046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849743, "uuid": "c83d9ed3-ba06-4f5b-8d71-af60ebf77c30", "comment": "Malware payload (OskiStealer)", "value": "0d680dba51deffe04686d1df8c87de9c6c0310f7060bf4cfb0079a2f25caef10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849743, "uuid": "d9df93f2-7b7e-487c-92ba-f781284c12f7", "comment": "Malware payload (OskiStealer)", "value": "cba7f97fb75338262c97549608a653c155150813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849743, "uuid": "d9da8a2d-94ac-4d26-89bf-5067f4ac5fd4", "comment": "Malware payload (OskiStealer)", "value": "bac0dcc8221ac0f20356c1a54a04a92635303ab53442114e0dff56f7bbaf8d7922f53c934b3fe21fb4a56b377e69b3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849743, "uuid": "8fa4a22d-bfca-4bba-9fda-43436bd0ad05", "value": "T17AD4E08A63E21F06FE6F033776922A05D1F72F855C6093DDA4507C97B3BE1C990A18A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849743, "uuid": "148872c2-aa8e-474b-ba4f-f4cb6c5ce9d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849743, "uuid": "22009b29-09c9-4bed-8e37-619b64df58d3", "value": "12288:3Ubjod8XX5e714XBmuhv41qGrE2/+UnapEoWVP:DYFxmuhA13v/+UnapDWVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849743, "uuid": "098caaeb-6d0e-4921-9af5-4bad19710144", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849743, "uuid": "1aa74b2c-2d78-4f7a-bcc1-9686fcb1c96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849743, "uuid": "8e20973b-0552-4255-a4fb-bb0c2b43845c", "value": "379ab7eebd100778e2605df3c32da046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621cb5d9-0cce-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658831606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831606, "uuid": "29fb836b-77af-4eea-85e9-fe58cd90dac5", "comment": "Malware payload (SnakeKeylogger)", "value": "fd6885269e6a7d68a4c553e9603e0f38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831606, "uuid": "1f9a3509-d98f-4335-89a4-8dbbf1d20e73", "comment": "Malware payload (SnakeKeylogger)", "value": "0e10e646be7b3f9857a2994bedc1b808fabc112009cda3192df15b8eb4980ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831606, "uuid": "850bfa75-08d6-45e9-a605-52edb963884a", "comment": "Malware payload (SnakeKeylogger)", "value": "58d53046042f016d9ed8cd3e1ba75eac75996fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831606, "uuid": "4343a0db-24fc-4e70-b345-db86b7f043c6", "comment": "Malware payload (SnakeKeylogger)", "value": "2c016b61be0dfe2974be1089dc9b104d8bf5657da67ba0be9c286631f5865e019e5d723dd1702ed5e2b9201ad97ada3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831606, "uuid": "7232423c-1502-43bd-8823-f9108bbc807f", "value": "T17915122C56A48F07D9FD83F98021050497B539153497E7AC9EC2F0DE3F67BA19A4AE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831606, "uuid": "53b66663-2770-46fa-9344-e648dcfb757a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831606, "uuid": "5b606033-05b4-46a4-ac17-22cf31df28a2", "value": "24576:6crw4UZvybcv8vntTftIBVSKsrDtHoB3+GxAP:6cr6d8/tztJrZHowh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658831606, "uuid": "c7f2e9d6-7410-4895-8b8f-697ebb33af49", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658831606, "uuid": "65197d4e-61c9-412c-bd77-c34b0ce8f035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831606, "uuid": "2b4e2804-34ef-4926-a288-1d95c5df9a37", "value": "ScanFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8d79d9-0cb6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658821292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821292, "uuid": "f4dd0d0b-73d8-42ba-815f-d0dd523c58de", "comment": "Malware payload (Formbook)", "value": "6946b7f7508b837dec1c4b9d811b7a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821292, "uuid": "4edd49bd-ff4f-4421-99b1-b01d83bbe0c2", "comment": "Malware payload (Formbook)", "value": "0e2abaab5494aa558c56833f0f191c641ed2fd6f7a6b9214f6800eafdd8ea117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821292, "uuid": "aa1c388d-b51c-4ffd-a33d-dc7df4611559", "comment": "Malware payload (Formbook)", "value": "a33764c6b50851adf7701467fa0932ad87360723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821292, "uuid": "d388a37a-33ff-4441-b65d-2fee8025b2ec", "comment": "Malware payload (Formbook)", "value": "8345f06f1ea1c626f44d14a13952e285b7008684aae7f3edbb30001f24d13a684af439867f4db6e6b224ed58ee97962d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821292, "uuid": "6c51ed51-614d-421f-953d-fa54efb60481", "value": "T18115122C2AA49F0BDDFD87F84420050443F039263947E76C5ED6E4DB2F6AB614E4AE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821292, "uuid": "e634e919-8045-428b-ae7b-cf07f47ee995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821292, "uuid": "bd9dae8b-50e3-4440-b84e-2505ca56ae68", "value": "24576:lc9w4UZvybcv8vjG5WW83X0L4t82bMtgLx:lc96d8C5WlH0L4m2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821292, "uuid": "06e5e5a6-8dde-4ac5-ae37-d5f10df57c09", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821292, "uuid": "e1888939-c3e0-4b84-8812-82a80f66a9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821292, "uuid": "1b0045b6-4ee5-4be8-8fa0-89ddaaa5a61f", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.22184.10451.2129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061b4d48-0d15-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658861946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861946, "uuid": "75ace46e-1f56-410d-91ac-c1ad64c710cb", "comment": "Malware payload", "value": "185e1b38e1b57da7d9c73e849541fdb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861946, "uuid": "17b688cc-e827-47da-aa83-9eb8d11619d8", "comment": "Malware payload", "value": "0e7d2dda2f1a7e8ea4e5ef528cdd05c3341f62230662981c5cced9a6c01d8a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861946, "uuid": "a5b8dac0-a85c-46a4-8f31-ffd77a0618e0", "comment": "Malware payload", "value": "d0c7f1d04465a59d33552672e74c334b30e47de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861946, "uuid": "047eebf2-a4b2-452a-95f6-5dcda65329b2", "comment": "Malware payload", "value": "fc162ff2a9e8fe54080021f4e691633d4873accf0fee0b6b52da82ae9ba8c9b13fb9b2c566731ecab7b750910222ca13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861946, "uuid": "4473b1fb-960b-4164-8837-cc394be544f9", "value": "T11FC4D07213ECC659E7BF06BAF8244112837AAF07D44ADB9957D4F2DE29F63908C01267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861946, "uuid": "5e6ca403-e7ee-4dbd-a225-eac3fb7c4a29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861946, "uuid": "effd3aa6-43e6-4469-b9bf-4409dad984b1", "value": "12288:gdDVgwYx02b2UVFdPBGj7UQRj/9hD1dbtc8d+c:E6GjxjnB5tc8kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658861946, "uuid": "692f9d51-fd12-4ca8-aa8e-912904624970", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658861946, "uuid": "7bea0570-b38c-401c-9a61-aec83fc9968c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861946, "uuid": "073d68d9-5149-4d71-98ee-7fac7e5194c8", "value": "SecuriteInfo.com.Variant.Strictor.267077.16486.27946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edd2ef7-0cfd-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658851680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851680, "uuid": "3e499a68-fa6f-4d3d-88b9-3b4ad9b5115c", "comment": "Malware payload (RemcosRAT)", "value": "19ed13315f8b7604a36430175972454b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851680, "uuid": "35affd49-8c1f-425d-8051-f91abbddf91e", "comment": "Malware payload (RemcosRAT)", "value": "0f04d67901cbdd7f63f9aaf7c5e8493e8d5f4347df701f214232c761d489aeba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851680, "uuid": "ab58c681-0bc1-4df5-ab31-62b4e7a47300", "comment": "Malware payload (RemcosRAT)", "value": "00f8e9a3403782b763f816e951285ebfbad63ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851680, "uuid": "234ecbe7-89dc-4ad7-9871-9c9203fc930a", "comment": "Malware payload (RemcosRAT)", "value": "8ce1c6e8edc949074bd8275bbd83b3f14d6acfc768ef19b01c69f5897121710cb2d1a283415db223a637c4e385617906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851680, "uuid": "46f79ccd-1dfc-48be-82db-1ab62473c3f0", "value": "T103D41258B9C20333FF85D5F38D12CAA4C1B1D1E4A1871753798D0E1CC6AA66A99273EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851680, "uuid": "34f5dec1-6ca8-4918-95bb-ce390226104c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851680, "uuid": "f1e88607-609e-43e6-bead-00ce55eefbc1", "value": "12288:IJZiNqM8RdfyjeWg/D2u0/10CE4Gsju+WN9PorK0:IL8MeCGm34JDUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851680, "uuid": "ac3de7e6-9367-4daa-bb00-5536c076d272", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851680, "uuid": "7d77f4ba-2f17-4b59-8f94-722c144a375c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851680, "uuid": "af7b00ac-53e5-4093-a6ff-9a5e8f792970", "value": "19ed13315f8b7604a36430175972454b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ed7889-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658851160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851160, "uuid": "3ce78a8c-5344-4a5d-97f2-48a6ee3cce80", "comment": "Malware payload (NanoCore)", "value": "d37cc595c5293095f0b41b5dab35082f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851160, "uuid": "4ec57d7c-a27e-49ff-b90b-deaaead95b51", "comment": "Malware payload (NanoCore)", "value": "0fa4a909bca937bd8f9d12a8c5b84f6cc63e1b37a3bf130b34fdcaa25be63ded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851160, "uuid": "1f2e4b4f-5f71-4079-a312-bbe8a11d4530", "comment": "Malware payload (NanoCore)", "value": "180c81499a958ef62e125e6f0bbeda2c4e9f9395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851160, "uuid": "1ca4affb-2b56-4640-916e-d80022e279dd", "comment": "Malware payload (NanoCore)", "value": "0738126e8b1bb2068439e824cb84ea82a04f62e151bd6d35020aadba7a4e2582828ca9902a823ea1b10d64b8ee594010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851160, "uuid": "efe6ee63-8132-46ed-b8b6-b375f7d2ac5b", "value": "T19E05F12513ECCA79D9BF07F9F8204551437AE307E45ADA8E5A84B0CF3E627A0C5066E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851160, "uuid": "70761697-1f8f-4f9d-a2e4-86dc95bb17e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851160, "uuid": "927f1114-14c4-4739-85c3-3b07b7eeb58c", "value": "12288:/dDVzwNdzi02b2UVFdPBGjJP7d+IFxyXQo64zIA0IHi55SR4oyRYAd+f:LzwNdwGjJh4Q+Mnmi/6DYVkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851160, "uuid": "b8136a1c-be06-43c2-b6fa-e836f07753d4", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851160, "uuid": "6f8d1491-0350-48f1-9a12-45f76ca07ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851160, "uuid": "989e810b-9aba-4035-9443-2125a911ac38", "value": "d37cc595c5293095f0b41b5dab35082f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90da0f9-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658818089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818089, "uuid": "d11bf207-7855-4797-be0b-1be25b5f2eda", "comment": "Malware payload (Mirai)", "value": "d7fe6910fa36517fadf345fc9e29756d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818089, "uuid": "7be0d213-0b8c-4416-805c-81af9c21cdfd", "comment": "Malware payload (Mirai)", "value": "10035694ef1d4985f13967e8e3004495fdcadff2103ce4de7a8508f81ce53302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818089, "uuid": "87927497-0b07-4230-8bb5-2ad9e5538176", "comment": "Malware payload (Mirai)", "value": "5205cf99d6f6dd62aa8428fb0582c7ec3888d0b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818089, "uuid": "bd684cd3-6b6d-499b-90b9-c90ac1fa1f42", "comment": "Malware payload (Mirai)", "value": "15781283200ed9717ad056fb3536bd6745a8cec930c44a77fef28a26d82d4708d99260b4543e1df7a489407dfd640b1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818089, "uuid": "1e035dc0-e46d-43b4-895f-1ff3eca7e86e", "value": "T172338C75E02DAE84C4530674A464CE740F43F1C8A3A32DB71EE682E19853E78FA15FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818089, "uuid": "47d99553-6a19-4b01-8126-f5ffe2d852e0", "value": "768:waS8egC3qdReStiLrSWUTf3atW2/z0yC8+own0KA2ChwwJZY10Ue:wa3qaJgwTfKT/3fBwvZChxJa10n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818089, "uuid": "26c60b8a-563b-4ca5-a603-939533e37978", "value": 52356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818089, "uuid": "dc99a8db-a920-44d3-96bc-a982f1a6ae7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818089, "uuid": "cc11a416-aceb-4d4f-9d5e-f9e4704a3514", "value": "d7fe6910fa36517fadf345fc9e29756d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c25275f-0cfe-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658852266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852266, "uuid": "3c3b2200-b087-4fa0-911c-7250cb10552b", "comment": "Malware payload (AgentTesla)", "value": "31e8dde99ed5c43ad07af1758338c226", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852266, "uuid": "8d4d1a47-229b-4868-9054-cb6c737414c8", "comment": "Malware payload (AgentTesla)", "value": "11272bf5c1a43644a470914b66bf65e88f878e8a8a2be498b368f306fb5223a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852266, "uuid": "2c9e216b-2d34-4600-aed3-e75b3e993159", "comment": "Malware payload (AgentTesla)", "value": "7622c637f340d89d834dcecdd9b100753bae0ca8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852266, "uuid": "abb9dd70-856e-4476-91c8-0df5661110b8", "comment": "Malware payload (AgentTesla)", "value": "2909700a3b71c797f8548e4241317b0b0efec7d98fd9a93d6a5ddc9e635536f789e45c1b8483dddc84b9cb862d31f300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852266, "uuid": "09bc0a87-d63b-4da0-a87a-14b1117bae6f", "value": "T1D005F13213BCCB99E9BF07BEF4609411437AE203E45AEB8D5BC4B4CE2D9779085056A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852266, "uuid": "804fbe1a-07f5-48a4-93c4-361b4d21fb23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852266, "uuid": "7ebeb1c4-c661-40a8-8190-ed835ead69e3", "value": "12288:bdDVLIOCo02b2UVFdPBGjGO8o+RaF/UOQhvpQkNDLM5jghkVi7nAjkOd+j:3XGjGO8TaF/ghakm0a4nqkOkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658852266, "uuid": "7b689d25-4d7a-46ce-b42b-1c36dc336853", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658852266, "uuid": "da9349bb-ddd1-4fe7-969e-375f67360d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852266, "uuid": "cd99fb78-00b0-493b-92d8-077bf82f0460", "value": "Required Order and Shipping Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29444ad5-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849120, "uuid": "5ef7e0fd-ef8a-4751-8e1b-8f7ba79d72d4", "comment": "Malware payload", "value": "addc23598950707cd6a7560a4d4ab036", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849120, "uuid": "74b588ed-0a63-48f5-a333-510c4ef05b0c", "comment": "Malware payload", "value": "1203fb3b55310aa437ba3cc40e4c0a7bb4a04aa8cf940d52fcef1cd0841a88fe", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849120, "uuid": "efe4141b-af49-4d3c-a495-ce979c00d6c9", "comment": "Malware payload", "value": "e184570e6b27d8cfca86df27dedff65a673defff", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849120, "uuid": "9d7cb4ea-88a3-4fab-8716-8fb8e29a8be3", "comment": "Malware payload", "value": "c6821801680c1e99dce82c86b1d57657275a1d7744896a28b62733462007b73be6c6eaf1edfc34d1425bc135a2e22f75", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849120, "uuid": "f8183557-a3f4-4b5e-bb39-19597ae22781", "value": "T11833BEA79A244BC5CA6D15704989F76A1D233CB4DB535C052C69FBBE0CFAD809013D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849120, "uuid": "a9ee40e8-6a4a-42eb-a0a4-ce5fb6de6b73", "value": "1536:iQUNZ7RrVD399pygIkEyT+IhV7rz9+yqm:idnogIkE2+IvXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849120, "uuid": "1b038171-3fb3-4a26-8e75-401e85a28b30", "value": 50424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849120, "uuid": "0bcbb938-83b7-4e35-8086-839a4442d059", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849120, "uuid": "3195b561-29a5-4ea2-ad8c-cddc8db1f1ef", "value": "PI 120003638 - CFR R\u00c9VIS\u00c9.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6802a27-0cd5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658834835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834835, "uuid": "011f9081-4f00-4330-979f-925901173f24", "comment": "Malware payload (Smoke Loader)", "value": "da2b1e6dae0e807f0985c061b803ddac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834835, "uuid": "3c4eae2c-7865-4486-9bde-07d17994ab74", "comment": "Malware payload (Smoke Loader)", "value": "1207558f08441171e6d93dca3e13d9c1bfd96bbb877c86b4e286307d0cddd054", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834835, "uuid": "ca43e1b5-9708-4f7b-8a12-b8f2dbb6eb25", "comment": "Malware payload (Smoke Loader)", "value": "ed01d5443b52028b11e82182696eab739f5bf539", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834835, "uuid": "57c31353-1a08-41d1-9d2b-66e751d281a3", "comment": "Malware payload (Smoke Loader)", "value": "5ecb01c31a1bc7e3e4de1a4d5e422900e83568b1e3d5c1b294714af405c5deb1d2aaaa83002bfa246e68e0def40da803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834835, "uuid": "46c681f3-b762-4bf6-b3f7-bbf79d786479", "value": "T131649E40BBA0C03DE0B751F47976C3ADA529BDA05B2441CB62D57BEE56386E4ECB8307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834835, "uuid": "b72d7458-2e76-4132-865f-976e2d8a1827", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834835, "uuid": "a234e967-4a09-4aaf-acf4-93bbadb9ec6e", "value": "6144:vzumxzNs8sTJ+gdquhRd+qKQ3vWTFmXwF54TKh:vHsLdquhi3Q3vW8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834835, "uuid": "0274e974-b21e-4a21-a84b-03a78cc81da5", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834835, "uuid": "908b7009-6ac8-4035-a27a-0d26585def57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834835, "uuid": "c49a0ccf-d99c-4d11-91be-da1da5bba3b7", "value": "da2b1e6dae0e807f0985c061b803ddac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16465a27-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658848659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848659, "uuid": "076028df-5545-4c66-9eb1-def113dcd1d1", "comment": "Malware payload (RedLineStealer)", "value": "8dfa26fc30a56406eef80f3b06da8246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848659, "uuid": "86d93309-883b-4697-8c26-e1d1f321695c", "comment": "Malware payload (RedLineStealer)", "value": "122b85288059eb5e20318712aa2569b8715dcf2d0edddb35afa0cf97944d5688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848659, "uuid": "a8d0e824-335d-45b5-898c-b11672b10fd9", "comment": "Malware payload (RedLineStealer)", "value": "62195d0e75754a357845bc39b839f6751d3d59c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848659, "uuid": "c9cf9dc1-5bd1-4f74-bd19-3a24e4abac95", "comment": "Malware payload (RedLineStealer)", "value": "665d4ff4e9396caf10e1b15f2baed0139cda9ad3322353697d3ff4f83f462181968a52779b08db2dcb77cd9a904ed02f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848659, "uuid": "ca6135a8-5127-4842-a389-066e4a0ef2ab", "value": "T1D0855C7DFB4751F4EA2392B1814FEB7B8B2479158421EEBBFF4ADA04F4335122819252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848659, "uuid": "5892d274-5f3e-41d4-ad02-5937f8672023", "value": "c642c0b422c0291be517cbe7f80512c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848659, "uuid": "9209748e-9046-4f08-ab59-3a3e83d18542", "value": "49152:mhza83AhwmExbo9Y3u5xfAEsFbXLOyXQCN:mhzaumExO0DaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848659, "uuid": "b6b1a13e-82a4-4218-9639-46446968ee50", "value": 1848832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848659, "uuid": "b0e868ce-59c4-4248-ab7e-5e13619a74d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848659, "uuid": "05478892-b459-4841-97e0-6bbcf26e75be", "value": "8dfa26fc30a56406eef80f3b06da8246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfbb577-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658851222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851222, "uuid": "5f1cfd73-46f3-4f9a-baf1-d8303e4c4e75", "comment": "Malware payload (AveMariaRAT)", "value": "4aea46d0c28c9ccb301268917d57e2bd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851222, "uuid": "1a70388b-2197-46cb-8a07-32aee4d0b911", "comment": "Malware payload (AveMariaRAT)", "value": "122fa34b3d7056f75429836ac9d6c2fdba192673979086be95a4037c2fa5d3ad", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851222, "uuid": "fa9cd150-07b4-4f27-bad8-06f9ae15ae62", "comment": "Malware payload (AveMariaRAT)", "value": "76431c0e588ee6cd38f380ef85af3c418ae0acba", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851222, "uuid": "89511c1f-487e-4310-aba7-4323c456d6fc", "comment": "Malware payload (AveMariaRAT)", "value": "18f1e929c01b52d5ec3cb8613d51dfa8849fee43a61bd31823f7ac8741f4b757cce07b317594e016398f215f57d4e4ad", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851222, "uuid": "bf10efbd-1de1-49f8-a947-61a5d3299670", "value": "T143D38D13BBE64436E6F202B02DB97E7597BCF9341A25C68BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851222, "uuid": "cceed8fb-13b3-41d5-817b-a8194f70bc6b", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851222, "uuid": "483e75c1-b142-434f-b18b-fbc2bac8bf58", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851222, "uuid": "4384b56f-7827-4770-a02a-7f8d922293cb", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851222, "uuid": "aaebd19c-8b1a-431d-a2cb-b5f6dfa3a91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851222, "uuid": "fd2e4a43-b030-478c-aa49-67fcc77f5ea0", "value": "4aea46d0c28c9ccb301268917d57e2bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7d4054-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658828723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828723, "uuid": "2e73bc50-c1c6-48ff-aab5-60c248d09d2d", "comment": "Malware payload (AgentTesla)", "value": "7ae0141820c7d4a04de5d0883480fe65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828723, "uuid": "bc4369ac-0ac0-41d2-ad94-1e269583e492", "comment": "Malware payload (AgentTesla)", "value": "1263f5df44545e62685fa6457ae24792e6e03e55c3d71d6f62c7eb16db23a7b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828723, "uuid": "79f2c007-fea9-40a5-a1c9-abc11381cdc1", "comment": "Malware payload (AgentTesla)", "value": "14d600294c9358fcb40cf010c8428aaeee7e3388", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828723, "uuid": "b7fdb9ca-0f01-4805-bf13-91df249d365d", "comment": "Malware payload (AgentTesla)", "value": "db81ea847355f18e7aeae6845469e97bc7bdb8e7e723c1d740e0b3fb34c87c92214eefa556e8d6d7cbe4e2c79e3e3c3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828723, "uuid": "9d4089a6-6123-4e37-ba1d-5032c52a34ef", "value": "T17635ADAC352075DFC86BC6BAC9A86C64EA2034B7430FD643901355E9AE1DBA3DF054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828723, "uuid": "2f4e085c-210e-44f9-88f4-156bf5066e1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828723, "uuid": "67f551d1-e463-4a64-bec3-5c09f62c0efd", "value": "24576:YPw4UZvybcv8vZ3eVzWJ5ZpWWac7L7OPNgx3DSJHM:U6d8BOVzWJrhL7WrJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828723, "uuid": "b02b2912-690a-4c41-85b1-b3bfcdde5aef", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828723, "uuid": "0e7418e3-d7ce-4080-bcb6-561262866513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828723, "uuid": "ee73eb02-52db-4be2-8e20-87301b84905d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.8966.23931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a360c20a-0cda-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658836870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836870, "uuid": "e43e7cae-ec86-4713-9ac3-ea8ed17da162", "comment": "Malware payload (Formbook)", "value": "6f23c7215e8f3fbaed216837e7543f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836870, "uuid": "a504f865-a589-49fc-9943-0240198b02b6", "comment": "Malware payload (Formbook)", "value": "1280d73374fc50ac13ba357fe84a9dac9dfd9b868d3492ac33d012eadf86606c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836870, "uuid": "0a267ca3-bee0-4712-aa07-d84a7c2cb92e", "comment": "Malware payload (Formbook)", "value": "9f6e35ee80d9447a1dbdb690ec144e10d285bdbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836870, "uuid": "37393977-0809-42a7-a00e-55feef7b2569", "comment": "Malware payload (Formbook)", "value": "577ac26fc7674fb6d281f44d00579f060bc61e9c575465315f5427cd685d2fa8a14c9038d683fbad3f06e818129ad066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836870, "uuid": "d055ecd3-7138-49ab-8ae1-c4d0d24caed5", "value": "T15A44E19D7750B8CFCC5BCD71A9A44C24AB20B4A2671BC243B45355ACAE8CB8BCF551F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836870, "uuid": "0aa5b77b-2542-4592-927c-77ed77ae0cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836870, "uuid": "ee7210f2-963f-4563-9d37-3191fb2ab977", "value": "6144:vSpyMaCXmgMKh8C4oWt54BbHtmYiUkvPNLxYyXnYmoy5IQTaL:vZzEVt+em52L2NLxYoYzTQTaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836870, "uuid": "a3061f64-4bbc-4d9e-bde1-01a82a8bbdfc", "value": 268832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836870, "uuid": "42862a03-afe8-4cd7-9151-2fd288776ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836870, "uuid": "92529b3b-9189-466d-ad68-347559867d36", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.29652.20984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b7f06b-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877976, "uuid": "a8bc54d6-9319-4eaf-829c-0ca67169a257", "comment": "Malware payload (Mirai)", "value": "50b5ef450242660c4f9e2ecdc26f28a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877976, "uuid": "a886ced7-8704-4da8-93af-65d2963ea98a", "comment": "Malware payload (Mirai)", "value": "1317a670760d4429d5085da2c74174d6288e9cecb8282ae56439e5ea3d5a52f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877976, "uuid": "00e37fa4-d880-491f-ae4f-f08f8bc1a14c", "comment": "Malware payload (Mirai)", "value": "316b7fa99c2b0469919960b4f1251a41350eeaaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877976, "uuid": "d9f8b477-713e-462b-b217-e47fa7be4dfa", "comment": "Malware payload (Mirai)", "value": "b7501010315567b098ca07ad592cd304e96d1627672f3320c31d2997ecfa46014e9406920a20f710622d9c9119eb06e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877976, "uuid": "f703f522-4c1d-44b9-8124-d5c4be0ea60b", "value": "T159632B95B8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877976, "uuid": "7c7537db-c3a9-46b0-baec-534c717da70a", "value": "1536:xgnAkIP7B9stYVenVQmHctQNqOSQ3MliOu2aaTLLJa10yt:JP19st6en6mHcNtu2aaTLL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877976, "uuid": "c781d4c0-a322-4469-a9f7-f4e04f0ebd6c", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877976, "uuid": "e94b9a28-9611-41ae-a142-3269f406ea77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877976, "uuid": "ce6bb647-0612-4214-994f-cb3f0573144b", "value": "50b5ef450242660c4f9e2ecdc26f28a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e559b996-0d06-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658855878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855878, "uuid": "8ef63195-8189-44f8-98f8-2ef8e01a5eaf", "comment": "Malware payload (Formbook)", "value": "25fe79e1e23673ead7e0bd10c15d4bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855878, "uuid": "456a5d63-506b-4598-a1d6-6812c85dac92", "comment": "Malware payload (Formbook)", "value": "14017a5f9a46c97ba874b288cb1f56a9ce838a0f91c12d8fbfa4265cef0d312d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855878, "uuid": "7c9c1043-c42f-4afc-bd9f-5d1c614bb1bd", "comment": "Malware payload (Formbook)", "value": "aa07042efac960b5ecb1f0800316eee54a6799e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855878, "uuid": "91bd54f1-0af8-4bd6-b03c-ebee12bbf5c5", "comment": "Malware payload (Formbook)", "value": "715ce6d4e56d3bbf69f4afaebbcb160d0f610dd72769b234c7de40eeda1d6c80a5deb934c1f9204579c6d4bfdc736dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855878, "uuid": "d654cfc0-4da9-489e-8a0c-80498487cbde", "value": "T18D05F1A053ACC249ECBF1EF9F425A41103BB9F1BD15DC64949D072DA29E33E1B42B993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855878, "uuid": "2c88404a-73f5-42bb-aeca-38caf791e68e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855878, "uuid": "157944e5-8732-4e87-b777-99ea5ecc0f8f", "value": "12288:n6eN58S702b2UVFdPBGjHgejO+Pfs4sOEIJ+aQa7tzzZRgkFer0osqhfkjd+LS:h8uGjAeRHsT8JhQ+3PrmKjke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658855878, "uuid": "1814d27c-f86f-420e-bf96-3abaeec8fcac", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658855878, "uuid": "df5248e6-6825-4c67-bcae-ef1ff4e204cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855878, "uuid": "fa8bca17-9830-4df2-b940-ddb8704bb54e", "value": "Purchase Order Frank Manufactures.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0b859f-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658851188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851188, "uuid": "22cd080d-bde4-478d-ad59-5ec219895457", "comment": "Malware payload (Formbook)", "value": "e2d591ea284e0444132c5118c16b1a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851188, "uuid": "3ae85ae1-bf5f-469e-a75e-0c058d02ce92", "comment": "Malware payload (Formbook)", "value": "14714f738eeb28f245c932592968c2c8a94d997e80dee5983e28e1f6c3280809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851188, "uuid": "c0d1e611-4d2f-4173-b7b4-a530aa264d0b", "comment": "Malware payload (Formbook)", "value": "13d3bc277422b717f1ffbb1a76a4296bd7ff0429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851188, "uuid": "993b1a65-ab68-422c-9d08-05700201e633", "comment": "Malware payload (Formbook)", "value": "84efc9033b3af92bb089416f7eaf840a90151eac5e6a94b72aa53f3c7216e65cd06444e54e599707d6cb1e0863153137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851188, "uuid": "6d0aa5a7-20df-49ba-8951-ec403575f2f3", "value": "T19C44C026B601C3F8E26101F5712C2B7B84FD1D3C225E60A6E3A219916EEC5E6F56C71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851188, "uuid": "6df86451-6e6f-4efb-9a2c-85ef309688d0", "value": "6144:Vhuav3+I9dtTyB/uLFYrmleA+l+WN7woIJ2fBV+UdvrEFp7hKJ4:OsZyB/QWq7JkBjvrEH7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851188, "uuid": "82c8b428-cf1a-4c26-90df-dfedb32f7985", "value": 259527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851188, "uuid": "8934fb4f-eb1a-4fbf-a7fd-d28c477ac50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851188, "uuid": "68273e98-133c-4deb-b734-4020cd4c977f", "value": "e2d591ea284e0444132c5118c16b1a14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12a579f-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801647, "uuid": "aa2dbf33-3e51-4d75-a86b-ad8dd336b66f", "comment": "Malware payload (Mirai)", "value": "941e76bb2b5789f32687f8a13d385d92", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801647, "uuid": "328e90c7-d74f-49b0-9095-715b2a0ff4da", "comment": "Malware payload (Mirai)", "value": "14b56644398982dc52eb768de1e038894a241d766d4d90f009dc9be05885921e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801647, "uuid": "86860cda-31a3-47f4-8d84-eae3ba66ac6e", "comment": "Malware payload (Mirai)", "value": "a24a6bf622f8a8cdc81294aaef6b084706a4e8dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801647, "uuid": "ac7aeb90-fae2-4b32-bd90-557708571f12", "comment": "Malware payload (Mirai)", "value": "ca6ecfc3f5bdd09da6cf63cb93dad486e0cd86e459c45821ab2e9b010cdb20f3a31a4bb484bfdd1a547bd1fdcd79ae30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801647, "uuid": "f6301a79-e812-4a0d-b391-4d417b70f60f", "value": "T1A0B2E11F988C150BC58EC934A3F5D8B4B578AA92879FC71703D8F24C432BCAB512A477", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801647, "uuid": "71c8b400-fade-4e4a-a1cb-a9f8c5971811", "value": "768:lmFIJ/P6tGzhp1k4t7nSq5bEgAWOSL+awM:lNJ/h1RnSaEg/Nt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801647, "uuid": "da8ad2f3-be69-455e-8ae5-2bd63eca3243", "value": 25644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801647, "uuid": "c387b7bf-e6c0-4991-9ef3-7dac481b4bed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801647, "uuid": "382ebae9-256e-44a5-97a9-0e085ab76eab", "value": "infect.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2424b19-0cc8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1658829137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829137, "uuid": "4ff4548c-275f-4f0b-ba9c-e813abf97a0e", "comment": "Malware payload (Gafgyt)", "value": "49655be47c766971f08cb5933c541d6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829137, "uuid": "eef7367c-bc36-4f69-a5eb-d88f061af35e", "comment": "Malware payload (Gafgyt)", "value": "14d2209984ec4a688c2ea085feaa817bde27d4604aeb4ee607bf0fe43fe7b04e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829137, "uuid": "c8af7c69-fd28-4816-a4a0-35d6b7cafb27", "comment": "Malware payload (Gafgyt)", "value": "2c7590ff467457b77802ff58da3cb94dfb0daf38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829137, "uuid": "ac50dadd-d303-4aaf-bd01-f417606afd7b", "comment": "Malware payload (Gafgyt)", "value": "dad7b0fdc38a1e133962c477154f35541a3a2a93d9779fbe1b50571b21986aa75474469c76e4ac561e935b6f7768c23a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829137, "uuid": "0db4b783-23b9-4ffc-ade5-1dfce2dc5946", "value": "T1ECA3D75E6E219F6CF7688A3047B34F25979C339537E0C581E25DEA012E6034E649FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829137, "uuid": "325d48ff-a3bf-412c-b302-0b6fe85a43fa", "value": "1536:YDXSLMBZWP3AsaOllwGdYGdqRGdjp9ivVMPcwibKbL41x81wCGsips:0iLMBZWP3AsaOlab0c1xw1G1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658829137, "uuid": "73517bd2-6e37-4688-99a8-8eaf3eb5fb5a", "value": 105952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658829137, "uuid": "2f223ced-2afb-4038-bb93-f52975c81f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829137, "uuid": "9a893091-eb86-4a93-8472-26f95b0b9c5b", "value": "49655be47c766971f08cb5933c541d6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d75a8f0-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (StormKitty)", "timestamp": 1658817962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817962, "uuid": "abfcb1c7-d2ff-40f8-aae6-18165df6acc9", "comment": "Malware payload (StormKitty)", "value": "24c5bd2c613102df0260befaa2b11a4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817962, "uuid": "226f7afe-5343-42db-82e7-b0501b600433", "comment": "Malware payload (StormKitty)", "value": "14d62b9dd87150bad3eafda51b5c2bd4639bd1e830fcde6254e4fe72a81b6a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817962, "uuid": "c14b3bfa-709d-4afd-bd88-47e393aabfa8", "comment": "Malware payload (StormKitty)", "value": "65b8e5dfb4c45615b9190c68a8e61a88890c44d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817962, "uuid": "9921c806-7592-4bc9-a244-58a7fe0d5c1b", "comment": "Malware payload (StormKitty)", "value": "031bb0f2dc355bffc36fe2ec7b0775dbbe8c30fe20e57d35fb0fbedcdc323c52af4c4dfa54be888845c6f4b5bb010e7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817962, "uuid": "ddcea72a-5135-4e50-8ce6-238fe3a5892d", "value": "T13042A56CDF4982E3C896C574A8B74A81B9FC6523B6724E1FA7C2730D6D035077063B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817962, "uuid": "a14f8320-29e8-49b3-a2f6-4d6b5ba509df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817962, "uuid": "2d2d9f53-07de-4b75-83dd-ff7e892202f6", "value": "192:ERqSEFlfAEEgj1QQJJ5fiiLX2HS9yxSyrsRt8G3mSF6zBzM:1zXfAaQIJJiiay9ycyrsR2vZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817962, "uuid": "c182c9c9-28e2-4c55-83b0-438ec67a326a", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817962, "uuid": "d3d49371-fb51-4887-bbc3-4933adcde6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817962, "uuid": "dec906d1-25bd-4a87-91e6-658848046acc", "value": "yHYWC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af01f73e-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827011, "uuid": "dc3b0398-1c64-41ba-b5a2-895e04ab0408", "comment": "Malware payload (Mirai)", "value": "edb6fc79606cc9a40bd63cc831f77068", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827011, "uuid": "f8a7dd12-1f94-4a74-9e33-c1be0ece6fa7", "comment": "Malware payload (Mirai)", "value": "1654207ee2c7029ef98219f2dc718cfe0781095e8446c3dd13a02e23310ea6be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827011, "uuid": "1dba7f79-e0c2-4dbc-854f-9c920a1b1d7c", "comment": "Malware payload (Mirai)", "value": "471315a8ea760d0b021037e37b8d9c4e15fe4bbb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827011, "uuid": "f8fb91d8-7fed-4f3c-8a64-b659ca40ed14", "comment": "Malware payload (Mirai)", "value": "0111dc504a76049860cd76c828a78673c81b531f966fc1b27b445067d3625417dd2ce880ca2b7de2b4fc83ea79514372", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827011, "uuid": "a0af61d3-37c2-4a48-b37c-72c91741a422", "value": "T145F2E1BDD340345AC9BEDC3E55FF5AF09E08A5C2310C8F092282689E54E9B1F75A507E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827011, "uuid": "e7bd310d-a371-4300-b9c6-25a67f6a5271", "value": "768:bo0pAlKelhAI2e2fOgjvR4K4Iy3UeFhRVzLXWA:hpGKNIybl4Iy3ThHzLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827011, "uuid": "d9e0a670-5dd2-413c-a09e-dbb93dd2cd5b", "value": 35720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827011, "uuid": "f6e83721-3012-4e55-97fe-6ec105bffe58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827011, "uuid": "9742b6b2-260d-4122-84b3-8ad64f75632f", "value": "home.mpsl-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6966f68-0ccc-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658830996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830996, "uuid": "7e2f3843-251a-4ba2-b1e7-14d0f89c1068", "comment": "Malware payload (GuLoader)", "value": "2b5646556eac75525e56a43a13faeac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830996, "uuid": "48d543aa-80a9-47a9-aa45-efabeaacf0f5", "comment": "Malware payload (GuLoader)", "value": "17591a1818c3e80dbddd26fa86566152ca06d64e7d0ada9a709e68bb59bf5bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830996, "uuid": "51a72f2b-3f20-41e5-97e8-2c2c32a2f09d", "comment": "Malware payload (GuLoader)", "value": "709b337ac9eda16c0f5ad3f81530373b48262b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830996, "uuid": "a5117ef5-976c-4b86-b623-b3d9404fee03", "comment": "Malware payload (GuLoader)", "value": "b6b1ba46f69fb8d7eb5e04b364771c24eb9b297679c4039b5d08a957a9db51696def33e034a7178a7abea331f4448c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830996, "uuid": "220ced66-d240-46c7-be35-8497db458375", "value": "T1FED402996BC187F3D41F077CA0E586453E37AC1BAB93281F6208FF851635B61131B9BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830996, "uuid": "bb1abc94-b1ec-4a96-9f26-8c14579d97a2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830996, "uuid": "234fcee2-0afb-436a-af0d-84c4c1ebaac1", "value": "12288:wNfv98L/yMxwt92EPBMH6W1bi6f+KCCQgI0tOP7HNC4T6ouo8yx:wNf1mJxQUEPWT1GC+KRQgInTM4uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658830996, "uuid": "b3b0c6c0-62cb-49e8-9e92-7815627b5c9d", "value": 650800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658830996, "uuid": "6d655dc2-246d-466d-89fb-83097b159600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830996, "uuid": "d936af48-590b-4fd8-b508-9cbe15419637", "value": "Nonfeelingly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e92eede-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658849210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849210, "uuid": "75cb6fc0-ac41-4b4a-8711-98a27c64a465", "comment": "Malware payload (SnakeKeylogger)", "value": "66da7fc14ea6ac9efb88f6db0050b883", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849210, "uuid": "a4a7562e-8785-4d02-a133-91379a37745c", "comment": "Malware payload (SnakeKeylogger)", "value": "17a2347f507a53c19eabfce3004889905a3eee858c10180424333997cd400c18", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849210, "uuid": "072d285c-a4a0-4dcc-b186-1d9cff90cadb", "comment": "Malware payload (SnakeKeylogger)", "value": "3e767f1f28a39cdcbb241011a9ce1101782db3d7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849210, "uuid": "f29f7bec-a591-4d4b-8e7b-5b3bdf01664c", "comment": "Malware payload (SnakeKeylogger)", "value": "935e67a31c3e0b4ffc9aa51def88751b3abd7463edecfbbac3bbce87491e37c0b424054b55f03078758bb986956bde14", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849210, "uuid": "1bc5e056-11b5-4ab9-bec2-218ab4ecd03c", "value": "T16DB3F174A6F9D56CF3B43D39FDBAA8108AFD9D31C520E2CB31023A4975F22ED0469291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849210, "uuid": "b7b43a68-aa17-4cb1-929e-718c4f34cb9d", "value": "3072:CGo5bD6S/lLXdnJbcaNRVKIeLIsak829E9pJL0vPV9050:foFD64RTaE/ktycIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849210, "uuid": "196bf7f1-cffe-4f94-a493-4d9e70b5c044", "value": 112984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849210, "uuid": "8e750383-3a05-4c9f-ad00-47d3fcf98b17", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849210, "uuid": "e465a533-19b4-4133-ae5a-be570ecb1c06", "value": "BL DRAFT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e21f8e-0d1c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658865088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865088, "uuid": "7b28b3ae-3f8e-4ad0-8b2c-013c999e2d9e", "comment": "Malware payload", "value": "aa946eb5ac53c98c16a467d5ea382f15", "object_relation": "md5", "Tag": [ { "name": "BRC4", "colour": "#1B7FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865088, "uuid": "e61e540a-54cc-414f-a506-c0be3b5a30c0", "comment": "Malware payload", "value": "181702a1231ee2a7e9fc2a06e7830d21c95593b79451870a594c492258cc2eb7", "object_relation": "sha256", "Tag": [ { "name": "BRC4", "colour": "#1B7FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865088, "uuid": "61ce2189-89f5-42cb-8c98-ca14f43d6353", "comment": "Malware payload", "value": "52ee5bb4a8a84769cfe4bad2c08d500006dc75ff", "object_relation": "sha1", "Tag": [ { "name": "BRC4", "colour": "#1B7FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865088, "uuid": "ed750aa9-927a-4692-a61c-8aaa350cbeda", "comment": "Malware payload", "value": "3ac45e021fd5dceef8478bd0c080d9adbb6f47aa8f08b066bc0fb9ee3e10b093be5dd77306e4153b76c4739801a4c195", "object_relation": "sha3-384", "Tag": [ { "name": "BRC4", "colour": "#1B7FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865088, "uuid": "8d0a8b84-8e6f-4f50-9fee-de73be774f05", "value": "T1DA649437D69354ABC256E437D9EEC132B5B37228D3F08589AA41933538EED93E54CE08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865088, "uuid": "2ba9c9e2-2ac2-4506-b3fb-740aaa70804d", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865088, "uuid": "955523b4-6955-4443-bbf0-85950d8002b4", "value": "6144:Y2v/VfyLez5cjWNYXBtIhMDXdiq+o5IDvCzw:Nv/VfyLU5cjC0QUXddgvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658865088, "uuid": "8c69d584-ffba-4a0f-810b-d596f7672389", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658865088, "uuid": "9648d113-9dc6-4407-ab72-094c52032ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865088, "uuid": "b3f1fb3e-988e-4924-857f-e1ec47650a01", "value": "Lol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67b23de-0cc0-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1658825762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825762, "uuid": "277ab9aa-f773-41f4-8b26-c887c1d3314a", "comment": "Malware payload (NetWire)", "value": "b2699ff02475e362a07a2cbc95b2bbf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825762, "uuid": "a9495c70-4366-434c-81ae-d66a140385a6", "comment": "Malware payload (NetWire)", "value": "188f5ac1494d6a38e1d18d1ae2ade944461ce8d1988d66bd6868b593ec730c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825762, "uuid": "0daf3e23-459c-4473-af33-2bb822eaf5ce", "comment": "Malware payload (NetWire)", "value": "b8bccffc99a775d6f26be87fcf4a228c74045f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825762, "uuid": "fbcc3eac-cf77-4da0-a2d0-a6a03ee118ca", "comment": "Malware payload (NetWire)", "value": "91a8264926dc1da6e3586d919833d1d75d2539488c1eb1a4c00079aebd9d567da22439f84753c07b0916354dcd4938b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825762, "uuid": "7028a376-f100-43ba-9e65-eebcfbc0c037", "value": "T19F35ADAC352075DFC86BC6B9CAA82C64EB20347A430BD653901711E9AE5DBE3DF054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825762, "uuid": "8a0bd667-e770-4f42-84eb-bc64dca08ec1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825762, "uuid": "b2be2474-79c6-4c3d-8726-365a7d4065f8", "value": "24576:Zw4UZvybcv8vmVmNHgogEspOZnhurGc99Y8fEEsrx8rH:Z6d8OVmiTUZhYG2CjEnrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658825762, "uuid": "4563b859-9009-4243-ab50-d15e7372f18c", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658825762, "uuid": "6e89d63f-c8ae-4df9-a319-11880fea5d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825762, "uuid": "55a40f15-6d39-4975-9e53-981af9c52fef", "value": "SV887INV0383288238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db15f7e6-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658855002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855002, "uuid": "83338c17-a52d-4f49-9c2f-1d3273c731bc", "comment": "Malware payload", "value": "e1d130551b06641c4cefdeb6aac2d7f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855002, "uuid": "8714d798-f004-4893-a1fe-9d25da4a3def", "comment": "Malware payload", "value": "1893fec0b3f86af897f1283f1cbfaa66e448909ecca6693ddad738a4093da71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855002, "uuid": "984e7ca1-b81c-40b0-94f3-d055063f21c0", "comment": "Malware payload", "value": "f0d9ad3456f48b987356245d0a6697a319f21b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855002, "uuid": "19a18627-e53c-47ca-b332-bc33ed33e035", "comment": "Malware payload", "value": "d885c3f617fc9ac732b0a3da7d224e8c3d9f45fe1a01622392701c0a4c4c883166c3e6ba48f43fdaa5898197f23a4f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855002, "uuid": "29c8bc1d-cf28-4f1b-8e05-dfb1dd22c8ce", "value": "T171046BBC18986D43EBBFDBFCC0827101D77431222A8BFA95925195E52F62BF1E4058DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855002, "uuid": "8ef4ab3d-3d4e-42e9-b302-27a102c4874b", "value": "3072:B3r8zojcmjSEuvB6TvVbvRyoitX+xUTcbUvcnDm9Y2:B3ep6DVKtX4UZvcDm9Y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658855002, "uuid": "b5a1e83c-dee4-4a90-8385-da3f99fc86a4", "value": 185070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658855002, "uuid": "b6aeafb2-e055-4f5b-a647-ee5dbe3890a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855002, "uuid": "7283292e-347a-400d-8229-772e4b646e37", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7210.13803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea9b890-0d1c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658865047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865047, "uuid": "d06d7df3-6f3c-49cb-871f-deb1543a8576", "comment": "Malware payload", "value": "9cef8265c679bafb06f885678ceab7bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865047, "uuid": "b4727a78-bb1d-421a-a462-32e14a22aca1", "comment": "Malware payload", "value": "18f7c9fcf55206644996038b2908aa3871e3ea9affa4c6d62a7460f5b95cca90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865047, "uuid": "10b238b3-3450-41db-bcdf-b479c2a111c4", "comment": "Malware payload", "value": "ac7faaa7e8439951eaafd8e02007f33a555cd01b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865047, "uuid": "326d4858-f79e-42d9-a797-4b60c8e21847", "comment": "Malware payload", "value": "4f260046cab9092d805a676904fb7aa598a3d5a646f3865b81ecb9a5e49038bbb22892e96710512f2f981d25606e84a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865047, "uuid": "6bce813b-3b9f-4ebe-a2db-14be1bd573d8", "value": "T1A4D4BE0367988B94C9A4B7BF22D1AB0013F9F0C76B02DB0B6F4B45E565A72C17E1DB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865047, "uuid": "75ad9e71-ce0e-4851-99bf-2f8d8c946313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865047, "uuid": "35db18d6-0192-4f9e-b304-f80ea3523c75", "value": "12288:7yJTxDWRQLg9r91BXxQ/q22ZzGSf1q6B0sQuc9G:7ynWRQerDxxs32NG61q6PQuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658865047, "uuid": "70bbfb75-b2de-45f7-93a0-51e50cbbd849", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658865047, "uuid": "e30d7d1a-8150-4847-bd4e-f17255a32f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865047, "uuid": "1874341f-702c-413b-8104-10cbab64a3d1", "value": "D6GEVBNNH11111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f62600-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877936, "uuid": "acb2dbe0-916d-41e6-8d6f-d513eec896cc", "comment": "Malware payload (Mirai)", "value": "8b1bcf14129652a6e78d2d58d961bb45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877936, "uuid": "aae371ca-f15a-4706-9441-8ec0aea54263", "comment": "Malware payload (Mirai)", "value": "1904ffe1f3c2112e68b1b986ee9714bba7e2ef7105a4b7f11dccb1eec677b5d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877936, "uuid": "375eefdb-a153-4d5e-be80-a820c6a3a83d", "comment": "Malware payload (Mirai)", "value": "f86db680a9c1312141c20eda09903f607d86763f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877936, "uuid": "4a836590-18f4-4fa2-9d50-fa9fb9a73f7f", "comment": "Malware payload (Mirai)", "value": "cf97258e601fa39b8a8ed7be9c3a56750bf03b476ab4712fbac3ceb0e31eb4f3132bae1f719de20329c56f297bc80e49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877936, "uuid": "57d31b91-8dae-4f8c-b4cd-80e796936492", "value": "T177435B52721C0E17C4A31A70263F5BE08BBFEAE022E4B685695F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877936, "uuid": "67719048-8292-4536-a2ed-ccc970c3f992", "value": "1536:+F6QcATQdskHosl9k1dP95py0bIy66hJa10j:NqgtJHk1dPLNbIyx4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877936, "uuid": "ea80b8bc-3f7f-4e75-9013-54fab148bd24", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877936, "uuid": "06a26e0b-f150-4826-83f7-1d3c7832a032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877936, "uuid": "17637f65-7d67-4bed-9dea-aba18ba6bb31", "value": "8b1bcf14129652a6e78d2d58d961bb45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d1ab36-0cc4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658827366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827366, "uuid": "3408b312-c0f6-4465-9cc7-20ebf6357fc3", "comment": "Malware payload (AveMariaRAT)", "value": "16535dd59deabd7da915f82633b24a01", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827366, "uuid": "7b4ec824-85b9-4791-b3b2-5cc4bc4e16fd", "comment": "Malware payload (AveMariaRAT)", "value": "1a432e578e6b754a70a3ab8738bb75ca3c95d61871fdc3c2ee1ba9033a6be463", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827366, "uuid": "03e0c59c-7c48-42f0-84fe-e7e905f9a9fa", "comment": "Malware payload (AveMariaRAT)", "value": "caffaa9f00e45d53f1c17ebbbe2bc84640b65402", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827366, "uuid": "abdeb6de-a587-47d1-bf9b-faa51060672b", "comment": "Malware payload (AveMariaRAT)", "value": "0f35b20ead419a5f86c011bdc9eadf6a683c1bfa5d8d67fdcd8bff0e3b4bcce629ec7546471fb58bbb18838319c39888", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827366, "uuid": "1fec4729-32ef-45d1-ad25-0c2713b6c4d3", "value": "T129259CAC356075DFC86BC6BACAA82C64EB203476530BD603901345EDAE4DBA7DF054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827366, "uuid": "d275474f-2807-4593-a799-807328a3d4ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827366, "uuid": "23400864-002d-4cb2-9d90-e9e179c7ec75", "value": "24576:zw4UZvybcv8vTA4OFYquV8B2yVxxTcH7P:z6d8LOFYXmB2ytcH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827366, "uuid": "f434e1bf-7b40-4ba8-9a79-87f1d6ddc89f", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827366, "uuid": "447482bb-3a14-4bc2-b53a-6dc9585551ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827366, "uuid": "1093e0cf-df42-4bf6-aed6-7e4f0204fca5", "value": "New Order ....PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5d4986-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload (zgRAT)", "timestamp": 1658846867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846867, "uuid": "e8dfef5b-6c88-4acf-999a-d7b1fdc55249", "comment": "Malware payload (zgRAT)", "value": "da790960872034d42b246345b04cea8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846867, "uuid": "0f3f41e7-bf4b-449d-85f1-b50e0dd59d5d", "comment": "Malware payload (zgRAT)", "value": "1a9aa28f397e9bd3b530f0426c2ca23ea456eafa889d022bac97c01cfe51ce2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846867, "uuid": "e85baa3f-7d2e-43a3-bea3-589e0103a882", "comment": "Malware payload (zgRAT)", "value": "37d211eb8c6a1c65c1e51489acda8496d7836c6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846867, "uuid": "bf98fce2-02b3-49e6-9c13-136a6437896a", "comment": "Malware payload (zgRAT)", "value": "9dd6d33943134459613aadb2bbb1f42544d748f3b7762dd83a8eb837e3fb245d9c1a07adcf207e4ca8eaa43ecb1f8ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846867, "uuid": "eff72fde-ff76-4612-ba6d-ad05bd996cac", "value": "T112D3E77976974712C65B4D34D0EE721C13A1AF026233E785FA4C33B80EF379A9D85A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846867, "uuid": "618b4e61-d580-4030-a848-a1c3ce320780", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846867, "uuid": "82ded23a-67ab-46b6-bb0d-7a614d7008e0", "value": "1536:EXpdK7VyEw/BVeLPj2lwXabG+lfAb+NuuVWLNya:EXp6l/LylQaamfAbcuuVWLEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846867, "uuid": "c48becab-80e6-4f62-9325-9b5804e88982", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846867, "uuid": "a40af7d7-41b6-429a-b793-3857b0ac9080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846867, "uuid": "f5187d20-59cc-4e08-af70-f93c5c0b5da6", "value": "SecuriteInfo.com.W32.AIDetectNet.01.23463.24872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccb0799-0d00-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658853072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853072, "uuid": "12b0ae12-fe71-4499-8755-dcb52da71028", "comment": "Malware payload", "value": "1d5bc6d3439e649c3f08d54f258a9d64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853072, "uuid": "b42ef0a0-3ebe-4fb1-b1c7-9fc5b56bae8e", "comment": "Malware payload", "value": "1ab91f91c7fc216ca3e2a34b222dcc0225e7b96255c57106c36bd72303efc290", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853072, "uuid": "dec0c5aa-65c1-411e-91c1-790825f2378b", "comment": "Malware payload", "value": "2822035cd7fa32c407b164d499f270e099b0d06f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853072, "uuid": "3f4cd491-8a2a-4f21-a281-784908c6818a", "comment": "Malware payload", "value": "aacab3538703f6dac5b5d88f0c6a774beac7db9266c4369edf626b352c27959bb77c36d39bd77d57b4afef8ecd4721b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853072, "uuid": "a0bdb556-0115-4def-8b8a-4c641f4fe066", "value": "T1FA63F170D3E94736C42D4F339977389240B7E6DA2C5F5F5AB04285688C4B6568F0BBB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853072, "uuid": "69532ac4-d424-4ac9-b588-0965eaea0d14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853072, "uuid": "a0c00be0-3e41-4a5a-ac17-850e7ed63715", "value": "1536:6DD6X8EXNNqnemD3q9E//4ClVfjM+HIe0udZ5IuYViE:6DDc8gUnfD///4cH30MIu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853072, "uuid": "a5b28a42-46e7-4b05-b00d-63e6375f7f38", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853072, "uuid": "3360cf16-48a2-4fa5-ae20-8a40d0cc69f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853072, "uuid": "2340e8d7-00ad-472f-9bad-3e7f1e63a4fd", "value": "1d5bc6d3439e649c3f08d54f258a9d64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112385ce-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849080, "uuid": "3eeffa7b-d57b-42cb-876d-ad9ef8ee853d", "comment": "Malware payload", "value": "ca12c8c884a36f55a502999ee3e7d296", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849080, "uuid": "102c67a4-ff62-4670-ab78-4c8c17b2b69b", "comment": "Malware payload", "value": "1c1f8d5a2567fc58a416f22945b6e7efb9312473f8c716315b448d9d5ea05d6a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849080, "uuid": "aebb54e9-be4b-452f-a612-8dec88d5de1b", "comment": "Malware payload", "value": "6dec9c36ba70ae4483e969a603cf229ab82a5ea4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849080, "uuid": "1078d436-1ab1-4d72-a711-3d2387a1b175", "comment": "Malware payload", "value": "c97c794396a5b18779d363c6c40cf33fc965c9d799905d3a7ecea4b5242a4df39da8b8e33f2bc9b4199f55d46336f79e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849080, "uuid": "84a4f7ac-9e92-4c12-ae01-2b61e49d26f5", "value": "T1D343BEB07BF93277D1B2EEB76295DBA9B8346E65DB54C48032F9B29B00349400C1B637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849080, "uuid": "f7d0c10c-0548-44e3-bffc-e746e2c074d5", "value": "768:sYS/XqMme8xrL0fnP6CVID1myzurRxDactbg6GK6TZeYTwsG6Gxz1euF4AoSsUmI:sYSfd8xrLCCCGcFceCaMuF4k231zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849080, "uuid": "9c9250ce-6cc1-4f02-ab4f-73e7585f5d72", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849080, "uuid": "a27187ac-9d92-4679-8d24-ff8929faf889", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849080, "uuid": "6777c266-4ae5-4fe7-9e72-6d2d80e5c384", "value": "URGENTE- Orden July_PO EM212843.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7a3c02-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1658824723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824723, "uuid": "09905c47-0ca0-4119-b63a-94b1c685d55d", "comment": "Malware payload (ModiLoader)", "value": "54f88e8269b980b2daf9026a8b4567cf", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824723, "uuid": "d995e079-1ea2-4eb5-9431-01543490005f", "comment": "Malware payload (ModiLoader)", "value": "1c353870ff190fe795e3804fc641d777b80df3f1b90784aa3e1b97e1d61f901f", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824723, "uuid": "aa8297e9-6843-4418-816e-5abf4d06a561", "comment": "Malware payload (ModiLoader)", "value": "c0d0f737a7e695c6a653d460ad16ddb7d0a606d4", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824723, "uuid": "34b82b53-bd37-4b95-85b4-660348119eb0", "comment": "Malware payload (ModiLoader)", "value": "5c6004f0fe6ec3233efe165bfa8ddd2ef4987842de1a0376a07a6ca148adb4425d83acbd0643f7c5e8d6f4ec436ba983", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824723, "uuid": "48bb438b-16dc-4184-81c0-01b22594115b", "value": "T17594235D9DCD6C7610279C810BB318BC4F93C19D2E67A61DAB1022166323E5FE37D2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824723, "uuid": "cd3b90e9-9259-42e3-948d-1ac36e5a69b4", "value": "12288:UBDwxexFkDnx7MBHvXwb9BDC4GSvTnsGhcu2bVYZc7m+sO1IT:w/FnBHvAbLxvTnsGhF+71IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824723, "uuid": "e7281727-c220-484f-b2b9-cf7ed445bc74", "value": 431941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824723, "uuid": "c4b7455a-f902-40fc-96ca-b69fe623b54a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824723, "uuid": "a957e783-6728-4b5f-95b3-e42e1ddfda0e", "value": "IMG_Purchase-Order-Specifications_QuoteAmendments.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1703c5c4-0cfd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658851667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851667, "uuid": "cd718ed1-5667-4359-bbf9-893b9b1d4b3e", "comment": "Malware payload (Loki)", "value": "111a90a2e621eca70ea6eaf203a442ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851667, "uuid": "13710295-883a-4b8a-b40a-ad7cc173c136", "comment": "Malware payload (Loki)", "value": "1cad6ac7f1a52dabece616a63040cc6e1b191461ce96caaef87a846de6c8ead4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851667, "uuid": "ee8772c9-5964-4ef7-b3fd-e764ef9d5887", "comment": "Malware payload (Loki)", "value": "f8536dbadc530e4f448f4ae7422fd2ac14797142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851667, "uuid": "8a83aece-1ee9-48ee-94ad-645019ed3caa", "comment": "Malware payload (Loki)", "value": "760c3dc6f59d3331e7b56dd89e5f26f16309bbe6b1e964f0cde3f853897127c87745e7553c26e92119f6523086efea1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851667, "uuid": "e0a8026c-92f1-40eb-81e9-93b06f15fc15", "value": "T197359CAC3520359FD86BC6B9C9A42C74AB603C66530B964390D33DD8BA3DB92DE054F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851667, "uuid": "4bdcecd3-c333-4644-94b0-6943cf45a74f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851667, "uuid": "ac8d55d1-ff7c-46a6-9f4a-08f960abc633", "value": "12288:KQYOpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrSa0iudFFM5ZWOSeAKwid9SDhpQy1ZarD8:Vw4UZvybcv8vE0LrGq7mSnx1MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851667, "uuid": "8b8f2d56-6dbf-47a6-ba0f-7de592f9e822", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851667, "uuid": "073f70f5-2646-46e5-827c-d9eaa0cd35ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851667, "uuid": "47394300-c28f-4c5c-a791-4d138dd5174a", "value": "111a90a2e621eca70ea6eaf203a442ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5c5773-0cd1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658833049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833049, "uuid": "2d33c32c-a1bf-435c-bf40-bdcff6ba67d5", "comment": "Malware payload (Smoke Loader)", "value": "80b3eb2c938cc27117d35ed6d55e1c57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833049, "uuid": "37689c87-2352-4c74-8bc2-3dfac8198276", "comment": "Malware payload (Smoke Loader)", "value": "1e6eb4e0f613f84913ce338248e9ef109d31fb48c0c18be96ad3bd805d2151b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833049, "uuid": "e7a443b1-5e88-4091-a0b2-1eb841811dda", "comment": "Malware payload (Smoke Loader)", "value": "470cd35b8117a1dec31d30555b48d667c8e113ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833049, "uuid": "154122f1-5ca9-4985-ac75-dfe61fc190ce", "comment": "Malware payload (Smoke Loader)", "value": "71847b76037ad07b510f453a636efe3126414ebe4ada6599c9bc88e8b30fdd1d720f0f20d5e2a773253348f977314c4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833049, "uuid": "809b798e-c9e8-4121-92de-70e87ed221ab", "value": "T1B2649E40B7A0D03DE0B311F4797AC3ADA52E7DA09B2455CB22D57AEE56386E1ECB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833049, "uuid": "ddb41d93-0fdc-4f06-b14b-14254addd75f", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833049, "uuid": "45a162ac-4ace-455e-afd9-55c81b3d5f31", "value": "3072:87NSNWOMekWmxzBsCpOdNffWB7aoArUHxpFUGiYL/E7ASDnbcVJMLz2GWiOyXBRU:JkWmxzBsCoXffMErUHXFHJUDb2eeG79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658833049, "uuid": "c5e93e8b-14d6-4a07-b809-9942ef86892c", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658833049, "uuid": "0c433ebb-7a1a-4bf7-a156-b4d71583aed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833049, "uuid": "0f4584e9-b8c7-41f2-a710-8a19431a4a14", "value": "80b3eb2c938cc27117d35ed6d55e1c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7c4ee1-0c8f-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658804597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804597, "uuid": "c53deab5-6e2f-4c13-bb87-324be896bfad", "comment": "Malware payload (GuLoader)", "value": "aa4266b1d2804d95fa378490c1b7e18a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804597, "uuid": "108bb26d-016f-40e1-8193-29a4c03636d8", "comment": "Malware payload (GuLoader)", "value": "1e7519092c25c4ca7049766ca8e73dbea51a7b6a057a5e086f59da7c86437071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804597, "uuid": "09554ca2-4b95-4c25-8a72-cda0dce5968d", "comment": "Malware payload (GuLoader)", "value": "8f8532162b8c1d49895e79b6d2988cf1b8aafeae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804597, "uuid": "d81fff3f-0ce9-482c-9d3a-df6d70a26b09", "comment": "Malware payload (GuLoader)", "value": "fee919bcc73a822c60a1605bdce1b4c8a867ca5b138fe024be6c8cf226f8da3c890aa0ff3a294e645324170819731a1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804597, "uuid": "6d31866a-1643-4b90-a7df-01ea6d757cf9", "value": "T177F4D082F610D6E2DC7C8672D86B89421B667C7EC7D05D5A71C8B32E14B3162821FB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804597, "uuid": "5c20e0fe-b52b-4836-8f1c-cc00dd825c8e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804597, "uuid": "29143cac-254a-4eed-a225-1edeb2a3e8e7", "value": "12288:I3YWl5i80E2SGZX+5LotbEM9aQsYFpD4JX3xNZtXaHrRWbUkixJJVe:I3W803SoO509Z7pUJHmtWb90c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658804597, "uuid": "b95c49ce-d0fa-439f-8392-59d66ed52a70", "value": 776208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658804597, "uuid": "182e1737-45cb-4184-9d37-86aa4691ae71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804597, "uuid": "9817e385-9dda-487a-9c2e-be941addccda", "value": "25-7-2022-25-7-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc1dd62-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801642, "uuid": "0498d1c4-10c5-481b-baa6-78ccf933ca60", "comment": "Malware payload (Mirai)", "value": "fabcd24d8fa6f2f0d1e1e596fad48062", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801642, "uuid": "b6f812db-ae1d-49b0-ab5d-10e24763376a", "comment": "Malware payload (Mirai)", "value": "1f17247ad37ac35d54345b18ceb8e383116b605d23c8cb028bcdd2340f26822c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801642, "uuid": "eb76aa2f-b810-4563-8fec-ddff9204142f", "comment": "Malware payload (Mirai)", "value": "b457adf16307e7b5cf9551ac4fabff4c94b4c208", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801642, "uuid": "da6e10c0-5ee1-4ee4-af7e-9497e394e003", "comment": "Malware payload (Mirai)", "value": "8097e00c69d88b86885e4a85ded12861f10c597337d6fa199cc3e6f6396ab14e46fb6fca08bff3723a4ce02c92299fdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801642, "uuid": "6e52a9b4-bf6a-411e-a24f-e0eaab1112da", "value": "T1E6D2E112E28E9B21D7A1E03CCC564B827D335B78D0EA316B6A35192067C76076EBD85F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801642, "uuid": "931214b1-f84b-488e-868c-64c2b88dba08", "value": "768:j39coFuFWmYm8ty1LNztdKhOyn9q3UELnQ:L95mvdPdoN2LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801642, "uuid": "b0097961-e801-4ce7-9d87-7f13b9849923", "value": 30044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801642, "uuid": "485cfba8-7f34-4277-8e69-31e120893d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801642, "uuid": "b84e2643-fa2d-4b53-822d-89d480c3ebe0", "value": "infect.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79726b08-0cd7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658835511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658835511, "uuid": "305ef406-5350-4247-9648-4dc461765c12", "comment": "Malware payload", "value": "b634b55ca647b9001f2b1fdab0a4a794", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658835511, "uuid": "dcb85bff-5772-4535-b1eb-1d9795b816d1", "comment": "Malware payload", "value": "1fe926b0f462b5084913adf51373dbe8e4836cb237e849ff4550679173780881", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658835511, "uuid": "448f1823-fddb-40ab-99b0-49aae593edf7", "comment": "Malware payload", "value": "eac5f61b20e8cb4e282c1079a0127674a8c08368", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658835511, "uuid": "91057724-1350-46cb-ae02-8a414a35509e", "comment": "Malware payload", "value": "ac64b6eb78476bad7a110354c52efae473f9cdb5895ec556f376450461c117d29104f5107636ba95a3c3470fcbad5211", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658835511, "uuid": "fc2181ce-ca35-4315-a7b6-5840453dd39f", "value": "T17AC533CFA78EEAE6D13E08E5C440DDBB253CAC1C44350C8DA9E52D501F98B616A2D37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658835511, "uuid": "057bc590-4dab-4188-895e-68da5993c60c", "value": "49152:1g4vGDJb9pNjVnUsNICLvsn8AEacEDpVYNPfW2neEwrHJf8+:1g469pNjVSCLvZAEalDpVYlfWuevrHu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658835511, "uuid": "772d5c4b-4e9c-422b-b26c-ac625b5bfa72", "value": 2511310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658835511, "uuid": "6f4f91eb-3896-4591-ba38-bbe6a0d9caff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658835511, "uuid": "a509ab05-a194-46fe-91df-7b54fe2e58bc", "value": "Loader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29686171-0cf9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658849979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849979, "uuid": "152bae22-0913-4611-a26f-552822481156", "comment": "Malware payload (Mirai)", "value": "79b7530bc29d2046d8a6983d8facd096", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849979, "uuid": "377ed78b-66b7-4d59-8f98-29f33f0f93e5", "comment": "Malware payload (Mirai)", "value": "20cb3b881029790396bb48977187c7acb39d725ea885a6ac0408a0b471c3d5fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849979, "uuid": "c518043a-51b9-4f2b-a00a-c3dba87ad15c", "comment": "Malware payload (Mirai)", "value": "d483e6d13786af34554903dc5ed1c30605553fdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849979, "uuid": "5078766e-e7cc-4e6c-bebb-f849548ad582", "comment": "Malware payload (Mirai)", "value": "82a2a1e91108e11d8fbd46a38a71dbf332834f976a3520a6479d27c1f4e6a629acb51ec46f3bd9b072fe3959d35f3d36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849979, "uuid": "bcabdfed-8623-4bba-9804-afe9dbb7eff4", "value": "T130A2E115BF1C868BC8323A3555D9E6D21252FC62F29DCC492940C15FF5A33AA6834F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849979, "uuid": "03cdacd0-4ced-4d67-bed9-1707e78028e3", "value": "384:M06Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTV:G98o08kxofBE+ZkXaEbp2F2TWul0c5Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849979, "uuid": "ccc7ce2a-b1cd-43bd-8344-1cbbe856fe7d", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849979, "uuid": "0a3489d3-4b6e-4a04-82d5-9303b4356f87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849979, "uuid": "078323c2-555f-4c7e-8d8f-f82844493ec2", "value": "79b7530bc29d2046d8a6983d8facd096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5748070e-0cb6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658821280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821280, "uuid": "e3a4ed48-3169-40ad-9fc6-0d9e63d7bab9", "comment": "Malware payload (AveMariaRAT)", "value": "1bcd34738e63d6e4c67d56a5ab8d3cd0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821280, "uuid": "68042244-8511-48ed-a0b4-9423d460cd03", "comment": "Malware payload (AveMariaRAT)", "value": "20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821280, "uuid": "bfd31585-43e1-40d1-8f9f-0b2275ae6db1", "comment": "Malware payload (AveMariaRAT)", "value": "8c8ee03272b9ec906ec060b39dd1b2ac0e820323", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821280, "uuid": "e1d14a6f-6d91-472f-90a6-0c1f1403bf1f", "comment": "Malware payload (AveMariaRAT)", "value": "15454e5b92b1e02216cd0bda53307c4eb13fe5d8c3ee415cee3be18eff7abba6b56ab444540b00878c07498d7ba140ce", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821280, "uuid": "66f53367-db5c-41f8-84a6-95fbe591c70e", "value": "T1ED15122C2BA55F07DEBD47F58020011497B16A293552E36C5EC2F0DE3F62FA1694AE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821280, "uuid": "1d9aa08f-0386-4305-9319-8ce5364b82f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821280, "uuid": "79293963-6e9e-407e-be26-f54fe3280717", "value": "12288:ywVUNZTavByKcTpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrS5Y4WG8jO1uesDWcocDEIeE:35cFw4UZvybcv8vb2GbvsD+Tp4xh9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821280, "uuid": "a74ad63c-e34e-4e57-892a-c47424897d39", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821280, "uuid": "f070a9b5-94f7-4ca5-bc63-588becc236ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821280, "uuid": "55786fc6-92fe-45e1-8161-f27c71634591", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.7977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de7a8f7-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1658850980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850980, "uuid": "61a3565a-1978-48f3-b1cb-18385724c152", "comment": "Malware payload (DCRat)", "value": "6469b2046d39cbb049465d0603651645", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850980, "uuid": "2e9d90c3-abd1-457d-94ee-b1fc059b2349", "comment": "Malware payload (DCRat)", "value": "212eb072938575c6c669199d58e567df5f04498c7f51c2750936494bd9c1cf6a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850980, "uuid": "b98d3ac9-6134-44e3-b050-964c8ba28b1a", "comment": "Malware payload (DCRat)", "value": "a1310ad538ecda7f9951a7f983bf7e3b6f57c01d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850980, "uuid": "680f6e75-8d58-49b3-88f1-ee4daf063077", "comment": "Malware payload (DCRat)", "value": "b15fa4d4e28a72b0d5d747492542e5153fab74ad9969d96c1f63f0cd836c2b4d3703e067f1fadf5bc870207a9e95aafa", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850980, "uuid": "786f7861-37e8-4a20-b8a3-bb678a4fbdd5", "value": "T147235D4037E88136F6BD4BB4ACF3A1458675E2676903CA5D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850980, "uuid": "ca8b8e9c-d7df-4aac-b8ed-6f049d632f65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850980, "uuid": "a2ab283d-612e-4e2f-9d71-7c9af55fef07", "value": "768:dCT3ILNCKi+DiBtelDSN+iV08Ybyge6iTBu/9vEgK/J9lZVc6KN:dCYmBtKDs4zb1zsBk9nkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850980, "uuid": "3e7c6c51-703d-4ffb-a104-f706ac05f103", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850980, "uuid": "5845e958-25c9-4598-a862-828fc5ca4c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850980, "uuid": "2cef3147-2f9d-470d-9b84-6760cc323440", "value": "6469b2046d39cbb049465d0603651645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9183f7-0cac-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658817155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817155, "uuid": "936bb082-724c-4ce6-b599-2e5dd8804a0e", "comment": "Malware payload (Loki)", "value": "49938a8ce7c76b5823b5b746a6aaa26e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817155, "uuid": "e2ef9213-3180-4688-b7fc-305e15407662", "comment": "Malware payload (Loki)", "value": "21825f7e7893e4db1214b0b36a755fb83f80cf716a3dc906b83ec66cdb7d6216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817155, "uuid": "4eb92f2b-b07c-4f18-a4e4-3f96a7271585", "comment": "Malware payload (Loki)", "value": "4c5055b080d566231d4a7e03fcb70e1cc97380bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817155, "uuid": "7ecbd95c-993f-456b-829f-8be1d93b4c10", "comment": "Malware payload (Loki)", "value": "4b6b549cf2868024f5264cd6f56dea9b8b63ed7a91355796acd0680446741f9b6d6d78ca2a2580324ba2108347a22b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817155, "uuid": "6f79f944-8e97-4383-9967-d0bfe4bda97a", "value": "T17C458D9573B9496AD3BFBBFB8010059182789E0254D6EFCD657530DC28B2783CE2929F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817155, "uuid": "b72dd6df-0592-4c51-9125-1e0004a557cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817155, "uuid": "a4cc1182-799e-4357-8550-123e767e3096", "value": "24576:P/2YJtE1DsYHWDs31/za9l6H+fIu7dr9ylQW29u1g:jJAODdfIu7dr9ylau1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817155, "uuid": "8ac29ee6-3fee-4658-8ba0-4cbc77db34bd", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817155, "uuid": "a7647a8e-b481-408a-afa5-a9f2430b94ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817155, "uuid": "3f5a7f4d-feab-4ccf-8606-5a3880d7b9ae", "value": "GI19l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec471d6f-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658851595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851595, "uuid": "849c951f-3d63-4c02-9505-36eb0de02192", "comment": "Malware payload (SnakeKeylogger)", "value": "d556d7ca68aaa084ed10c246f3340d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851595, "uuid": "7dab7239-88cc-4873-9061-ec52d1677fa8", "comment": "Malware payload (SnakeKeylogger)", "value": "218c08cec6f1611911718ce26eb572771eaf353c7cec7b2b32f11e1dad2c466d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851595, "uuid": "7a7db45a-9d82-482e-9a0a-b5e8b8f0b731", "comment": "Malware payload (SnakeKeylogger)", "value": "7d3a2e22d18fd9088859a51698e66f6bf11b198f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851595, "uuid": "4af348aa-465c-4967-983f-c7a4ff4f90b8", "comment": "Malware payload (SnakeKeylogger)", "value": "3dc5a6c8ecbd78397830b878a20c252ad8e560946b01c6e6f36ac775e2f04ac627bbc101442654bfb29ed27a712c7116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851595, "uuid": "2e5112d4-88a9-41ff-b7cc-834ba865cd40", "value": "T131D45B9C3692729ED917D4718FE85C64EA20B877970F9213942323ADDB2DDA7CF110B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851595, "uuid": "95e3aa6b-444f-405a-8aba-1661b97994c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851595, "uuid": "fbf2390c-5450-4da5-a521-275747667f7a", "value": "12288:6Pot2iNDXR073OVe49ZXoeYiCLheZAa+GZDONwhjVt0m90BIWzyAlTpl8cgi3u:lt1rGOM84eYvNza+UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851595, "uuid": "9f746286-0ba6-43bc-bfd9-3ae531570f9a", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851595, "uuid": "c85c0329-8daa-442a-aea7-caa5eebebc8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851595, "uuid": "211644f2-3d9a-461b-92df-389c1b9967d0", "value": "d556d7ca68aaa084ed10c246f3340d99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57de223c-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658849198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849198, "uuid": "f718e74b-45c0-4a6e-ae16-24a9e797ae5a", "comment": "Malware payload (AveMariaRAT)", "value": "aa991425117ec8647651c6c028c8e781", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849198, "uuid": "d11d44f8-62e2-4f50-a45a-0d8bea4603b3", "comment": "Malware payload (AveMariaRAT)", "value": "2207880d0a99724e619396cb798dc322e3fb12eb1a4286daf5f1190279dd25b8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849198, "uuid": "31000db2-4ea1-4933-b5a8-913ef5f33822", "comment": "Malware payload (AveMariaRAT)", "value": "d534c83b18802cf3adc9b34bca3acea3c1b73d02", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849198, "uuid": "7d1b3b08-5dee-4e29-a059-226e71797157", "comment": "Malware payload (AveMariaRAT)", "value": "31fa5b499cff79394c74e03469a550d33fbd8b6ec2b886b541c415130cf5d84a1c72adf7c41f069a8a7587d98cca04ce", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849198, "uuid": "f5238bb0-bfe7-44c5-adce-8d285600e82a", "value": "T15F43DFD4CE69E58FC2113EF20E6A402067791C9BB90191B7271AB63325F6F86CD435FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849198, "uuid": "38870577-89b2-4342-a827-cf45ded3002b", "value": "1536:X3CAL512pb2yMpxeg2794dXbuALkAwlKwyH0ZY:X37L514qyjIbuALkpMGZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849198, "uuid": "320d14d4-d8f3-4a2c-9b8b-310349d71b3a", "value": 58808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849198, "uuid": "59b99bf2-0bbe-4194-94e4-2681eaf35b7e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849198, "uuid": "cf371fe2-cfd4-42c1-9e6c-0556091dff9c", "value": "RFQ-0019288827711-KARATAY International Trading.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0696710f-0cca-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1658829735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829735, "uuid": "72992ae3-e806-48f5-b261-762d0a94897a", "comment": "Malware payload (NetWire)", "value": "6ddf26a588ef63efcf1f1974595a0ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829735, "uuid": "8675a7c0-19b6-4816-b7d8-df268e332b92", "comment": "Malware payload (NetWire)", "value": "220929e603d9a3c2f2f7fbfca0f3bb7056c9e8f7ff353d13b6d5371d7f450439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829735, "uuid": "c0f698c8-6209-4c06-91d3-5d1c454da59c", "comment": "Malware payload (NetWire)", "value": "05f5106fecbf86eca0fcca56f72250600ebc9dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829735, "uuid": "82b67614-f52b-4476-b1f9-5b3855619116", "comment": "Malware payload (NetWire)", "value": "cc6618c91bd99b5631107be9481fda939d53936607435f6d1daed7b60b2ecdc30f69cecca467493fe55fddb5200d3f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829735, "uuid": "524bc34d-ac8c-4431-be04-1fb34dc84aed", "value": "T10015122D5BA59F07EDBC87F8945044048BB165153186E35C8EC6F0EE3F26FB19A4AE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829735, "uuid": "19f00fd3-d4b0-40da-b563-a77377bec6f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829735, "uuid": "268c343b-99a1-45f9-9ac4-b46519891d88", "value": "24576:+c1w4UZvybcv8vupHeYudf26pc/k6YsGFg1WuiKxhP:+c16d8aAzp8Ssg8yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658829735, "uuid": "e6be60f4-ff1f-4b23-a1e1-4f1d28e2ff9a", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658829735, "uuid": "4f0520c2-c6bb-493a-bed1-8cb66058238c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829735, "uuid": "6547ae95-a09c-46e7-9b87-3fa60d89b7cf", "value": "Proof of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cc29f5-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658848603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848603, "uuid": "eec428ba-725c-476e-ab4e-5ab9f072d42d", "comment": "Malware payload (RedLineStealer)", "value": "27bb317f9ae7a42119b387daa9ad0993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848603, "uuid": "67fec5e8-608e-4bf1-96b1-272329e71236", "comment": "Malware payload (RedLineStealer)", "value": "2334e0b1e63b8c4c212c345c86e10bfc5930a355830a591a201751ed364bb47a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848603, "uuid": "5aac9067-d340-4039-87e2-c157518b52a7", "comment": "Malware payload (RedLineStealer)", "value": "f2a6034b660a8b4a87fe179d263cae1940efe1e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848603, "uuid": "552383b7-d566-471d-bffc-9c315bdb268c", "comment": "Malware payload (RedLineStealer)", "value": "2e532cee35104c9d8b9cb46e0e1a2edae3486044245a67475409bcde73509f5db77e1720c26ef0c6daab2c567bd7f5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848603, "uuid": "d24e7d94-4d8c-4beb-a757-928903cf41db", "value": "T149C51A135A8B0E75DDC23BB4A1CB633AA734ED30CA3A9B7BF609C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848603, "uuid": "cb21d428-02c4-41fc-a76d-4b2ac4d088e3", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848603, "uuid": "c21c1421-a2d7-4e88-8787-8e91dcfe16e1", "value": "24576:AaprphSX6wAWPYdYYax0HCtMK5dLYYGIiFpQzAOC/ONtutLV1Bmyl3RuQ553134:NZSFA0zynOCmNtutJnPl3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848603, "uuid": "f69a6f7c-1c27-4aa9-8518-c58a3d2b951f", "value": 2589760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848603, "uuid": "9132cc33-57ba-45b9-a073-8bc8efb8bed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848603, "uuid": "1918c0c3-9330-480e-8efd-b7473ca1d225", "value": "27bb317f9ae7a42119b387daa9ad0993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d62a149-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848886, "uuid": "690b18b1-32bf-4199-b627-a60c535bec19", "comment": "Malware payload (Mirai)", "value": "1b887158245be82a3f272cddcf56b665", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848886, "uuid": "d7821a23-a0d4-4b1b-958c-76116a294547", "comment": "Malware payload (Mirai)", "value": "23463a98d816c3425d937886fee7d59313110a7b1f03c9e9936229e494b5c6c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848886, "uuid": "bd7f242d-db36-4082-abe3-fc21cf9cd07e", "comment": "Malware payload (Mirai)", "value": "b7b129803aad60deb6c3b7d18b339977358110ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848886, "uuid": "dd97f86e-d665-42e5-ab01-5dcab4615f57", "comment": "Malware payload (Mirai)", "value": "1fd4e6c16ace389a7dd64c74df48bdc2db13e73f1d9c082f81543cdd1a5432c2a2d8c6e58d6a395e855d9b9702018f74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848886, "uuid": "791d9533-5d7c-485a-baca-80c15151d8b2", "value": "T1E9A2D0F675DB0897DC66D87B422F08CA846E6D1603E7C3D239E271B25D63494DC3AB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848886, "uuid": "3fb07053-0500-4088-bd19-da3ef201911a", "value": "384:MLcDqRfKUWFH39z+/49ETjvXOtTyPq1KLLjlu3gd2sTxMe7IzG+v1RpA:mMkKJFH39CBLOtTU6Ujlu3IyeM9pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848886, "uuid": "f7dda021-ca59-48af-a01b-38189f1d74e0", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848886, "uuid": "a427ff4d-4486-4a50-8f0e-fd4f6df22a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848886, "uuid": "25d7b8e6-b2de-4cd7-bcf5-24bcb07b4d70", "value": "1b887158245be82a3f272cddcf56b665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e665c4bd-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824527, "uuid": "80946585-6547-40b5-b97e-8ba310f24fc2", "comment": "Malware payload (Formbook)", "value": "4721e9399f37a985e580fb8c6e75ef81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824527, "uuid": "09ef31a9-def6-4df1-8073-3e6213e51ef3", "comment": "Malware payload (Formbook)", "value": "237ae90b2be47d1dda459210b49371fa2b1b0421020d44c583ed82e35018f5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824527, "uuid": "fe79ee29-7505-4be2-ba5e-d75b3441687c", "comment": "Malware payload (Formbook)", "value": "d035fd57e25d0f06d0081843089e17469bbc79c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824527, "uuid": "64d038bf-0503-4bf2-83c1-582877dac033", "comment": "Malware payload (Formbook)", "value": "e2448865dd4888d9c5f057c1befffe1cd8acd58b93f4f44c6d1142ea6899dadf6ed79748fd56ebf1d5012f9ef7fe176d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824527, "uuid": "58b18eee-79d3-4331-a4ff-7cdb02e93337", "value": "T156A43E2C3B1D7EAEED1ED43086120A34BF660F832A40999157CF39C8A77E5F5AC45C96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824527, "uuid": "85468cef-5824-43f1-861f-e062849b46bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824527, "uuid": "a0eb4f3d-aa9a-4dfa-9fe4-bf0226d0297f", "value": "12288:u31LFb/QEBpESeaLJTo6KfhxVbTPOzg+oNtvMsZL2m:S/QEsSvJknf56oNtvMsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824527, "uuid": "f98aa042-9617-4b6a-84e7-12b40a114f4b", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824527, "uuid": "ee075f44-bf55-4e69-b687-963f798c9de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824527, "uuid": "ba8bcdf5-3e04-4ac3-bbec-5bd7eebb594b", "value": "MV STONINGTON EAGLE_Vsl Desc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf8cf5d-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658849073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849073, "uuid": "25143f02-ea08-4943-a795-cba18960fee3", "comment": "Malware payload (Formbook)", "value": "19f74dc6b49077a23a8c69f31a5f151e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849073, "uuid": "f2accde8-f001-4111-8f02-167e08d3844d", "comment": "Malware payload (Formbook)", "value": "24814dbd237c26e5fb64c170a08f21ea69365e8b00535bd2b3e83a24cd825030", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849073, "uuid": "ea880fc3-50b2-4224-92fc-5714a6e9e146", "comment": "Malware payload (Formbook)", "value": "cc35c77f464c2ff53cad7e765ae22f95ff5b48cc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849073, "uuid": "437a6541-25bf-449f-b574-3bda8c1753fd", "comment": "Malware payload (Formbook)", "value": "7f3644834d11d0077edfdc31385c381683ed02a8d9b7e2ab2a33542a34132a719a9de6971af45ae8ab48c706397629a7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849073, "uuid": "a6a663f2-0f79-489d-957c-65fb96a9e1f3", "value": "T197B3022076AFA13BED6713FD099704E8D2AAAC4BC4B14221D5B0375FDB351041EB927A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849073, "uuid": "74224172-acec-4468-8eae-940d9aca60e0", "value": "1536:qBceG9znHLMc+u15gQlYhKjmPaqBImHs/Um7q0wWCsRSaXuEAHDQvFGX:qwnHLMKgQlSK1qamCv7qEScfk0du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849073, "uuid": "5fdb8d40-fcbc-40e7-aca9-9303bcb03be0", "value": 112968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849073, "uuid": "97f25bec-f77d-4edd-9d9b-9a98ecb4ae84", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849073, "uuid": "82bc5e49-335f-4c3b-acb0-a89c6519d31c", "value": "103_FT22195J8MKV_0461571799.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba61cc7-0d1b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658864586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864586, "uuid": "7643b454-945d-47b1-a7e3-ba2873dfb223", "comment": "Malware payload", "value": "3a198ca3987c399d87d8f490d9b4d938", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864586, "uuid": "c7652e9e-0ae4-4c91-a923-5db053ac2556", "comment": "Malware payload", "value": "256ee72fb41f8c4f886e730b30a8775df49d17db75b360c8beb51fdf9c65562f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864586, "uuid": "09e5bad1-c57e-4a7e-944e-77159a7f2b66", "comment": "Malware payload", "value": "83c6600c6da54e19d59f8e1809d9b72fe030bc9f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864586, "uuid": "ba989501-2782-40f2-92d1-325d1b1d12b7", "comment": "Malware payload", "value": "078283db3dc013f760fd22acafb511cc60f8a69512a968a140b0fd821f4679e05dabe4adc3c27f2a92724afe2c86d04b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658864586, "uuid": "61984f1d-a21c-4fd3-8895-3e451a751310", "value": "T108A478BC34903547D67A27E8F683E57C7A8438B8633956C0FBF1F0478A5869DDC20A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658864586, "uuid": "025d41e2-00ac-4633-996c-56e485a53c10", "value": "6144:nP9uiTng1/C5NxOHgL77bRIzAvkuhb7cJCsBfqOwDBixMwfw8pFnG5OdU64y:1t0s5NIyfy5Y8fNwDIVf5plG58V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658864586, "uuid": "a92625c3-3494-4525-ba3a-6dd101f1f7eb", "value": 471927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658864586, "uuid": "5c669e5f-d442-428a-8aec-c0721c354b73", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658864586, "uuid": "20a1686a-3bcd-4da6-a1dc-14c9ca2cf54d", "value": "Genshin 3.0.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09daa07-0caa-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658816276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816276, "uuid": "f29f9359-8a8d-4063-8441-683377350700", "comment": "Malware payload", "value": "e30b3e4699fb1250f9983f102e0098c5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816276, "uuid": "317cc359-e105-42e4-9017-08851ade601a", "comment": "Malware payload", "value": "25d76d51bbfe6a09392a23e9077e410a89cac0ac6bb9fed74d5131dc6006dda8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816276, "uuid": "9e63278f-4f81-4cc0-b505-60d34b6dfbba", "comment": "Malware payload", "value": "493529ef5f8ccb2a13ed1eecb74be1654c53480e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816276, "uuid": "39ddb74e-2c73-41cd-87de-e85574b1fe7d", "comment": "Malware payload", "value": "08df76dc473816cbc9f9c51f4a8fd2c322f8334724644271b61e9ec0898ccafa69132a1a90917f7c798c5cd03ff102dc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816276, "uuid": "e1cec8ed-7798-4204-a408-77678a94804e", "value": "T1FB242349D6BB79C00BA4C4305618B213AFE8D5713DEDACC90A1146FDA3ED37390EC59A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816276, "uuid": "c23fe5ed-6793-4c4c-ae33-aea3b0ea0246", "value": "3072:WVTUpLAR1nNUMrcfbBYQToD/6xveoEOtkXtM9P9aXHTAixETrwV47sSgRvh7Rhwq:WVQyRNvcfFPXxntkXyHTrQKsDvGp/uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658816276, "uuid": "0f985167-5537-460f-aa46-6a178069854b", "value": 229731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658816276, "uuid": "0a1a8206-b3de-4e77-95de-d841fc30d3f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816276, "uuid": "f4fefeeb-9b4e-42c2-8503-f29edff036e5", "value": "Unpaid_Loan_07.25.2022.7432.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c53431-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658854993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854993, "uuid": "86bfe585-783e-4d32-941c-1a1e7d6c1bcb", "comment": "Malware payload (Smoke Loader)", "value": "75d59e2fb9aa6f7f70d1684eb9b065fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854993, "uuid": "2b8b0fde-3c92-4634-97be-0cbba311470c", "comment": "Malware payload (Smoke Loader)", "value": "2847fb03cb28aebee33ddafe47658f94ba312a8c3942dd2af350a7844b4ee4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854993, "uuid": "f9b03431-9f48-491b-9d75-0fb9cc9da26b", "comment": "Malware payload (Smoke Loader)", "value": "5ff75fa6ac9fd13ef9998f79813fc1893f6a7c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854993, "uuid": "2b8f9b6a-c98d-4983-8d46-c4c45a406b00", "comment": "Malware payload (Smoke Loader)", "value": "f35d72b84b967064337e759999fbf43f986dc175a558334da697c0621a420d0380e219037daeff2b49b13de1fc13a01f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854993, "uuid": "cbd54f24-b3f8-404c-ac3a-a4b1e1c888fd", "value": "T1DC648D00B760C03DE0B751F87976C3A8B5297DA1AB2451CB62D67BEE56386E0EC74347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854993, "uuid": "c4864d3d-2042-43e9-807a-22d572edfcd2", "value": "341ace376080222d26a7767debb6055b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854993, "uuid": "04ec2669-645e-4df4-9d3c-15876c1ae395", "value": "3072:q7VSN1aMeqPyldOsrSrYd22bRS2cUW4I3rJ68r2f8deO8aNnsrOUitGWcsBLvj2q:wqPyldOsrEQ2SYUW4ar4NbcNXsWcsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658854993, "uuid": "cffb6b33-43b7-4555-9d11-cb93f59b9695", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658854993, "uuid": "d88c1664-36fd-4644-a1b2-9ac98ab95bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854993, "uuid": "d2f38ef5-d944-46c0-b582-f071e1b5b189", "value": "SecuriteInfo.com.W32.AIDetect.malware1.19286.3599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159f089a-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658849087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849087, "uuid": "df9d69eb-3926-4fca-9f1e-c006aaf88ea1", "comment": "Malware payload (Formbook)", "value": "8ec4388c74c690fb0652e9ae4bc3b242", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849087, "uuid": "bff6e7ce-0e9a-4789-9d48-c19a7c6916f1", "comment": "Malware payload (Formbook)", "value": "285b6168ecb4057651a499ef15f26f576386ff62b00135ebf3877c828649015c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849087, "uuid": "c7576db4-b14c-4bc5-88e4-3cfe43bc1523", "comment": "Malware payload (Formbook)", "value": "a4217119880e2c8d958b7fe57f4c4884840d31ca", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849087, "uuid": "9a0633dc-7534-4db2-a1cc-c277d9baae0c", "comment": "Malware payload (Formbook)", "value": "de03b312aba68f675fa530ef9908377bdc7e39f7fd82aa04d69c61631acbea81f9b958a58087ac2cea49c69c1ba708cd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849087, "uuid": "35bd91e0-093d-46cf-b24c-ea9c79cbf112", "value": "T1E933BD1771B99D2FDAE39E320A9004D6B754FF1DA605A0C2AD1B7989E8B3551CB2033F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849087, "uuid": "5d983605-4465-4645-9ff0-0313abde588e", "value": "768:44uoz13AydJCgjQBOGSQYftqHmnHqL0c4PNEyBMN8YaU0ctk2pJRW:40139U0GSvtRnHeClEyKNKU0ct9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849087, "uuid": "8a05aa74-2331-4d19-ad38-4f10309c7bfe", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849087, "uuid": "b4e001bc-57d1-4dca-abb8-0d8f45491544", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849087, "uuid": "21cc619d-b4dd-4a8d-81f7-9ebcaaf53ab2", "value": "MV. HBC63-PARTICULARS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4203ccc8-0d32-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658874502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874502, "uuid": "31013969-1e7b-4621-b074-073bad9eff43", "comment": "Malware payload", "value": "5ac3d3497a4f79a3117c4e5b9db33ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874502, "uuid": "6dee0728-6ccc-402c-8b26-01dd6dc648fc", "comment": "Malware payload", "value": "2863d59554f71daaca458ebf5f9d290771630f3945b54bef7a5cdc91ed963b6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874502, "uuid": "8716ba61-ea2a-4dc1-8550-eef2a8e6b521", "comment": "Malware payload", "value": "c158c51009630fbfe942a4e37a791e4cb841dadf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874502, "uuid": "0dbd6e1f-fa0a-4dac-9f09-97336a9b77f4", "comment": "Malware payload", "value": "ccbb87aa3ab711ed5b4b83cdc98d8bf32cd8901366d5aabd7203d9d2430cdcc071d82d5d283141e7dc08ddb676dc63df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874502, "uuid": "4e035839-8c32-47e4-91c7-fcc0ee97713f", "value": "T1D3156B3160E66BC4EAA6DFB64ED4E155FFE75C02DA00D21EE96036F24233B90C9511FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874502, "uuid": "c0c25bad-c6ca-457c-b511-d9a1b87444b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874502, "uuid": "660f5e99-1feb-40a4-a589-72b35626b759", "value": "12288:6XEguujixgV2iNDQD+mS6RVAyeXqitgAVvSh7yGV:6LixgV1HmA/vCGGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658874502, "uuid": "486d0360-d233-42d1-b9eb-863c18eca60f", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658874502, "uuid": "cb7441dc-aab6-4cf9-ab66-ba837a88836a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874502, "uuid": "7e92b113-88d2-40be-94a2-a28671639e76", "value": "5ac3d3497a4f79a3117c4e5b9db33ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eca9325-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658848888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848888, "uuid": "160ac566-1ec1-4536-bc53-6a6c5fa60e94", "comment": "Malware payload (AgentTesla)", "value": "0873a5654bf5892d7a916aecb2249504", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848888, "uuid": "10f4c245-5dcc-4637-abaa-0ba9f5002f66", "comment": "Malware payload (AgentTesla)", "value": "29ba62e3442fa9feac4df8071d7a64119152498c648722a6ea95c2599d30b94c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848888, "uuid": "71137d98-ec76-43d7-9fea-2121175f8f9e", "comment": "Malware payload (AgentTesla)", "value": "65871c6e0e05d56ca93b35c3e74279338a8fddeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848888, "uuid": "aa9e8e8c-67c8-4b3f-a21e-50dc9aa58da3", "comment": "Malware payload (AgentTesla)", "value": "068781f050402c6874d071f369928284b8a253a79d33e6a6b22e6d65965ffabff1873532c97183ff40cc488ce6574503", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848888, "uuid": "98dcad6b-3508-4388-a7a5-db408dd52e51", "value": "T186240A7E17855D41C6EE41FDD0B6815821F0A7038366B38F6DE248EE1B172CEFA2A9D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848888, "uuid": "4bdc0fe7-092a-4e87-87d1-ee00b310abe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848888, "uuid": "f2fbbe3b-ccf8-4ad4-9b8f-873d8076f440", "value": "3072:ycHIq04AW1Dm6dB+TkphrJLXXcOOUwbIp656xVbySAZskEYCaYAN8U7Ai:RHoSP9ph92UwbIp/VbzUZYAOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848888, "uuid": "e3d832f5-3591-4fed-94af-9bafcfbe59e4", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848888, "uuid": "b48a5464-c8b3-45a1-8de0-605ad24a7931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848888, "uuid": "d1edba55-bcd0-4a30-927a-8d43a20d030c", "value": "0873a5654bf5892d7a916aecb2249504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6bb4c1-0cd1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658833045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833045, "uuid": "5b52815d-d325-4181-a204-38a2254de289", "comment": "Malware payload (Smoke Loader)", "value": "c1484b89c452ce79c2ce3f80675aec6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833045, "uuid": "551436ed-50a2-4352-911d-363da584dab3", "comment": "Malware payload (Smoke Loader)", "value": "29fa967456a686990c411c90db5a89f2d2bdb75ff5d1e266ca30501c4395987e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833045, "uuid": "cd71490a-433b-461b-bf0e-fec88dd075e7", "comment": "Malware payload (Smoke Loader)", "value": "754774711bc79f50892948d2646a9d7ab0366d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833045, "uuid": "2c906a88-6f9d-4ae0-8e10-387215c69cc2", "comment": "Malware payload (Smoke Loader)", "value": "2b28a5f06fad493e060b233422fd630f36ac03e730477b6fc313c8b3bb2cdb81e159673abab9b61ef721854aa2aa1f4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833045, "uuid": "3e99740d-b04d-4291-8a3e-66892089cc6c", "value": "T12F648D40BBA0D03DF0B711F8797AC2A8A52D7DA09B2055CB62D63BEE56346D1ECB4317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833045, "uuid": "336b52ee-6cae-4e34-a2db-8becbe6e2d42", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833045, "uuid": "c2a18d89-ce3c-413e-afc7-743f341f2333", "value": "3072:G7NSNW1Me1jmxzUsFAf3i22mD7m6MPoqDZqlLGME/6eyBmwCMj4uB4hcgZq+ziF2:I1jmxzUsF2i2p3MPoqDoIbyCk4uqlab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658833045, "uuid": "9f91f2cf-cc46-404c-815d-74668717174f", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658833045, "uuid": "b8b15e22-57ac-4d3d-b8bb-32b5ba2efba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833045, "uuid": "7a404edd-f621-442c-9405-c0bd29dd488a", "value": "c1484b89c452ce79c2ce3f80675aec6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e73eeff-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801643, "uuid": "f6920ee1-0c51-412b-88da-f2e37d55a41e", "comment": "Malware payload (Mirai)", "value": "a2ba9bde001432d24d74a9236b5eaf17", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801643, "uuid": "b76bec06-6475-4e37-94ba-d4ac8ab17eb0", "comment": "Malware payload (Mirai)", "value": "2a569eedd43aec935500df40ad6cade044674095bf21e8db1e3f71b9c7b912b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801643, "uuid": "4efb6a03-608a-4a0f-a9df-28f1b91788f3", "comment": "Malware payload (Mirai)", "value": "0204e742a1872f0f89b7cf86de0dcf1cbd7d8a75", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801643, "uuid": "accf9dde-5454-4f44-a465-0c48952bad92", "comment": "Malware payload (Mirai)", "value": "b0e430cd4417ac56f7e3077df52fd7d438b67abb38f9c5c79583225159195794a770e0c5bf2169238e7f6e4f6ff61eff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801643, "uuid": "101ac5f0-df7d-478f-9109-6af6d0d3e674", "value": "T19FB2F1A8C1FB856BC029803DA2A90516E584DF996369C1851F87C71B9913AFE533B7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801643, "uuid": "5db17f12-7f91-4a29-90a5-e7cecbfd0f78", "value": "384:MlXx1rthAmgVQZqf+G3VtbMEGJvlsTEacgDtD1E9QAHm5wzXhp0d+v1Rx:w1rzS3VtYNJKTEaJxD1E9QNOhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801643, "uuid": "185e2ad5-1fe7-414f-8fa5-0da1341cfaf5", "value": 24764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801643, "uuid": "e922abba-3ee6-4bfc-87ec-daf9871724e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801643, "uuid": "56304d55-75c3-4233-81f5-a3bc0dd6405c", "value": "infect.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f141d4b-0d1c-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658865156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865156, "uuid": "464f40b2-8b72-45db-b00f-0036b9cb95b4", "comment": "Malware payload (AgentTesla)", "value": "3b838d4a3ccf5eda6b4bf7485fdb66a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865156, "uuid": "8b6cf0a8-09c1-42b9-822d-c4fd06c23644", "comment": "Malware payload (AgentTesla)", "value": "2cc73daea111d63417ed6fefbe7771952bd40c7dcfe7b3c38b91644be44a8956", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865156, "uuid": "0c79c039-442d-486a-b877-6a4cb1740307", "comment": "Malware payload (AgentTesla)", "value": "435ce52179a7c2ade06769468244170f2fb160cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865156, "uuid": "954ade2e-e739-4454-8c16-60e68e3ecd7f", "comment": "Malware payload (AgentTesla)", "value": "f10853eb3a4823bf00fe52096a12e78abb7160ee54614029b2a0ccad340959c1fd6a8faa402231d0e5ffeaba89154a70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865156, "uuid": "f2ca07c0-b42b-4136-81a0-5776dc6cf569", "value": "T157C41224253ECB29DC3E8BFE4029B0485BF4B15BB302D35D8FDE20E965A2B144755AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865156, "uuid": "02b4f86e-88c5-48d2-b551-704f5feeadcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865156, "uuid": "81a104c5-12fd-4ed6-b695-db722ecf1a72", "value": "12288:bj2FZv30wMzKZaHmigR987yFPfexpRFvjY2jlfAymTZYVjU8FOjTiUox8:KZvEhzUaHmR9fexpRFvjY2IwU8Whox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658865156, "uuid": "4c8c5e0c-51ba-4183-aa4f-173805f58fc2", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658865156, "uuid": "8e99ea86-6552-41fd-99ad-f079af225181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865156, "uuid": "ff7282e7-5fb6-40b7-813a-479aa16835cf", "value": "transferencia bancaria.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce55a7cf-0ce6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658842096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842096, "uuid": "e33ca6ac-b7e0-4c73-bacc-d011a5ea30dc", "comment": "Malware payload (Formbook)", "value": "31f6b2e3d8b53ea77ec9836573ed5f14", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842096, "uuid": "aeb8cd52-c811-4713-9c6b-13c2d5638584", "comment": "Malware payload (Formbook)", "value": "2f3a27a2a81094862924f64a83c1a2b61c25a331a5926a1144330d0357d78797", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842096, "uuid": "d391b71b-e79f-4384-b714-60e02d0c7fab", "comment": "Malware payload (Formbook)", "value": "43c81bae7809300ee2a04054aef0fefb5f9fe745", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842096, "uuid": "0d29a698-e757-4d20-bc6c-2a4c51dc6b0e", "comment": "Malware payload (Formbook)", "value": "ea444d86c91bd4f543db1085d63bd4e82006dfd9b6d4155d2e50c80e63ab520384f9065ca398723eb6d26af9c20ca169", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658842096, "uuid": "2148793e-98ea-432f-8c7c-dc285aba702b", "value": "T1AFB423C48D0D14AB8463F530696CDC69EE58E73EF1233CD65C7277A6D8E02D7A292C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658842096, "uuid": "76bef340-d915-4b53-be4e-e335f237219e", "value": "12288:1cyA/4NDtRGESGGG/FYu3jPRfvwPT5aMKOdC:KyAwNiESrGau31HwAFOdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658842096, "uuid": "9ae67dea-eb36-49ed-a4e2-4f1ac2459c40", "value": 528063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658842096, "uuid": "868818ff-05b1-49fe-8211-cb6259f11493", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658842096, "uuid": "f0401a51-9e9c-4108-86a5-cd397d10640c", "value": "List of Items to Purchase.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acd0e99-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658849230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849230, "uuid": "cc1b8222-1bdf-473e-8ba8-11afe039ac41", "comment": "Malware payload (SnakeKeylogger)", "value": "b3efcc16b65c57094a643b402275bf00", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849230, "uuid": "91f66b5d-8a2b-4ecc-b82b-e93d4cc81900", "comment": "Malware payload (SnakeKeylogger)", "value": "2f8de1520000f0123bcf4755cf6c3430d34a46cd2799ffd0021138e8174ad5bd", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849230, "uuid": "23eeac0b-3909-4019-81bb-06b17afb0e46", "comment": "Malware payload (SnakeKeylogger)", "value": "ed51c87cc128a337171f83095313462579de89b7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849230, "uuid": "ebd24ae3-8d41-4d15-a4b7-6e1613cb9f73", "comment": "Malware payload (SnakeKeylogger)", "value": "95b4ca1a87af97a0c2859ef31ab93a7c79a26c5a7d9f6d8afab445bcc8ed3f818f792a71d2db2ac88e0f0bf8b460ecaf", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849230, "uuid": "55927ad0-1b99-455b-bd54-ec4455c7cbac", "value": "T16BB3F132B6D4A690D9B840F50A7D8AA099665EF653E9CCA33F22F10C497DE7C0C4312F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849230, "uuid": "65a8a487-9947-4774-8bf3-8fb3203afe68", "value": "3072:YS+6aAr66ygYgV+KLXvxGCvFKW5w6uRAA:/X6tggKrvxhv4Y/uaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849230, "uuid": "7c240984-4577-431f-9faa-5d81ca686a69", "value": 113064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849230, "uuid": "95b3aafb-4322-47e0-a7c1-4b783e03a2ea", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849230, "uuid": "ebfdc39f-a694-4fa1-aeb8-c6eb629128a3", "value": "PI_0936567.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac049ab5-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827006, "uuid": "2f8499d2-2613-4329-a980-0f802bdb88f9", "comment": "Malware payload (Mirai)", "value": "14ded00b458a60afe2c621e6d802d1b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827006, "uuid": "1d46faa6-1589-44af-902e-e5e3ec71138e", "comment": "Malware payload (Mirai)", "value": "30e2a20ed1df45fed8bf38dca8a7f78b726fa2ebfe4972ccafdebb6458382185", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827006, "uuid": "52cfc1ab-8b9e-4b7f-a4de-15e2c5dec9b9", "comment": "Malware payload (Mirai)", "value": "0a046732cbd4618d5379825fea9e61e9d3698f1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827006, "uuid": "d2c91f90-15c2-4397-ab60-ed4a8856b71e", "comment": "Malware payload (Mirai)", "value": "4d941b98d4ec2d60284d1e4744166fc37fb978020f5bfb6d7e7017087723dde82a0f3cc4f8e97c6d75f7dfc285ce69b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827006, "uuid": "91caa97f-fe3a-4de3-81ad-2045cbe91bca", "value": "T11203F109B3776CFAD3B44433EC2D46824B585BF8B16614C3451C5DADA68908B0BB6FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827006, "uuid": "e47e4d0b-b873-4035-a1fd-6d87bbafc8b7", "value": "768:g1tHceDfjSg+EBDP38TZKQLNqAtX8DKOKf9gWX8newt4Q99q3UELEw:g1dcezug+IDPzQLnMrKlgWXiewtaLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827006, "uuid": "4b6f77fd-5d02-45e9-8319-1a7cdd873d28", "value": 37796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827006, "uuid": "f5924077-d172-4a76-a22d-9048469e0049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827006, "uuid": "9e7866e6-78b6-41b9-b836-f8123cd91b6e", "value": "home.arm6-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221f3594-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848249, "uuid": "993ae07b-9450-4a20-9961-c03e04f7c256", "comment": "Malware payload (SnakeKeylogger)", "value": "65ae88db2ccd8e9da11e275342dad8ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848249, "uuid": "2b4b42d3-f323-4525-b9a6-4b2042040ace", "comment": "Malware payload (SnakeKeylogger)", "value": "311e354dee07f9889d3efcd5dc0b87db72d8c9055827068b45051aabafc7e380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848249, "uuid": "8c09a005-ba2b-4075-adef-ae529f6265a6", "comment": "Malware payload (SnakeKeylogger)", "value": "fb96dca05b9a6a683fb839682ee1a6c3c0532d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848249, "uuid": "35a01c14-50fe-48cb-a09d-067c098a35d1", "comment": "Malware payload (SnakeKeylogger)", "value": "4128f58a54417bee7c501bcab9f422592565033e6becfb151598b42507aaa294b3d39b364ac0d6e1a29697ebc4cbb7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848249, "uuid": "88ec3e8a-a130-4f09-921f-ae1d0a7e7aa1", "value": "T16184D0AEE310C509E8A8777798B793217705BDA076B7C35B51E5389B8877BEE7C001A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848249, "uuid": "ae18d359-d7a5-463f-a9e2-c017d532fa1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848249, "uuid": "f76bb41c-029d-42ae-8ed9-784396e724c9", "value": "6144:udo40ldq4vlir0oN2fFzXx0Lqrt5fHecYWZ1oOdLPliy4Ovh0dh34tqUi6Y4:740ldqFrjN2BxGqrtNHjT1LTb4OveL3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848249, "uuid": "e119bb69-0427-43e4-b937-d29636113c61", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848249, "uuid": "752b2582-432a-41be-b2a4-805a663e05d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848249, "uuid": "82998058-2706-4eae-85c9-ee1d7891fd36", "value": "65ae88db2ccd8e9da11e275342dad8ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020425b8-0ccc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658830586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830586, "uuid": "9ad682c5-2441-4da2-9ab9-d532fb4535d9", "comment": "Malware payload (Smoke Loader)", "value": "bd732865220af5455187d6d345f38463", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830586, "uuid": "0a2f27b3-3857-42c8-8879-0a76389cd2bf", "comment": "Malware payload (Smoke Loader)", "value": "32d56a576f5825ca27838fae5e94cab340eb7285a97e982de7963a41a38ec228", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830586, "uuid": "3b7a1fe0-59ac-4bdb-9534-db67c9c19367", "comment": "Malware payload (Smoke Loader)", "value": "07828d376b7bef8234c6ad75509826bf7c6c43e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830586, "uuid": "4561322d-8bb7-4a69-b1e5-270be8a3841b", "comment": "Malware payload (Smoke Loader)", "value": "f081ea3827d5a64bf4b5b24e8982bc1b4b0789f45c7dc99066f96cac97dd826ee008ca945958f5c3b5db384c607a0433", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830586, "uuid": "dab265b8-67f5-43a8-a854-b540652e22ce", "value": "T1EF648D40B7A0C03DE0B711F8B976C368A539BDA09B2445CB62D67BEE56346E1ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830586, "uuid": "b897570a-cd69-49d8-a65f-9731b4a57ad2", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830586, "uuid": "4e17375a-ce28-49f3-826c-bb06212dc1d4", "value": "3072:17NSNWCMen2mxzxsuvUdfrmER9QwXAKseh4e+Um1yEbgxvnIA7oZpVkWOZlkCj4Y:Gn2mxzxsu+frtpXAKThj6ZExW4//kCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658830586, "uuid": "c18b6de7-db6e-4871-9ec4-e98e03b12620", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658830586, "uuid": "99be28c7-9260-4658-9920-50bfeed95755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830586, "uuid": "5c4519b7-656d-496f-94ce-548a6b1600a0", "value": "bd732865220af5455187d6d345f38463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9bbf60-0cb4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658820430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820430, "uuid": "5882a9d3-3141-4038-9938-582addd8e127", "comment": "Malware payload (RedLineStealer)", "value": "ae366d3ea28c5c6873ef524c87485e0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820430, "uuid": "318b1237-bf6e-4fed-a009-c527ed889ec1", "comment": "Malware payload (RedLineStealer)", "value": "333fc6c84ff02a81fc125f7e6fba3e6bfe86a24606499d8cb6d578c698a3105b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820430, "uuid": "2b3621bc-0625-4eeb-87a2-af62459cfadd", "comment": "Malware payload (RedLineStealer)", "value": "eb9becd61d2a6eb9ea04899c9e8ba4cec70e4042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820430, "uuid": "399e3af6-ad70-4d20-b792-adcb04ed824e", "comment": "Malware payload (RedLineStealer)", "value": "f647dfc6127201e6faaf4385ac360d7cb2e76a45f3f1c0d8e3bf401efb4a5fd49089480b2ddc00d995912e2006b72325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820430, "uuid": "6444030d-4bf0-4e31-9a69-542e4fe82902", "value": "T18E94CF40B7A0C03DE07312F47975C2A9B52A7DE1AB2051CB32D67AEE56342E5ECB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820430, "uuid": "239ea5e9-b7a6-4e2b-bddd-ebfffbdb68ba", "value": "504d97a665c5990d2e90f1479886157c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820430, "uuid": "8b947f01-ba29-405a-94e5-b0e96fb06fe8", "value": "6144:VFoHTsy16D1W/5w1B9ZmGISA15if5ddhiQqlLhymo5I3M9lQnki:VY16D8w1B9Z+SC5wdClLksalQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820430, "uuid": "40be2780-ec1f-4daa-bb4c-b9cf15313150", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820430, "uuid": "3ac3fea0-2454-43cb-b2f1-b61cb9c6e4f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820430, "uuid": "eb430a70-701c-4ec2-b27b-6180dae5f5bc", "value": "ae366d3ea28c5c6873ef524c87485e0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2929bf6-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658828735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828735, "uuid": "330f304c-bb33-461a-9320-da57af82eef9", "comment": "Malware payload (GuLoader)", "value": "a62e55e293a8f324fb3fdb37363fbf1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828735, "uuid": "4b0c08a0-890f-468b-8115-8688d9f49caf", "comment": "Malware payload (GuLoader)", "value": "3422e6f79f556b96084cd45206b2cad7c916f4fceb96a0ec245189a6c3d23a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828735, "uuid": "cb88bda3-dedb-45e4-90e1-32370236afe5", "comment": "Malware payload (GuLoader)", "value": "1df43b120a1cf2e908d1d29dce1f5c48a81a210b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828735, "uuid": "40d3c372-59d6-4b73-a41c-185a1824a3fb", "comment": "Malware payload (GuLoader)", "value": "1deddfb0a2aaa006dc563bac5b991c54eecca9c3858eef0ca1592786827a8d1f190bdc17374cfdb7782d8de35af4a932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828735, "uuid": "f25502b5-2a9e-410f-90a3-0bd118ba9d78", "value": "T10A54E028ABA4C817D8910CB49D729D9FA8F0ED415549DAA776103F3EE27C282DE1E317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828735, "uuid": "26d8afbb-f7b1-4bb8-b736-15ad00799ad2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828735, "uuid": "7f1a360e-40f5-4510-b900-af91ac0bc5b6", "value": "6144:9DYa6lZYbjBwn53Rp9OaC9SlLLTMZA+Ph:lYzZYbja5h+19kTip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828735, "uuid": "d8bd2911-29f0-4101-99a6-e0a754b61527", "value": 293440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828735, "uuid": "341633a8-a154-4487-86cc-6b91def3d26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828735, "uuid": "94d69163-46bb-409b-b234-5410ec4e09f5", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9343.20003.8845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218c3b4d-0c7a-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658795420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658795420, "uuid": "ea67f41d-8aa3-4cc3-8fd3-b1e4119425af", "comment": "Malware payload (GuLoader)", "value": "8c7afe303bd2f7c516e2268b9aa65690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658795420, "uuid": "7ee4d24b-f69b-4227-8785-63f6b0c56e94", "comment": "Malware payload (GuLoader)", "value": "35fed5ad5772fe6c7f7411d77512d73497be6668fa8d5a5a8524dc76f44243e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658795420, "uuid": "9c294510-3b5a-4cef-945d-347ac251e4fc", "comment": "Malware payload (GuLoader)", "value": "47c0e4f79b7335c061d3bcd53208d075129998b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658795420, "uuid": "93558021-13a4-401d-b64c-f124012808b2", "comment": "Malware payload (GuLoader)", "value": "c4345b60b518381d801741d84bfde8205432befc4945ead159ebec0ff15e03e37700108e6fd7d9ed115ba4b417b8454f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658795420, "uuid": "b6d8ac84-ae0f-4367-8467-e55bc59619aa", "value": "T10C2501117504E1A3F6090735D9B7DA7507BA3E8ABC884A8F728CBF5F35B3602641BA1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658795420, "uuid": "e6225aab-3757-4171-a798-0b24c9427649", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658795420, "uuid": "1394a973-ed0f-4c95-a3db-427c3a00a8d9", "value": "12288:3OjpRt9HUMQvSAUumtr/ynwL9ED3I+wpD7mkKKTJCwTJ0daT:3O1H9HUMQvSAUuCrcRDY/DrTHMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658795420, "uuid": "41137d6f-197c-4fed-a7e6-456faffbc89d", "value": 987552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658795420, "uuid": "cb7f7b20-c068-4ff6-978f-1bd875edfe6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658795420, "uuid": "2916071f-a05f-4515-ab1c-f5076cd78e75", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9233.25284.19729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fd43a6-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658848313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848313, "uuid": "31b6bb80-53d2-4a5c-b76f-4ad786c1b16f", "comment": "Malware payload (RedLineStealer)", "value": "65122666327049e092095330babf99e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848313, "uuid": "221e7a97-7f0f-45bc-8b6b-d244e68dbc79", "comment": "Malware payload (RedLineStealer)", "value": "36ac1377c88fb5dd7ffb82c918ee1e07fa75ee2ff50f6ce129e859152bf0dc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848313, "uuid": "42182882-82b2-4df9-89b3-187c40167743", "comment": "Malware payload (RedLineStealer)", "value": "c5f4465e63f83d09f93d1dea47eac33bd463e485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848313, "uuid": "6847a5b0-895a-484c-a152-a9533c9eac90", "comment": "Malware payload (RedLineStealer)", "value": "3732cde717fbfe01b2061a8835e6022f66ee4ca0a2ea820a0460e65fe4294af82848889e6fb32e1186417b798d8a5826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848313, "uuid": "59c7bdb1-c24f-44fc-9cc6-5561a454c15b", "value": "T13AC51A135A8B0E75DDC23BB4A1CB633AA734ED30CA2A9B7FF609C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848313, "uuid": "9fbaca26-6fb2-4565-9af9-54ad57fe1d13", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848313, "uuid": "a45fff8f-2493-422d-9464-4eecbad2aca9", "value": "24576:e10YbWPQNZYNYnfpA5XiHMAodrDY8TgnzQFLrwzSrJF5RNLKO4hu0l3RuQ55313G:URGQ9txcrJF5RN2vBl3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848313, "uuid": "0d9ceb64-ed05-417c-a5eb-3d6a7be9626d", "value": 2587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848313, "uuid": "438e80de-7a0e-4088-94de-66551ceef1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848313, "uuid": "df36080f-c38d-44b1-8ae8-3634adcc2c98", "value": "65122666327049e092095330babf99e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2034f5-0c80-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658798260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798260, "uuid": "a82a69f4-968e-4bad-b855-90b7ad335076", "comment": "Malware payload (GuLoader)", "value": "9162dfe57964eb774b778da435d3ba5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798260, "uuid": "f8a20e0f-e1c4-4e8d-96dd-723387d11035", "comment": "Malware payload (GuLoader)", "value": "384d7fc0bb89b0fec770a1fffd775f9dee8e6ca461d443b6cfe9fc867f008674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798260, "uuid": "61781c2c-8017-4cd9-b9d8-6b7f14c06081", "comment": "Malware payload (GuLoader)", "value": "06ab6fd94f7b3b8407027b8c964943df49106331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798260, "uuid": "faef6e20-edd3-433a-8625-a3222c7e04fe", "comment": "Malware payload (GuLoader)", "value": "8569844ac191d01b78b723fbf5ebd28bb5394b1d0694904f07007611c81950ed580bc3ed3e66eebbed0cb11fedc56ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798260, "uuid": "3a322b58-1072-4e1f-9e9c-aa8c427c9458", "value": "T168A4F0D2D25180AAFCA9673588378C2616A3BE7DBCF0E61E564A35366F732D3005BD07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798260, "uuid": "fe9a1aed-09da-42e1-b148-b2b0b46a4d5f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798260, "uuid": "61ac847b-71d1-440c-a5a7-7aa7f2b64a2c", "value": "12288:p35nRIVGI6xhdOsk3RmRCFRWMd7UgyZLCCmGDU:p35qYhdOs6gEFRWMJUD+KU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658798260, "uuid": "dea1abad-3dda-47a3-aaf9-ffba48689dcf", "value": 480176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658798260, "uuid": "141754b8-280c-48cb-a04e-77cdbb46a8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798260, "uuid": "b0e34e36-9420-4edb-bb43-b476e69cf101", "value": "TNT_AWB_AND_INVOICE_06859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192d4783-0c94-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658806573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806573, "uuid": "36beb263-d324-4a75-8815-2a8305b81142", "comment": "Malware payload (Formbook)", "value": "723e98c1303b543e714fbde71c3e0cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806573, "uuid": "8ca2e692-0c9e-4339-826a-4d3de5dc80f8", "comment": "Malware payload (Formbook)", "value": "38526e2036a5fe19b1d4edbb6e9452a3f80db6685b6b7c1d53b5e75117f2050a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806573, "uuid": "887cc494-eb49-4cb0-9457-8f682284ed58", "comment": "Malware payload (Formbook)", "value": "6ed6ab017f26409836bebafbb0c8a25cc048c457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806573, "uuid": "83b58d9e-a7b2-435c-bde2-ffdaa7b27e98", "comment": "Malware payload (Formbook)", "value": "53be3ae69f566868700d75abf1707ad146b587f913b2b02b62b9b6f7fda93f6f07a8a3be28c5f6e76cd129682dde4092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806573, "uuid": "69e6b387-5b4b-4a8f-aa0e-e87785b0bcf2", "value": "T13FD4D00039EBB324EF66D6B81BDCD4A48DA5E923E908A6797D263339C731F714952036", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806573, "uuid": "7149ad36-99c0-499b-821d-18a45c8f719a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806573, "uuid": "7692d1b2-4ece-4f07-87ed-90253f21f99c", "value": "12288:Cut2iNDXR0nBNfKe8BbIMdiN36uE7C8aukE:B1rYBX8Bng4CPukE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658806573, "uuid": "6a02b934-d21e-43d8-97c0-84813a8447af", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658806573, "uuid": "05c8c340-8387-4a2c-be68-7f0634dcff85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806573, "uuid": "e48d1755-4c2e-4709-a5a3-cd65aa0140e5", "value": "picture of products.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb7cc36-0caa-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658816221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816221, "uuid": "0ca41a62-4442-4ec7-b88d-050ce09d9cf3", "comment": "Malware payload", "value": "7fea104bf1fd80be8fee4c0f91a7a1a9", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816221, "uuid": "ccec6f73-d27c-4403-b392-402efa90a89d", "comment": "Malware payload", "value": "388effb360254afaa7730c7f8489a3c40b44f9650bfc6333f7aaa8b2495bb200", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816221, "uuid": "337662c5-9f14-4302-8d75-a5d7748c6599", "comment": "Malware payload", "value": "7e124b9141b7505004067ff6f8e1c8d34dd9c64c", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816221, "uuid": "e2071703-1e98-4d7f-a15f-c7a5bd3cd707", "comment": "Malware payload", "value": "ce1c652b5efca738493bf4fb2d7cdf0346074b718c88fd0c48cf373dda0f2429293a65e9fade8555aaab7722bdc446ec", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816221, "uuid": "93e3a475-d640-4cca-8ab2-c084d58c0b43", "value": "T161B3F1B5647BAB3BD8B0A13E23C56850D27BDF5B85CD4D6AA2CC706D093B6F1C742121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816221, "uuid": "9c3fdbbf-88f5-4f21-a610-0934c025bbba", "value": "3072:UNBBpIzuFyQwqA7QtVmuOSUD5cHmYjAvESMNvIj:YWzufNmyMcGYbS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658816221, "uuid": "5dbe1509-e77a-40ab-b545-556ee64febbd", "value": 112712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658816221, "uuid": "e5fa5ff2-f248-4890-8997-b2e0e79457dd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816221, "uuid": "85089b8c-25fe-4430-b8e5-655670e15ee4", "value": "invoice .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0acb373-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658824866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824866, "uuid": "38cfa3ea-0cc9-4fda-9fc1-bd6edbe8e579", "comment": "Malware payload (RedLineStealer)", "value": "d041018282f1e9950dd7fe32b03d221b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824866, "uuid": "584947d4-f796-47a0-ad71-6e0edcfdefeb", "comment": "Malware payload (RedLineStealer)", "value": "3965cc95e998297ef8ae6c9dc1ed0250dae034be0a2d041a29e1a952385678b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824866, "uuid": "8c397b56-44a2-478f-8d95-98fee5a6f795", "comment": "Malware payload (RedLineStealer)", "value": "3fe84741b6e35f397391dd45ba5410f0047df391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824866, "uuid": "5608ee3d-db3f-4f30-9767-3a7c3e3d57c3", "comment": "Malware payload (RedLineStealer)", "value": "db2fab7c9723945c1aea180fa7f6794fb98dc31909a09f04a2721aa9c40c88325bbae520381398c1540ac02627cc1b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824866, "uuid": "9f3923af-b583-4368-9d1b-daa2ed7d987c", "value": "T1A394CF40B6A0D03DF4B311F479B5C2ADB52D7DD09B2091CB62D63AEE56386E4ECB9207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824866, "uuid": "ba71361a-d3f0-4c07-99ec-fd4a184c14cb", "value": "504d97a665c5990d2e90f1479886157c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824866, "uuid": "8c67f45a-96f9-4dd1-bdbb-14e2c7e51dd1", "value": "6144:Q9EHGs/FMyTWsw0Wd6rBRUv4CADLEWZRWENxSkuHY6nJsc7mb9KU+Vu0OsRn:QNOMybw0Wd6rBRdQWZbT/WJ8x0jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824866, "uuid": "da425abd-64a6-4cec-bfca-b23c230617d6", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824866, "uuid": "a281d70c-b71b-4668-8418-6c40f8576ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824866, "uuid": "778c4a46-ad14-46ac-95d8-d8f0814b6871", "value": "d041018282f1e9950dd7fe32b03d221b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39ac1a6-0cd5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658834830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834830, "uuid": "398b71d0-3324-432d-af7d-82a1ced150a9", "comment": "Malware payload", "value": "ac296f715f382a144116ee9e9c5c7e61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834830, "uuid": "f96bc2ff-9cee-4049-80be-d1ab110d0e58", "comment": "Malware payload", "value": "398dda8819020b08d425a49e334a26aeb49b7b3915cc0d704cd9f9307aef9622", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834830, "uuid": "a46d6037-d937-4578-b92d-1a99a97c676d", "comment": "Malware payload", "value": "f9087da6c77cd43a16cc8d8be9148de80e95a511", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834830, "uuid": "79d482dd-046d-4db0-af31-6dc4e94fe9da", "comment": "Malware payload", "value": "bd5dd72848be1f4bcb1c4aeaa77475346f283a6f3de5b970db23bd34076a784077ba34441e6a71b73a94ba343b4347fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834830, "uuid": "974a4dda-a8ba-4724-af68-9344b4f0b0ff", "value": "T1A125233BBD99C492E94BD5348697F302E90A04589583F0877AC819492F7F9F8DF1ACC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834830, "uuid": "087c00dc-dfb5-4846-99ce-ecfb3fe31eed", "value": "24576:639gLE4CwlnPYW50eHeUrN4Dz8TfahEIQxlE5oBYu8HaOASp:E3IPL50XH8fahEIYEI0HaQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834830, "uuid": "62e3e28b-1366-458b-a1bc-21b68dfe5280", "value": 1053124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834830, "uuid": "a11512df-b4c9-475e-b12e-5f781996255d", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834830, "uuid": "de641bf0-9d62-4dbb-9683-e520d3f025a5", "value": "onomjaelhagjjojbkcafidnepbfkpnee.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f103f1-0d02-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658853948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853948, "uuid": "122e937a-7562-41eb-bce6-deaa51e6b29a", "comment": "Malware payload (NanoCore)", "value": "f99cd690a89f7c5bc10a93a5e44a789a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853948, "uuid": "40f756f2-0d87-4ba4-ab3c-053bc4f7862c", "comment": "Malware payload (NanoCore)", "value": "39e0a6901e63ff3ac0c9236537712ae2f5775022232654e4814592517d0e612d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853948, "uuid": "40a6da1b-1dce-4789-8588-26efb9452bf6", "comment": "Malware payload (NanoCore)", "value": "200cbb93c8221e9c970017b1d477f9d2820155d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853948, "uuid": "386c3b50-cf88-409a-9038-6bdb7fc17592", "comment": "Malware payload (NanoCore)", "value": "09c2caf91347b1eca206a093550b2fee849097c1b55a7edecc3f75ad29cc078ec76f83d88d2d2ca8a5add027f2f14beb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853948, "uuid": "c10679f7-d4be-4094-a75c-8dc221763711", "value": "T13314CF263BA8862FE2DE857D611212569379C2E3E8C3F3DE58D451B39B627E1470B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853948, "uuid": "bbc4b541-b922-47a1-a03b-95f27a4dcf87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853948, "uuid": "18a10149-30cf-4cb0-bbf6-78ee19526f93", "value": "6144:QLV6Bta6dtJmakIM5Kehjauz5+CE+RkLXUJ:QLV6BtpmkAjBA2SLXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853948, "uuid": "0892b922-6456-46ef-afd3-8070ea803d64", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853948, "uuid": "147bd5aa-eaba-4be9-84b4-8e5ddbaefcef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853948, "uuid": "e78627e1-043d-4021-ac23-3ebe63b98b03", "value": "f99cd690a89f7c5bc10a93a5e44a789a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70baca34-0d0b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658857830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857830, "uuid": "9ded45e8-249b-4a49-a67b-4344e20ad216", "comment": "Malware payload", "value": "937f9a89b3e6df05b7e1f92fc0cc87da", "object_relation": "md5", "Tag": [ { "name": "2FTyu", "colour": "#5D6254", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857830, "uuid": "7661bf4c-eaa2-42e3-ae10-296b04b832dd", "comment": "Malware payload", "value": "3a2ad0e80729ff79d53caaf41eaab3ecf7ee87eea82787ee213589de621181e5", "object_relation": "sha256", "Tag": [ { "name": "2FTyu", "colour": "#5D6254", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857830, "uuid": "2dd8c2a5-cc48-4233-b3b4-6b29662527ea", "comment": "Malware payload", "value": "5a55dcd4b5fb470083817b415118db57f940eedf", "object_relation": "sha1", "Tag": [ { "name": "2FTyu", "colour": "#5D6254", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857830, "uuid": "a254ac82-23b4-4f2d-ad0c-dea1dbff32ff", "comment": "Malware payload", "value": "b5f8ff75a4c8366fa66134c0d759f51a4181ddfdeb4d67f0e98063430f82f6a66a12aba3c0a0d241d7946369cd0ec63c", "object_relation": "sha3-384", "Tag": [ { "name": "2FTyu", "colour": "#5D6254", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857830, "uuid": "45939507-5a03-420e-966c-7a9262cd01b1", "value": "T12F252320FDC8BFA3CF148534562BAE1991DA7F9C234AD0BA639675D6127873703A780D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857830, "uuid": "1ec9801c-054e-486e-97a6-854e6ea90b1f", "value": "24576:+uOUfC3QVIanV9RRYED6hMioVjGtfYV+ZwqH+O8w063tS:O3QV+6qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658857830, "uuid": "d7ee125d-992e-47b0-a7b5-47ec84fc3e39", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658857830, "uuid": "e0fa2311-5eb5-4752-88f5-07f936b6eaaa", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857830, "uuid": "60ccaa9c-43ab-41c7-9841-1e2c9193fccf", "value": "Kgj1sGZ.2FTyu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0623c247-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658843048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843048, "uuid": "a8d3c20b-9abd-43dd-a240-002016b02cf6", "comment": "Malware payload", "value": "a2ce7740f5aaee7c598fc1ce3877c654", "object_relation": "md5", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843048, "uuid": "4f4e80c7-0799-4667-ab34-bed131dc5d60", "comment": "Malware payload", "value": "3a39c8c0d9d72ce6b8238042231ab510963b4927099bd8f0b28e8bade52700e0", "object_relation": "sha256", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843048, "uuid": "9f881261-6526-4e23-bd7a-0dfdce24101f", "comment": "Malware payload", "value": "5a94dff213f498371b10b007c06bbc978c27aa87", "object_relation": "sha1", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843048, "uuid": "931c6dac-c118-4be1-8bfb-862af0025355", "comment": "Malware payload", "value": "de401d8445dee51573f6805bf75e599177da330593b198c68c9c0a674caffeb5b5a0ec07d2982b72b3e8d7429960eeff", "object_relation": "sha3-384", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843048, "uuid": "4023f533-69cb-43e6-9851-0d90342df163", "value": "T1CBE3294772E4407BE1B6963989B31606E773B8121B31DB5F036C427A2F737919D3AB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843048, "uuid": "c26cdfc3-68f8-4672-b0e0-ba744945c312", "value": "3072:s+KYUXl+ey1QElt1jfvuoFPVYxCh8/G2P:sKExeQEbt2DxCEXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843048, "uuid": "f6ef3895-f56c-426c-ada3-b0e99276374d", "value": 156689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843048, "uuid": "8e899b57-fada-4c0c-8c3e-26d372791c13", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843048, "uuid": "567b53dd-7efc-48ad-9a37-5c64fe04923b", "value": "launcher.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3559a51-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801651, "uuid": "e376af66-5a6a-4342-a40f-98624ddb9883", "comment": "Malware payload (Mirai)", "value": "75725ee7d55d785bc092892a1220e99a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801651, "uuid": "7a0d3bdd-e9bf-440b-a55c-f96616a78b2b", "comment": "Malware payload (Mirai)", "value": "3a4104a23b77e24fc1962adafe27eb3efef83d7d2e77ed6c64a62f39ee8d62f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801651, "uuid": "66ffda34-f45c-4ad0-8636-64fd31389017", "comment": "Malware payload (Mirai)", "value": "7960aba876f64846426cc93b4b368c39b472461f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801651, "uuid": "7b1b8670-5e40-46b8-b3a6-2c144f760a7f", "comment": "Malware payload (Mirai)", "value": "8a4be516e514a2d2efeeab86c394e1e265c99f9a027194be5150594ded5b66f7760bccd3310c7afd94b09ca5b0fc76b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801651, "uuid": "c80990a7-f17f-462f-97bd-3dfc17f366fa", "value": "T1D0C2DFEFDA44DD89DF4CCC7E50EE13251E847092738A0B9C32144C8D2B99977B84A5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801651, "uuid": "90145eca-99bf-44ea-9d8f-0ae47d662c0e", "value": "768:kGWhs0AICS8ywJ3gX5sK6Ee5GSrjr/BCWh:CDrCS8JJqe5Gojr/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801651, "uuid": "bf3eb028-d7cc-4a91-a2de-0c544b140d90", "value": 27472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801651, "uuid": "48b13462-f5d0-482a-93d9-de5f8cb5f5bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801651, "uuid": "36c99781-ba09-4573-b92f-48b34c664a18", "value": "infect.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db997a4-0ce4-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658841048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841048, "uuid": "019fa9ee-d9f5-4456-9d47-9550fa723ebd", "comment": "Malware payload (GuLoader)", "value": "6417d7316bd08b63965ae3174c821b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841048, "uuid": "f7906278-e335-4253-a75a-5a1d37348b40", "comment": "Malware payload (GuLoader)", "value": "3a4a2ec14175be12da686c53c9b3e826009788300628a528921fcc4be0043e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841048, "uuid": "8b8536ad-e405-415a-b37d-3273a50dcfe1", "comment": "Malware payload (GuLoader)", "value": "388b1617ccb4ece3a269e9e80011b4a629dd7c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841048, "uuid": "72f6117d-935d-4159-bb4d-6fd4f4af0a04", "comment": "Malware payload (GuLoader)", "value": "540d4199836951248f4dfe70cdee6ee2aa554d8c590cac742f41bc455e329880d7e0c7cdfb3cf4c22aa0288a87f4e141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841048, "uuid": "27187f56-e44d-4ed3-8e82-34961930098f", "value": "T193C4E0C2B400DEF8F92A963264B95D7A57523CBE62C0250DB58836535EF32937123F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841048, "uuid": "551b24e4-85c6-4a8e-aa87-ac774fb5a115", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841048, "uuid": "df84b500-9e3f-4f4a-99ef-ff8d5181fce3", "value": "12288:iq9fUw9bby8Bj6tUlAwxrcTW3dFD4kLUHzrBA:T9sw9Pyw6lwhWW3dWTHX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658841048, "uuid": "38f184b3-5208-4137-b12d-a611f3f62268", "value": 553776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658841048, "uuid": "8e94bc1a-977e-46d0-9ab7-715a825fc774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841048, "uuid": "e49f2943-6d8f-48e2-aa20-fe368043684e", "value": "nuovo ordine del mese 0002327778844495 07262022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540be0ad-0d02-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658853916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853916, "uuid": "8368631d-890c-40bc-8aed-f4aee848b39a", "comment": "Malware payload (AveMariaRAT)", "value": "21e5e1588469183614585941d12d3d71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853916, "uuid": "05269b0b-5c8f-4669-8522-b4fa8023421b", "comment": "Malware payload (AveMariaRAT)", "value": "3aa9f42db84b58ddfe400634f12ab36d48ba74f631e9b7e37294aadbd0a30aae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853916, "uuid": "d58ac4cd-73a2-4030-81df-f483c8c5c957", "comment": "Malware payload (AveMariaRAT)", "value": "51aaae7005e8ac160d0d45ad020698fe8820207d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853916, "uuid": "827eb1bb-7df2-4a46-952d-796d8b1377dd", "comment": "Malware payload (AveMariaRAT)", "value": "852ec013e97cb11048b759498cca4f2665713efc71b121e27467a47e26849d597ea3fba3e416ac26317570fc712d34f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853916, "uuid": "cecd0b2e-e2c1-4e81-b1d9-f0d2b0f6ea2c", "value": "T1D8D39E12B6AA4035E6B702B02DF93E3A8FEDFE311635C55B53D4948A6C71484EA39393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853916, "uuid": "38506fed-9578-410c-b748-cca7392af60c", "value": "ef804870e7f7c9feae20101fdf049fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853916, "uuid": "00188b3e-42c2-44cd-aa4d-cdc0b548071b", "value": "3072:+T9d8ENJxID078Ia0W2t8GhigMCeLg/Qj9LTJ:+pqENJy1Ia0lt8GhiNlg/W9LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853916, "uuid": "c177813c-889e-415a-813d-a393dbfdfc16", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853916, "uuid": "c8446090-e34c-4cbe-83ee-affbf6ca7c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853916, "uuid": "3809cc1e-9540-4949-9171-6a9db567d7b3", "value": "21e5e1588469183614585941d12d3d71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59d6bab-0cac-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658817224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817224, "uuid": "55292239-7e25-4634-8ee8-41e006e8852d", "comment": "Malware payload (AgentTesla)", "value": "c0a18bfe487a3c5ae7a3d5fab07c8d4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817224, "uuid": "8d1bb809-9dcb-48cb-9567-b07599fcb7bb", "comment": "Malware payload (AgentTesla)", "value": "3af9bae302903367a3bfcc8c729d13f86c97783cf5ada8bfe6f12c8ea2631566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817224, "uuid": "36dd4b93-67a2-44a7-a184-c4fcf6b02891", "comment": "Malware payload (AgentTesla)", "value": "30f8f25bdc12189163101ea5dd75e09a957ade65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817224, "uuid": "c401d011-5cc2-41d3-a347-274e503f6acc", "comment": "Malware payload (AgentTesla)", "value": "4b374dbb573e3b1cfcff5d5118618251d3edb0867deda2f708e1b40022fbea5467c49c18f800861e3f814654a1365d27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817224, "uuid": "527593df-7270-450e-a0b5-fa10e62257f0", "value": "T14DA423C91BAB0331DF7D2EED4AB369416239E08183B33A535133816F466708E4EB66D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817224, "uuid": "7b4c93ec-b08f-4dc3-863d-f2071fda3848", "value": "12288:LFfytbIpamDE2rD2YVuCZ8c4J/3x1ZbaVHha4a:L6bIImDE2rD2YVCc4JPx1twHja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817224, "uuid": "faada0d4-0f36-4baa-970f-4a6aedc60303", "value": 482993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817224, "uuid": "58e144c4-4250-4e80-8e3f-f5df3804f212", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817224, "uuid": "4550ef52-b020-4b16-988d-93fef307d7c3", "value": "Overdue for July & August Statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa546949-0d22-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658867939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867939, "uuid": "02e88580-7b96-48ca-b739-ae3965cc7c85", "comment": "Malware payload", "value": "c75ffcb1a96a4aa0700af898650aac12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867939, "uuid": "479f65ab-2ae0-4d0c-adb7-e74ad636b7ed", "comment": "Malware payload", "value": "3b0102e94a22bef70889a8ef737d1cd09e65160aea4b93d454e46c03e8fd3a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867939, "uuid": "06e93494-46a1-478b-b3ab-20f949a5fc57", "comment": "Malware payload", "value": "b52f2aa6a882847a83ccb8deb948ad99aac35960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867939, "uuid": "091799cf-4586-46b8-bf23-13fd7e34cca5", "comment": "Malware payload", "value": "503b2bd40700b809a93e52968b46f85ba861ae2d19944b4424e977100facbfc8f8fcaefe79da228b3d04cf4229b69e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867939, "uuid": "3703646b-b550-44e7-879c-28a72cd77990", "value": "T180345CBD620104B6ED6358B4C5289225F374F15E4B18B32CD7C8C6765F33B15AEBA389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867939, "uuid": "fabf1a64-bf13-40db-be0c-ea1db1050452", "value": "91bde66b67a29e5790ffa64580c66620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867939, "uuid": "a672e869-a74d-4aad-8250-a114e241a948", "value": "3072:Ka+uRyzho5C9KSyw3ozAeXN7sfbqxS+Pm2Lo:K2mqLNEuxSAm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658867939, "uuid": "816afa3f-22b8-4593-a9f1-90f14d36d9a7", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658867939, "uuid": "d74dcd65-62a1-4e9a-8e27-a0ad0a957c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867939, "uuid": "b8c9914d-c1ad-49d4-b5c4-89dddb442f1a", "value": "3b0102e94a22bef70889a8ef737d1cd09e65160aea4b93d454e46c03e8fd3a87.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677c1983-0cd2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658833333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833333, "uuid": "a0704b2b-94f7-41af-9aad-85d72e178583", "comment": "Malware payload (Formbook)", "value": "3857e6e4367630f48b4ddbe63daed124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833333, "uuid": "5e687eaf-1294-48fd-973f-880b259f6c5e", "comment": "Malware payload (Formbook)", "value": "3b35af72357dd7a40e3f4d878b05f21d99aee95ffa0b016465158723b4cd1e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833333, "uuid": "ece39198-ed16-4f23-9f0a-b22a30e83568", "comment": "Malware payload (Formbook)", "value": "665fbb42982e14992abb51eedbca71bb359807a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833333, "uuid": "347d054b-14ea-4dc8-96e6-d6794f11fb9d", "comment": "Malware payload (Formbook)", "value": "06e0f8462730b38443a6827381fe080a814f6600e5440d2698494e24642d40ccd845b4fa14385e394bbac64f21db654d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833333, "uuid": "90296f9c-a102-4266-85e1-ea18d842e7d8", "value": "T10335AE9C355037DFC8A7D6B9CD64AE64EA603966830B9A07B01311DD9E4EBA3DF050E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833333, "uuid": "ec41864e-f18f-427e-a164-65ace3c2450b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833333, "uuid": "8e030fb0-32d4-43d4-81a4-bc4a0fee8ff1", "value": "24576:Cw4UZvybcv8vojooNcpasTpuT11yxOEH:C6d8glN11ZEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658833333, "uuid": "e794e474-06c7-4c12-a3e6-3f173fe92724", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658833333, "uuid": "88d2d199-397d-4a1b-9715-a42bcbe6d833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833333, "uuid": "1b6ea4df-c989-4110-a901-e818d1ca90cf", "value": "GJRO7kgy6z57qTi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09e3749-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658843442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843442, "uuid": "03bd8877-0d34-433b-97b9-5ded31442faa", "comment": "Malware payload", "value": "06c8da5a548939b1a9e19416966d2048", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843442, "uuid": "4ea43bd8-252e-4d45-a795-d9f0559f6ac0", "comment": "Malware payload", "value": "3bb5af138221510e76cc45971465ebdd7f8efab1f505b4706fb61928b4b25933", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843442, "uuid": "3f543ac7-aa24-408a-9517-7beea3cafd03", "comment": "Malware payload", "value": "52a4ec414f9a08afe45378cae817c1a75c5905aa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843442, "uuid": "2473cbf5-7b17-4ecb-b556-c06e97427075", "comment": "Malware payload", "value": "78ac0af37a6cdc7a615210e61e9569c18127bfc545bf896c065198407ad7875b37a466fe8d9b43dab26227d590586ff1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843442, "uuid": "0b408ff5-1209-48ad-aa5c-5001b587037c", "value": "T1DDF42316EE7861BFD1425F52BD875257C176B53883AB2B46D72AC88D6C8FF32F882440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843442, "uuid": "82381661-b227-45aa-b91f-783bc4fab4c3", "value": "12288:S4Z8L2JTBgRrCI2OWEXTUONtpBFy9YjETYxPEFvppeDGb05QX3bWtP5jdvizJ563:11BgRK6X5ZyKjE81ipe6o5+4jdOFDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843442, "uuid": "43d17161-c6b5-42fc-975a-6c3886c5ea61", "value": 758003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843442, "uuid": "ba678dac-bc77-4405-8b1a-1374c6d7cb2f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843442, "uuid": "a49a4aec-556c-4ae9-a0b8-c1b96bf0c89b", "value": "SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549cea63-0d00-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658853058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853058, "uuid": "d6d2eeda-e8b7-4b87-bf0b-23b5a0c74b1a", "comment": "Malware payload (AgentTesla)", "value": "b70eae7dcad1bf8bc8efb0cdae14233d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853058, "uuid": "f58a5972-4ab3-415d-80f7-4149b5e5ea41", "comment": "Malware payload (AgentTesla)", "value": "3cdf585582fd700e93ed92a047164e75dd9c566077f6a8439cb22bcda6eaa1e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853058, "uuid": "ea3c944e-fad6-4b1a-bccf-4c061b8e3563", "comment": "Malware payload (AgentTesla)", "value": "c6410cc3db54d7be49b3a36fea07a47a6787e253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853058, "uuid": "15f991ae-0f4d-4d93-9fec-491b3ccf44d8", "comment": "Malware payload (AgentTesla)", "value": "d5ae1cdc645f5e21c77114bd12887f986542033f401728ccb913d577014435ef1107b32bad14065fd6f803a1ae69cc9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853058, "uuid": "53398a21-0159-433a-a301-f186293b2e54", "value": "T17F241B7E13C55D61C6EE41BD9092815811F1EB03C326A38F6EE348FD1B161CEFA2A9D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853058, "uuid": "28ccba0c-6df2-4ccd-a388-b690f9f24db5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853058, "uuid": "493f36f4-31ed-4f6f-8021-cd686d0c8ea0", "value": "3072:AKU2/+gFlT/0uTSs5mqUKlHCUn97Wp3YJa12IfSejUetm5M0tDF0M2HGhM9sQ:dUER/5shUn97Wp3JKcU1ykM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853058, "uuid": "94443839-1b00-4fcc-be00-b80e13fa7cf0", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853058, "uuid": "a174d75b-6f44-48fa-bb67-70fcb1eea848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853058, "uuid": "0801de45-ecfd-41b4-805a-a55c871f035e", "value": "b70eae7dcad1bf8bc8efb0cdae14233d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70eb672-0cda-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658836876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836876, "uuid": "b82a5df1-f064-4236-b3fd-20ad18752547", "comment": "Malware payload (AveMariaRAT)", "value": "097accc48700f7b1547fc16a1855e177", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836876, "uuid": "2ec73734-e04f-4262-ae56-fe503489071f", "comment": "Malware payload (AveMariaRAT)", "value": "3eb465b93b32006a3ab6df42841bbef09d8386a12df6254038c52b1eddf1c1cd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836876, "uuid": "cb439957-822e-4c89-b9f7-d17d57e5bf59", "comment": "Malware payload (AveMariaRAT)", "value": "e3547f8e95634fba5a9c016de388f17a5c753bc0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836876, "uuid": "8070d79c-8cf0-40e4-afda-fbfa46e6e11a", "comment": "Malware payload (AveMariaRAT)", "value": "9519243ab64b6b8dc38494d95a10e49e1672f06ab5f931ddcf68c55a5e732dfa0e8b023f6970bc243446f580331d8b75", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836876, "uuid": "dbfd6b05-c10e-4032-88b4-ddac271032e1", "value": "T13A654B69B201E0CDF96E94B1CEA0BEF455167C6ACB0B590311073EC5757FAA78B3A093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836876, "uuid": "704e66a9-5051-4169-ab90-8b994a1b166f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836876, "uuid": "f9090a2d-c339-40a1-87d7-5b16a97c858f", "value": "24576:rijw4UZvybcv8vaSexDhcS4L0Sdtb+C9B/x9ul8CHM:G6d8H7Lddtb+C9Bc8CHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836876, "uuid": "320f1ea1-e33b-4b5f-969d-6aff7f29f9a0", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836876, "uuid": "58795991-869c-4cca-86ee-93d2fe19d965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836876, "uuid": "9a6f6231-aabb-43a5-8580-f7caec71a6b9", "value": "SecuriteInfo.com.W32.AIDetectNet.01.11621.28456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda31caf-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848940, "uuid": "f4d01fb2-834f-4c8e-8d0a-ea6a40f28b84", "comment": "Malware payload (Mirai)", "value": "0a14d882eb2c865236bba2ca61a70c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848940, "uuid": "a39c1a39-d612-4bea-b7e9-cab8657ef1f0", "comment": "Malware payload (Mirai)", "value": "3f4f2367265ccba908af2dd7c24386de9a7272931aa71b076bb75a3f4da0da0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848940, "uuid": "8c52aad2-bd0e-406d-b67f-476be61d08b2", "comment": "Malware payload (Mirai)", "value": "9713b998c55f4f9c24a6ad552f835dae62a28eea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848940, "uuid": "00ef7ee7-eafc-4af6-8dbd-14b115d713d9", "comment": "Malware payload (Mirai)", "value": "3917a049b310b2e95834cb9d5782e3c316686e811ef7de9014a41549101432c1374da1df4bedb9aa1b6f53dd54f282d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848940, "uuid": "88760e76-c4f1-4a69-8ad3-1729e5810de6", "value": "T1EF432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848940, "uuid": "b66cc2e3-8a1a-4030-a7e9-5b3bb31ecac1", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwH:RqtmZPuutfbltZFBSJsBcfDSTFI+BEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848940, "uuid": "1d4e9757-9402-4c86-ab33-f682c892e7ff", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848940, "uuid": "d9278d21-7eb5-4490-b6c9-04f3f064e2a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848940, "uuid": "c9183ec7-c19b-4608-b133-17c49c0ed105", "value": "0a14d882eb2c865236bba2ca61a70c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1a34d1-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848244, "uuid": "d74a2255-6bbf-4b5c-a073-6fc511dcb484", "comment": "Malware payload (SnakeKeylogger)", "value": "a12f182e2a1c67b486fd2b363f40909b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848244, "uuid": "391d752e-f226-468b-95d4-3116df7cbcde", "comment": "Malware payload (SnakeKeylogger)", "value": "3fd707dbbf7a289a8cc02b0e3ae49cda05d20836991d0fc19723ecb42d4bcf76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848244, "uuid": "3d5747a1-69c6-4f6d-affe-ea2f5f74230e", "comment": "Malware payload (SnakeKeylogger)", "value": "1d09b6359f6b82f39339d26c6887976ac90649d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848244, "uuid": "3c25abdf-c651-4d6a-b1eb-ce4c6c336d02", "comment": "Malware payload (SnakeKeylogger)", "value": "9f0cabe1198fd2ad0412d8536aa884bdacdf39afe51e5c30a14f42e6becf1549fe85ef71b8dd01b0a1d430b08afebe9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848244, "uuid": "fdd0f311-d2ba-421e-a5c0-8a55696867a9", "value": "T1FDB412402B6ECB35D9AC47FD851961042BF0BB57B302D75C9FFDA0D229A2B950340EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848244, "uuid": "58ee3f02-fb67-4a8c-b09e-229173c09f3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848244, "uuid": "cf822360-3b13-408e-bd44-99d5e0c88f0a", "value": "12288:HjClv30aT4Jq82NNzHph13vNe+X/fi/fPUezc6wRx8:elvEa0q5NFL1fNJfGfm6wRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848244, "uuid": "33373d46-d393-4aea-9f8a-bb248af5db47", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848244, "uuid": "00230f6b-d4f0-4b4b-9912-9edc01aaaf22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848244, "uuid": "12ef9768-e66a-496f-96a8-0de46ccddf27", "value": "ORDER LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d6fa73-0d09-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658856815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856815, "uuid": "9bc4d22b-d25a-4370-a26b-915d96134384", "comment": "Malware payload (SnakeKeylogger)", "value": "98bea000c24acc0ff1ed611bdd0b2980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856815, "uuid": "abbfcc72-6266-4116-a9d2-fb745f91e861", "comment": "Malware payload (SnakeKeylogger)", "value": "4052a34c91edef0c3781f4ba9ee17d6efb3a2a630901c580108c94a794beb939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856815, "uuid": "0a3c0690-6b99-4293-a22a-f99ffbb50521", "comment": "Malware payload (SnakeKeylogger)", "value": "0189496b577fd7fa4f026e763e43d582a013516d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856815, "uuid": "112a49af-f985-4083-9857-bcfd056707ac", "comment": "Malware payload (SnakeKeylogger)", "value": "10959b3af0b6ef89ec9d9bf1f75aaaa8d1631ab6f056770d74afc561bfc55600683a4b3dd2623c5be430721a271d669e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856815, "uuid": "03b61bd2-5526-4f27-9d7e-9f8070171401", "value": "T176F45A35E78AAF58DA35E7F806F4D3605FA0AC1E9911DADD2BD233D54233EE14A19023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856815, "uuid": "d3b08839-2fef-44d6-919a-930fceb95f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856815, "uuid": "8c07e5f7-33e0-48ce-a209-473d16b60e0a", "value": "12288:lXEQuQjixgV2iNDUxv0xtYTh+RP5iusDY7JG/f:lpixgV1i9MF5oDY7Ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658856815, "uuid": "fc1df84e-b826-4fc5-9f32-b6e1a06a6d16", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658856815, "uuid": "195884e9-001e-474d-9855-2aea5cd1fc8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856815, "uuid": "3d7ea021-5e48-4ff7-a73c-0632bdecb993", "value": "final docs (ATD73).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fdafc3-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1658824759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824759, "uuid": "541c9100-af8e-4508-9b1d-66806d1ce549", "comment": "Malware payload (SVCReady)", "value": "222ebf178e46a2be70538ad88da0f26b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824759, "uuid": "85bfa080-bc99-496a-aa15-b39facb47000", "comment": "Malware payload (SVCReady)", "value": "41148bd3c83c0e9334cb8c54aee40a157314fa2f43ff82c780a661fb656675a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824759, "uuid": "8a1be79b-c982-42f4-ab86-6ae44070341b", "comment": "Malware payload (SVCReady)", "value": "d15e1e7eb03f561d7bf237f365dfe9672339439f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824759, "uuid": "de1345d3-e2f8-4bba-b87f-5c8caafbce43", "comment": "Malware payload (SVCReady)", "value": "3b75c96535f55f143a4d8cdb0b4795ff90902c65fbb85cc667b2f0a59ba202f41c50e89a581279bb6123a3ad49c01afc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824759, "uuid": "a00a1016-56c7-456a-994a-1475682e22fb", "value": "T15845BFB876047DD6667F467BDA96ECDC13B616229ACBA4CD8064BBC30563376FE02C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824759, "uuid": "851bd968-8c52-4d97-b340-08c2d98b84a7", "value": "24576:1M/BkIVYwdZpl3QEwgc/gTx3Q0hRejKEaqQm8PGKwE3h4L2wH/87/c9JdDUnWcaG:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824759, "uuid": "f50fd829-d2d0-4481-a009-317ebc843258", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824759, "uuid": "ee5e25c9-51b9-492d-bedb-16ed0c437617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824759, "uuid": "af1aac15-a2e4-4c26-afd8-589314ddd4f7", "value": "yA6F7.tmp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9197f5ce-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658851013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851013, "uuid": "cd2bd8a4-8e06-4593-8d79-4244abd3cb3d", "comment": "Malware payload (RemcosRAT)", "value": "e0a517853f4fa033187a58756c1330fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851013, "uuid": "e6e5791e-bdd2-445c-be97-843549695f3c", "comment": "Malware payload (RemcosRAT)", "value": "415f115399ed11ed0e11ebd468d3082bb1d0771c3c663fed23bd481a18a2898f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851013, "uuid": "8f12a9ac-4e58-49c6-8209-955e636d3efb", "comment": "Malware payload (RemcosRAT)", "value": "1397796dd3d0b2534ffea6317503fa6a183407b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851013, "uuid": "7f7e7bef-1494-409f-b4bc-ea6e61c1cc2c", "comment": "Malware payload (RemcosRAT)", "value": "bad7d5c2ddd7ba0acc0b92bb7ce99bdae2f069c612bd3afa145e65360fea1473543a49684abd3f9e03d34ce330aff9b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851013, "uuid": "0a80c94b-7c7b-4df1-929c-e6fa76fee510", "value": "T1A6F48C12FA81D03BE87259B04C39E77ABA78BD311A618C5B73D26F867970102B63571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851013, "uuid": "9e61637c-28d6-4208-b26f-7ce34f4b6548", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851013, "uuid": "856e2e2c-822c-4ee6-ae0e-7edc68636568", "value": "12288:GENN+T5xYrllrU7QY6hsrjeS3UVprYfELtx6uz6s3Q4KsfZV0tS6dq:K5xolYQY6GHeaUVxYVuzB3hZS0aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851013, "uuid": "502a5bfe-a478-4203-ab50-88a9c6540581", "value": 756052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851013, "uuid": "f4b6969a-bf97-459d-813c-8adfb5008340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851013, "uuid": "8f9861b2-d5e9-4c5a-8623-dc17c6319826", "value": "e0a517853f4fa033187a58756c1330fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2321a2ac-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848251, "uuid": "e6a75975-2eb1-46a7-ba5a-f7978dd60c78", "comment": "Malware payload (SnakeKeylogger)", "value": "6c8c3b31536714059de0a2ec8adcabac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848251, "uuid": "fee29305-fe6f-4aaa-823b-0666621ae285", "comment": "Malware payload (SnakeKeylogger)", "value": "41a319d16bfcf8d091d3584c721240253d5d4ae499f4cf39a6147ca540c28f6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848251, "uuid": "6a6a2d0b-e306-403f-868e-fb7f45f7cb9a", "comment": "Malware payload (SnakeKeylogger)", "value": "d4f3934341c15a9947a5e12ec96d4b9e75b75284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848251, "uuid": "05235b46-44a5-4516-a705-57b5b0b86fe5", "comment": "Malware payload (SnakeKeylogger)", "value": "e2a98ee600454a247d10905c23ebb665610c3a4b13826a927ad1494029819f15c90219d876adf957d3663a05cb69a2dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848251, "uuid": "e8906a6a-162d-4dde-ab7f-34db484b96e6", "value": "T1F2A4F16C37EC8A41E2FFDAB32671411087B6B842195BCE1D56C1F4292A3EA488D17FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848251, "uuid": "345362dd-4bc5-4f01-b346-0e9c91483be8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848251, "uuid": "08616f94-3190-4c67-abba-b37209b10d8a", "value": "12288:BT3E3HDei3oXA2jCXgXLz/HQOqzjW/NaZ:BTU3Hq6oXA2jBXHnqzjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848251, "uuid": "f971eb3a-4d69-4a49-a9ac-7a89415f90d2", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848251, "uuid": "876d88c0-2056-4532-92a2-4d0c95d41ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848251, "uuid": "b540861a-4527-46c2-9bdd-b6828ef52877", "value": "6c8c3b31536714059de0a2ec8adcabac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d7020c-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824418, "uuid": "66c7101f-527f-408d-ae49-4beb0617195b", "comment": "Malware payload (Formbook)", "value": "e411596e3e09f668247d72c0bd96bb18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824418, "uuid": "0eae94ff-0830-48f4-8c99-9e7620593f55", "comment": "Malware payload (Formbook)", "value": "41b14f39335372e62c5291a0934b0102d14e050a24d5f2f15c8a8e9e96a9e732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824418, "uuid": "459eef46-d8ce-46d1-a323-330e7f470e83", "comment": "Malware payload (Formbook)", "value": "bc61c049f98a9a08e152cec8b209fc173769a9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824418, "uuid": "52ea13b9-c182-4b8c-a775-bd62049e8a37", "comment": "Malware payload (Formbook)", "value": "80cecf6d4020e3f9f9fb25c8a2fb5fbafab2084531413dd700b2deca98452cdd6948bf4e97c5aad670a2f4ff435d338a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824418, "uuid": "35df2bcd-8bb4-489d-b9d4-31f6f8398e6e", "value": "T1B2B4129C12F84B0CEAFB43F52CEC92152BB5700995D0D52BBDE122DEED647B48661B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824418, "uuid": "d821d2c5-0c96-44a1-b72b-b9adb17ebf1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824418, "uuid": "421c161c-16da-4ab0-b050-8e201cc4c967", "value": "12288:SCfP2iN/2iNh73F/xsu+tNizUycljZcdF5K2wGjImdFD1kPRxliW1:tfP1J1L71KcUjnc5Dwwd31kPRrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824418, "uuid": "17eac455-b236-4155-9560-e78992bb486e", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824418, "uuid": "8317a5b0-4b18-4464-bde3-1e2718969d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824418, "uuid": "de9293db-edb5-4337-bfa2-52cefb3c0e24", "value": "ctm$18,500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c24a2c2-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849206, "uuid": "0abfd08c-2e20-4aec-bee8-99aeca662d2b", "comment": "Malware payload", "value": "4e8f7096d498e1b3abfda0751ccf97a6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849206, "uuid": "81989705-d058-48f8-aa37-89940d162dc1", "comment": "Malware payload", "value": "43368b583a5d2c5c482f1badb07da0cfc8d0de1dd4e0f45c3a5f15410fa49e15", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849206, "uuid": "0148ed8c-5a66-43ed-85f5-2834cf9aea28", "comment": "Malware payload", "value": "6fbbc5e7276f3849b7a75b8f1dce9f63dffa993b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849206, "uuid": "0d177b2f-79b7-4561-8f63-b11ab2bf5fdf", "comment": "Malware payload", "value": "03a6739127dc4022ae4f5a5def1c3649f249c57864b76c1f20dfb5691e374944c81ceb79d8baf06f241ae60e39194c1d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849206, "uuid": "475af6e2-0517-4208-b2e7-0675ee33d612", "value": "T13943CF2A16A047C7E8AEE5BA1B5680554354FE0BB5F6B0323C8DF619267005EFF73681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849206, "uuid": "d1557455-1003-4b80-852f-938c379fbcb6", "value": "1536:jIWbSQPujUjYt/gCny2wQrvwqSK24RdwdD:jNZuyYto6Zv1NRed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849206, "uuid": "3ae3f2a3-75fb-4b39-b1a8-af977bb42296", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849206, "uuid": "672bbf0d-3daf-41fb-a831-53d99493eda3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849206, "uuid": "75a6046d-d9c0-4c22-889c-49f7bc55ca4f", "value": "DS Pro Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b916205-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848238, "uuid": "213e2326-5e48-4eb2-a51c-25397fa97415", "comment": "Malware payload (SnakeKeylogger)", "value": "704c89a10fe40a22fcf9e12ebbb4da32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848238, "uuid": "4615a9d5-4574-435a-9977-2ed77634fd68", "comment": "Malware payload (SnakeKeylogger)", "value": "436502367baa8f7a602eeffa423d0604a76d8480136c3b7d44610354f32b2538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848238, "uuid": "090abe3f-624b-4760-bfab-b8e5a7d1e392", "comment": "Malware payload (SnakeKeylogger)", "value": "5d00be7057f91308062cd3ff89e3b579d4b5da83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848238, "uuid": "5becbac1-0748-45f2-966e-d23062be6dac", "comment": "Malware payload (SnakeKeylogger)", "value": "b333febf7f0e98dc753ca39604e03fce5ce216c3962bfecab692e9142f2f0400d370486612963973385d429dc42a2783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848238, "uuid": "ce7275b3-9294-461f-93b8-cf6227ceb1cb", "value": "T136259DAC365075DFC86BC6BAD9A42C64EB60347A830BD643901315EDAE0DBA3DF054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848238, "uuid": "507b7cb3-d15a-4cde-b690-6ae60fcab29a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848238, "uuid": "0bc201f7-610a-4ee4-97e7-dcffa975ba42", "value": "24576:ww4UZvybcv8vMMsNDYHcrIMhdmaMxR/HY:w6d8bSDYHcc2dmaI/HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848238, "uuid": "6f1b585c-ab6e-4244-8b22-be020d97886b", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848238, "uuid": "b8ba04b5-175e-46df-9039-d5812c9b1d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848238, "uuid": "6c59eac8-4a91-47a3-944e-3b592423c9ff", "value": "FYA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0803406-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801646, "uuid": "8a2e376c-829d-43cc-a316-3e140fcce027", "comment": "Malware payload (Mirai)", "value": "d61b8e67577d68c434000ae6e91286ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801646, "uuid": "c093615d-fb3b-43e1-a8a9-4f2364033b7d", "comment": "Malware payload (Mirai)", "value": "43e306c6872cd4c0966795fcb05cd1e8fe744ecb38a3f6bce3692d2af215e871", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801646, "uuid": "2d8df20e-3a29-46d6-b983-14faa0c42864", "comment": "Malware payload (Mirai)", "value": "07a2f9a649bf88cef7fd96fae0ab72244ed25d1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801646, "uuid": "2cf6c83b-bac7-45f1-b54c-51bc5a5e5f13", "comment": "Malware payload (Mirai)", "value": "ca719e1cf040d89fb780c98d28a991bd454d304daa5bdc308c7a1e9b8172b63cd449b288e1fd2bc23486ebb2af1bf4aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801646, "uuid": "fa16be97-117e-4110-abbc-92dcc113acfa", "value": "T171C2E0B0C00D1159C852CC78F3AF8D6BFDA387AA1EAF1146EF2565C60C87920E568B39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801646, "uuid": "bb67b6a4-de82-4de1-a6df-9388d0a7394b", "value": "384:MYu4dLP9/C4ZwoaWchrIBOHlE4hJL39PgxJHtCcQDKZQvPOM012LldCWDz8Ovq+a:7x1aURZOeO32xJNCcyKZQv/0g7zNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801646, "uuid": "fd47c10b-41a1-4238-8a68-c9832518127f", "value": 26940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801646, "uuid": "f0ae0485-951e-4789-9aa4-b645942a0f7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801646, "uuid": "ae17d49f-4dc6-483b-8c78-084b6fe3fe42", "value": "infect.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f073d8-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658851125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851125, "uuid": "3d26f24b-7220-4482-9267-85d1f8ee3877", "comment": "Malware payload (NanoCore)", "value": "216da2f5569f547a153b2cc501980502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851125, "uuid": "5978ad08-b84b-4547-bffe-74edf7e71112", "comment": "Malware payload (NanoCore)", "value": "442bad09c1091bfbe52a4b7c5b0a39b2691f0b56eedff731b8e90aa6f80cd388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851125, "uuid": "f5c95dd9-27c5-4dd3-8de8-a7d3bc1adbea", "comment": "Malware payload (NanoCore)", "value": "7ef12e1238bb11ee4337027fa86545420bb81614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851125, "uuid": "0eeeb6b4-b70b-45cd-a8b0-9af579666feb", "comment": "Malware payload (NanoCore)", "value": "2cbc9aaca027942e698fa1619e4b7bb3ea9dbde57f9c9952e534aca84d9c961be340270e3c3538bc182c95a4635fdc6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851125, "uuid": "5080d51e-dbb4-4a83-b74f-ea88a13ebe94", "value": "T163F49DAC361076DFC867C976DAA82C64EA607477930BD203A01315EDAA4DADBCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851125, "uuid": "40276290-6831-41c6-a61e-178854aa5bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851125, "uuid": "515f8d00-6273-417c-aded-8c7e8fc02c15", "value": "12288:fxAw/UTsZSY30cfVQ4R2E43Kcef4NcS/Y/AffKySzmmah9fLcrXX2tx8obprsG0s:pAw/UTs9EaGBtef4NcSqWKGAWtxvbqYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851125, "uuid": "2470b8f2-2894-46bc-8c8c-2be300f41e00", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851125, "uuid": "467d3de5-22e2-46e4-852a-7a1ecdf8b584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851125, "uuid": "0299254d-9b3b-4dcd-8e5a-da0c021e4502", "value": "216da2f5569f547a153b2cc501980502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87363f2-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849387, "uuid": "7caf6ace-92e5-4808-96ed-0a73dbd1aff6", "comment": "Malware payload", "value": "51688d32af33405f9761d5fee339b9b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849387, "uuid": "39f15c55-3b14-4abe-b32c-4a01b7b27b9b", "comment": "Malware payload", "value": "4485d4e3c543380937010961e445c30a8b5f26505caf078c31f5de1fa84645d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849387, "uuid": "d51f965e-397b-4cf9-9840-e5973e04a46b", "comment": "Malware payload", "value": "a4d4a56309ce9a04607c015c23396532a65b858c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849387, "uuid": "5b9accb7-07a9-43c6-911e-0ad6b8d5c9bf", "comment": "Malware payload", "value": "39dec1071dc08e8acf7ad383b55f7e9894291e311f122acd944b58a7c44cfc18a6bdda13a58a22e1db0ccc8619cab9e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849387, "uuid": "014eff33-50f6-4114-afcb-d77f56368a4a", "value": "T1E9825BDE9D34A68DCA2061A627AD9E8867F8552F9510124E382D71409FB2D40EBECF7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849387, "uuid": "3ea45ae2-c7f7-4af3-9453-7014489c6de9", "value": "384:FArFZjBcGM3Umx5V+7qiWnoHuWQn/wM6JgVhHc+:6rTBclzV+7qiaonQ/wMog7c+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849387, "uuid": "ec5650b0-4b02-4a52-8896-18790db69749", "value": 17744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849387, "uuid": "9f6c6f28-0a09-4b76-96b6-ebb18630fddf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849387, "uuid": "011ab2e7-047f-40c5-839f-fa4d7a181d45", "value": "UdDEnnNTew_vj63006ned.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3779dd84-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658851292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851292, "uuid": "1783b403-c773-458f-95ef-0bba9a2b7d53", "comment": "Malware payload (AveMariaRAT)", "value": "960be0ebe6eaf853788be74c4256a05e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851292, "uuid": "1c3f8687-20ca-4f7d-b532-e8312beac9db", "comment": "Malware payload (AveMariaRAT)", "value": "44914f8910e1d09003df5fa5ab1545e47ea331aa45d5a3d4ce627907eaa28fbf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851292, "uuid": "8e1672a1-fd15-48a0-8b45-6504fc5dbb96", "comment": "Malware payload (AveMariaRAT)", "value": "706c002edcf16ab77d0fddb87da85dd897555c65", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851292, "uuid": "4ca45b42-733c-4252-9743-2b94aa9ad997", "comment": "Malware payload (AveMariaRAT)", "value": "178340ca9cbf13459c639656d8a521e9685a5ca7e72acbfadecf3aa1939849259fc124df7fe1f28b065002b39e76f868", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851292, "uuid": "bbe022a5-7595-4301-8d0c-a2a8e75cb2a4", "value": "T19004AE0A16873BD7D4CA84F10C52BF25B36EAC25E441F70A768AB236F57B3E9941394C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851292, "uuid": "94bc972d-1e8f-47fa-8c76-821e87087ba8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851292, "uuid": "ce39a9bf-cbcc-42d5-b6c7-5b43f1ce8fc3", "value": "3072:D2slKEC3cKT8N2YW8aU98oY9WYHRm3aQYHXE8iIQDs9kRD6UNbM:6sPKu2bUIOaQuQQ9GD6UNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851292, "uuid": "0c5d1209-98e7-4da5-aeff-bf6c6c86a25e", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851292, "uuid": "23b71232-36c1-4a1b-a60a-8e7ed2901318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851292, "uuid": "b385d87e-3862-48f6-a755-ce087287078e", "value": "960be0ebe6eaf853788be74c4256a05e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23a6ae4-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827016, "uuid": "29d5e112-2411-464f-972c-7bac778d31f1", "comment": "Malware payload (Mirai)", "value": "86951d55a3b4ae82edd3fe111279b7d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827016, "uuid": "2fe94442-57cc-429f-8abc-8821ee57e5d6", "comment": "Malware payload (Mirai)", "value": "44f5b34ef8beffac75f75ac0568a852181557d84e7753326c28ed51a87801597", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827016, "uuid": "039d88a1-7abf-42a7-a513-aa866ed4b2b1", "comment": "Malware payload (Mirai)", "value": "be853c7c724dfeda64e6aa6f35e3a7600648c32d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827016, "uuid": "10b324d7-8a8b-4c2e-8e99-b4a682b1c49b", "comment": "Malware payload (Mirai)", "value": "8ac7821f907a0e9a32beb71ab3cddec94ff9bd4ab2f368356088f289a28966c254922bd09c2a5cd5c31a9387da50bf42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827016, "uuid": "b7ec54b8-a8d9-455e-8d9f-39735c4f274c", "value": "T13AE2E0F2D177867AEE495038440C9784B431246E960B36BF88DBE4FEC5EE9CDB950AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827016, "uuid": "4e2cd84a-6dcb-427d-9f48-f48724e15755", "value": "768:a5kcUKzjCdqfnEYyXA0BZbnUXZ/QaYU/bKwhcXuvJUx05w:a5kcLzjPMYyXA0BZb/aYU/WweUu2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827016, "uuid": "edd59775-a633-4457-bbeb-1f538877fc86", "value": 34220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827016, "uuid": "a3b70e1a-939e-4aa0-b462-87d469c1cf61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827016, "uuid": "9d10435c-d8da-4e33-b907-56692ae93b4d", "value": "home.x86_64-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65447a08-0d00-11ed-93bb-42010a9c0043", "comment": "Malware payload (Zyklon)", "timestamp": 1658853086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853086, "uuid": "73b90e70-53fe-45bc-be75-de66388bb36c", "comment": "Malware payload (Zyklon)", "value": "99dd44876baa90714269ed17e412ea7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853086, "uuid": "13fbfeb1-8391-4575-b0a1-387533af807b", "comment": "Malware payload (Zyklon)", "value": "4501d85e86cf567897f6c4ed7b1f7877cee415f92760566404b1f1daf8f4d6e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853086, "uuid": "7396671b-620d-4caf-b669-ad34554a1772", "comment": "Malware payload (Zyklon)", "value": "4787230a896e666d85e77c6e71e8a347433b5098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853086, "uuid": "d0e5ed3f-d809-4577-8c7d-66c513d70d82", "comment": "Malware payload (Zyklon)", "value": "ef3813b43b839cf1440419ab150a37908a6fb9b0da36e0195eefac727e6cc59e586441a0d8739b7ff9c47bc4f8c4a820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853086, "uuid": "4cff2b30-b8ee-4572-b7fa-1168bdef12c9", "value": "T1E2054F597A0B4FB6DE4E05F0C392B9499F20DC66BBC0D4E629B15CC9A60D9C2EC4D48F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853086, "uuid": "da4fa031-dacd-4836-b41c-57187bbaee35", "value": "12288:2cRbFueFELgMDuWzvrRUxI5aknPnFaGqXfu7YQLpI55hd8olHVK5Yp181rKxy6PX:JbFaLUSrRsIkkIwJp4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853086, "uuid": "9f73f108-efc5-4d5b-9d9b-dddd3fab9d8c", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853086, "uuid": "76f9ad20-f5ef-48c9-b8fc-ce5c5c7a8b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853086, "uuid": "802b8a58-3e9b-4c99-8a8e-4a34db708904", "value": "99dd44876baa90714269ed17e412ea7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cae902f-0cd4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658834120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834120, "uuid": "3ef797cd-7eee-4711-92ce-d3e17a0efdbf", "comment": "Malware payload (Loki)", "value": "6e5ad8c215916c6179ed260c4ed50ea5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834120, "uuid": "74741c94-5cfa-463d-b64a-78768933f3d8", "comment": "Malware payload (Loki)", "value": "452bf280a3a41e742c7b0abbd602314e3406017fff1543dadd3b46fd481dbd71", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834120, "uuid": "f88093ea-e3a6-4f9e-a9cb-da699e528a77", "comment": "Malware payload (Loki)", "value": "633a598ca2288a9fd5119e15fd193a4c1e85ab25", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834120, "uuid": "1c42f131-b054-4831-9a76-94f79d92d4c9", "comment": "Malware payload (Loki)", "value": "5eef8f0405bd2decdaca720fb9c58df188ed8594daf9741a7eaed51e56bf9ca5d87840ccae0709bebe5efc30306f8484", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834120, "uuid": "a22f22e7-6181-473c-9e5c-db542d0eee01", "value": "T1EF03F167BFB1F0D1E9C9E5E65A6A5786E101F6B49C58363B380A3A8C4320DB83F4C095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834120, "uuid": "4baf1150-6843-4e5e-85ba-9e68e5ea8002", "value": "768:tg5g3KlU4Ej2GG/768e960LSdhcU7pbP/NRVfa+13CwkfOPKYvYg/SeXjq:tg50KpEj2GGT9edLSrcU9bnNjfa+13Cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834120, "uuid": "9117d672-0359-4815-8403-01c201962084", "value": 40500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834120, "uuid": "caac8d74-40ee-45eb-8e79-be25e49c6cad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834120, "uuid": "11c5bf4d-5617-4211-ad8a-1dfffef5e253", "value": "Narud\ufffdbenica_(P.O_60463402)_ATINEL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb59d37-0cb4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Zeppelin)", "timestamp": 1658820487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820487, "uuid": "24da2a0e-2a3a-4be4-8917-df4e77939515", "comment": "Malware payload (Zeppelin)", "value": "ad62332b9fc5fb70fa1cc2913812154a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820487, "uuid": "4728f159-e00e-4602-ae37-f1863ae9de49", "comment": "Malware payload (Zeppelin)", "value": "4728a3fa4f94d7a09e2dbe21d12ae84543042ce88ba4ea11f3fb3f27490a4933", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820487, "uuid": "44d57309-6634-48fd-bc22-9400196f1bb1", "comment": "Malware payload (Zeppelin)", "value": "e3fd29cbbefcae39190af5262852446533642daa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820487, "uuid": "a82a6767-1b67-4258-a547-29eaf76571f5", "comment": "Malware payload (Zeppelin)", "value": "b850e049ab4eea7d91dd5ef1aeb0fb27d0c46f5effe1b3a04cc864c827510bc4ee2a4b6661f5b74dafe2142359ddb914", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820487, "uuid": "c545b965-dcf0-41f0-823f-5d7318cf4b7f", "value": "T151248D36FA808433D1731E7C9E1A56AD916EBA302F2C14477DE45E8D9E3E3A2652D1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820487, "uuid": "d1cd9655-dfcb-40d5-bc27-ff509dc413f7", "value": "8acb34bed3caa60cae3f08f75d53f727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820487, "uuid": "1cc749c8-54eb-46c8-84a4-234d128d1de7", "value": "6144:QyJE1yd7WiJmcyfpHaShzh04DQFu/U3buRKlemZ9DnGAeIS+giR+:QU/d7WnvtLhza4DQFu/U3buRKlemZ9DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820487, "uuid": "5022dd7b-b869-40d3-9040-fff6af39aab3", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820487, "uuid": "35727c0b-40fa-48d5-8fa4-dde31a2d23b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820487, "uuid": "95a91076-ddf8-4607-87bf-2411be4262fd", "value": "ad62332b9fc5fb70fa1cc2913812154a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bdeff7-0d0b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658857807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857807, "uuid": "8a94c8b4-737d-4f01-8578-7a4a20525165", "comment": "Malware payload", "value": "fdc86c0fc9341c6b1763e594cea780e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857807, "uuid": "eaeff91c-7d74-43aa-8fca-eb718d77d67a", "comment": "Malware payload", "value": "4825f7750e2edcd4abaab402cabebf6dbbe65312ea200d5576de799b3facf86a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857807, "uuid": "aa35b4b4-3eba-4ab4-b1ed-e275655781a5", "comment": "Malware payload", "value": "20f60c0462b3cf92919c858616670efdf42cabc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857807, "uuid": "16a3b18d-1367-4bfd-b324-a279d27999e6", "comment": "Malware payload", "value": "93607421ff7fdf9d4cb0d35f58700158e3470f6a6ffb2aa7bcdf4c20d85085a5e807c73dd969479a37405c27c6b078d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857807, "uuid": "f6f2d0f5-29b4-48bb-b566-08e9af7e82f6", "value": "T1F222432EAFA84737CB6FC634D8234980E45865D32572DFEA47E2634D1D172817A87F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857807, "uuid": "7a80f4c5-5adf-47a2-9db0-77882d5749cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857807, "uuid": "1b9b98c6-e2c5-432f-9a38-ab1915fc45bb", "value": "192:3f94jfUh7Ik82X0CegJgvp0UEgjpdM1wKJvzFq8iFG/a:WjfUh7k2ECjNzFq8iY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658857807, "uuid": "4ca1912b-f2aa-4ba8-ac2c-0b832fba86ff", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658857807, "uuid": "4104b661-b2c7-4101-9372-4df409c0dac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857807, "uuid": "3e700c3f-f7fc-4a2e-a0cb-8a7d4b2df197", "value": "SecuriteInfo.com.Trojan.Siggen18.27372.28537.12907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52dff63-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848899, "uuid": "b78c7538-b310-4f1a-b683-e668c5d73139", "comment": "Malware payload (Mirai)", "value": "42829d7ec4bcb4db8f3e5a2b70ad211b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848899, "uuid": "b711b370-7d94-47d7-9d60-3b406d4cc0fa", "comment": "Malware payload (Mirai)", "value": "485e6812e25da821f7b945b21b29ea8c61ba2b9e076a7aa9d82a9b73494c7028", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848899, "uuid": "e3456f2b-574a-4ec7-9f58-fde6c823d0ef", "comment": "Malware payload (Mirai)", "value": "0b61d438650174ca54a4dfbad4cf93c61f098688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848899, "uuid": "c9d37820-6824-4b48-9807-35e097cb5f77", "comment": "Malware payload (Mirai)", "value": "26f331c3b282f9c47db45f1e7b4051eb79814f92cdcf11143d52a0e749432d50ea41fdcf6f0bc79baccc868df58d973e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848899, "uuid": "903b09ad-9b28-42d9-934b-29304263334a", "value": "T182B2C0CC61943484C98D7C7C578D4AA74F6CA180BAED8B26E350CD98B3BEA4B785D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848899, "uuid": "edcbcbe5-4cfe-4406-8e97-d87c4dbd136d", "value": "768:otrQlS07dEv0UXqUhvQE+CXQKMQKCXBpOZqqWvH:iQlS07FUXqIYSXQKquCqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848899, "uuid": "1155b3ca-ea9f-4d64-a68e-6f107f7c7d02", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848899, "uuid": "78167d79-4fa7-4f4f-aff5-722209e4be78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848899, "uuid": "7383bdf0-d88e-4a65-9194-5b3978ce4f1e", "value": "42829d7ec4bcb4db8f3e5a2b70ad211b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a12001d-0cb1-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658819164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819164, "uuid": "f910b3b0-045b-4f42-908d-193c5a08e2c9", "comment": "Malware payload (RedLineStealer)", "value": "05f0beffc945ca0e1867a79ca08f27c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819164, "uuid": "67bad630-6188-47cd-8a66-f05325d76fce", "comment": "Malware payload (RedLineStealer)", "value": "48a86f9e92d5325ea6222df4bb2ee689bfcc55d884578d7fa2a46c8bf75a150e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819164, "uuid": "d1a5de96-1c2e-4d12-8598-640387bfeeaa", "comment": "Malware payload (RedLineStealer)", "value": "f0e31ce7eab831603f930b83f5d23b8e45489e46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819164, "uuid": "a187cdb7-c239-4141-af17-fea605116927", "comment": "Malware payload (RedLineStealer)", "value": "0adf00a6b5652b37eacdddc5ce29d0d125260b48aa9319922a129763ce5a57efc96c1faa7e34d4b97bdda722fa2be193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819164, "uuid": "c623b65d-7ff1-4935-bc2b-3382b9846183", "value": "T1B444F12076B0C472E1F3063378B492926A77B8137675958F27A82F3D6F206C05ABD75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819164, "uuid": "bb44dfa1-6e83-47f2-85d3-59eb15bb22e3", "value": "5b1496fe4917fe7c0dee09867ced7d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819164, "uuid": "dc2c560c-66ed-4adf-8641-bbc242ce60a4", "value": "6144:8FQYLjA+oSw4vqs9CgWcV/Fi1SCuQW3Wx6b39m4/:8SgjArSwGX9CgW0/FivW3Wx6b393/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658819164, "uuid": "6ae83d51-769f-444c-b961-763ce58bf130", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658819164, "uuid": "4a4e4136-f438-49d4-9b65-0d32d2bfcbd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819164, "uuid": "0f044481-5896-49cf-8178-663aa7f3b7cd", "value": "05f0beffc945ca0e1867a79ca08f27c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cc5e1f-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Renamer)", "timestamp": 1658828742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828742, "uuid": "fe5bd5d0-b00f-4d4a-85dd-6b550f2290e3", "comment": "Malware payload (Renamer)", "value": "58e6f101a4bab8433ca50401915b6db2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828742, "uuid": "adab850d-a5d6-4974-a03b-4ba9810263ba", "comment": "Malware payload (Renamer)", "value": "49216fef468c991eebdbf0b125fc962cf72782fc647c73b17cb2af979490e98d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828742, "uuid": "677b3987-1b8c-4c41-8ae3-c5fd7dfa68f6", "comment": "Malware payload (Renamer)", "value": "8e8a50aa670aeec4223b676cec302bdae4f69faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828742, "uuid": "b919b558-e444-40ff-8571-8d1a099c558d", "comment": "Malware payload (Renamer)", "value": "609424fc598da24d7d0e53335e4e6e6e7e4036721c51a5b97ff3d50eb59fdc3cde8ea4787a5ce6546db94fcded66ccec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828742, "uuid": "545cc8f1-dbff-4dfa-96db-5dd6a9046255", "value": "T1E185D0AC752075CFC86BD6BAC9A82D64EB60346A530B9603902305EC9E4DBE7DF054F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828742, "uuid": "e1744e77-3b94-4a68-b018-1132165ed253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828742, "uuid": "d90786e8-d4f0-4a8e-9705-2b38cc756e71", "value": "49152:W6d8vcfefZ5MBjI5LcqyUja7PI3I91Hz:W6d8vBhi1IJcj5w49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828742, "uuid": "49bc80c8-19ce-43a9-bd43-9af06989c04d", "value": 1754624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828742, "uuid": "6d935d50-e8a9-4b4c-81c9-9eb8a86d7375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828742, "uuid": "c7695aef-f692-44e8-9939-73f05249f2d1", "value": "SecuriteInfo.com.W32.AIDetectNet.01.6268.21634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a079335-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849202, "uuid": "b95099c4-41b0-4e75-ba21-e9413c4a4dc0", "comment": "Malware payload", "value": "e090d494840ab54bd2816ff50efb62ae", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849202, "uuid": "cda066b4-6f5c-4b38-a412-b5488e884888", "comment": "Malware payload", "value": "494f7dd7556107ed64b75bce7a10ba38bcb0e8b9c2305643dc0757584fe60075", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849202, "uuid": "ca77a63a-8fb6-4dc3-a938-b0fd7d0f590e", "comment": "Malware payload", "value": "dca97c162e05dfdee8a3629eae1552d0c8b1d909", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849202, "uuid": "ac179f8f-cea9-40cf-a0cf-f89fb7cc9ba7", "comment": "Malware payload", "value": "b76b8b61e3aa83467c00ea6f67a2f75031e283696f24be45b232349ccfab0a27bff661ab8d4517400ed99326596598a0", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849202, "uuid": "9bd80fac-e57e-4fd4-ad50-b446b667f907", "value": "T18543CF0D631B8AA2D66916FC401507B019B4FCE9889F5CCB2E117EFF2635219B960FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849202, "uuid": "61d4cbf1-ff95-47f1-a8d2-3c06c72b34e6", "value": "1536:xbwO89rzeos9f4hwUxvV9w1JNQxIO9II:xU59qoAf4myVmJNQyOiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849202, "uuid": "66ab1c07-e9ae-4aef-b6fb-8eda6460c489", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849202, "uuid": "558ffbb7-7c24-46a6-b8e6-547d3be6b868", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849202, "uuid": "6ffa5a0f-8504-4431-86f6-5ad8e597de84", "value": "BL VCLHPHPZU1558922.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed1262b-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848915, "uuid": "32e52c75-242e-4e4f-8395-9ce67f3f59b0", "comment": "Malware payload (Mirai)", "value": "cc03dbfbee2b54fcc96257416c7cdae3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848915, "uuid": "440767b0-4710-4a96-94d3-0b412f84baec", "comment": "Malware payload (Mirai)", "value": "4a59ce9879cb8781d0aad01211b920c57d027f85b0d975dc914abcf54dc6d6ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848915, "uuid": "3011b8bc-a148-4f34-83ed-8d8d2f0010d1", "comment": "Malware payload (Mirai)", "value": "d09ff18304cb3ac1caca0da1d67689c47904f51a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848915, "uuid": "c47a7d88-2120-47ce-8591-56a35dd1c5fe", "comment": "Malware payload (Mirai)", "value": "b7eb876a6cb2e71cd2cb363b62d6d6fb4b5eb111ea8486ee9707b492dee53de507ba626cabac4a54ceef7ada04aef814", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848915, "uuid": "9dd1e217-4594-4233-ad09-23b7b058d6f6", "value": "T1AF82CF3051AF74F5DBE10435FAAECEC6971A0BB8D1FC369317596B78C98610621F82CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848915, "uuid": "7cec2d80-b481-4219-84de-cbf6462f1ea1", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMajdhymdGUop5h5lc:6/V0P6+kom0tVAoNvm+to15s3Uoznlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848915, "uuid": "612b633c-b076-4941-9008-a1923c5dc7f0", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848915, "uuid": "58117891-dbd4-4972-9a5a-4c5e0bbf59e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848915, "uuid": "4ab0b2a7-46cd-4af8-9e02-23efc840cfa7", "value": "cc03dbfbee2b54fcc96257416c7cdae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064d7854-0d0c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658858081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858081, "uuid": "61077aea-d803-4a93-ae6c-3156db6a59a2", "comment": "Malware payload", "value": "6f02b3eb6b2cf1f217e44eda13ab6ef1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858081, "uuid": "135ac0af-dff3-4466-a164-d7df1eb3fce4", "comment": "Malware payload", "value": "4b86c52424564e720a809dca94f5540fcddac10cb57618b44d693e49fd38c0a5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858081, "uuid": "90c79abe-3d6a-475f-a1d2-dba1a3d088f6", "comment": "Malware payload", "value": "3c6f731e481293d7f1b528d04dde15b27a1dc007", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858081, "uuid": "589185f7-19ac-4f2a-8066-6f09054230a8", "comment": "Malware payload", "value": "621e550e91c9ef2feaea2aaf77e847482c6d8ad47a75cc44b9a673ab88886f641457d72fe0f18ac503e94efda85ed26f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658858081, "uuid": "44edf364-10bc-40ae-b9c2-98729f0f9e32", "value": "T1429423A9851F4290BEC468F701BDCC50F6C94E21B807A271A7BB53D7278E72A23C56D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658858081, "uuid": "5e59bb21-d9ad-4e6f-afcb-736b0c5882fd", "value": "6144:vJmm9Sn7Q8tEcK5FvovkFNr8KeQc2KSSchTM92OBbCBUDUgHBJdP0k54BlATasS3:a7dESnVJSSchY928b9J2A4Bl29Etkp8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658858081, "uuid": "fd8b35f2-9b53-4c0e-9b32-b90efd2b15f0", "value": 420425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658858081, "uuid": "f0aae354-fb06-44d5-8a9a-020698d9876e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658858081, "uuid": "bec974c9-2f83-486d-a600-abb051d3ce6e", "value": "[redacted]-invoice-07.26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec953f2-0d02-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658853854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853854, "uuid": "504e203e-a267-493a-a2ce-0716da291b10", "comment": "Malware payload", "value": "a92f13f3a1b3b39833d3cc336301b713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853854, "uuid": "98a66f87-c660-4a2d-b0aa-90a82e3a7244", "comment": "Malware payload", "value": "4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853854, "uuid": "de4778de-e264-4cae-ae6f-51bc126f596e", "comment": "Malware payload", "value": "d1c62ac62e68875085b62fa651fb17d4d7313887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853854, "uuid": "242abd73-69cb-477e-802c-9ae3f802afe6", "comment": "Malware payload", "value": "c27381c611ece2baa0ed7d32a02daa771b0d9bdde08ab893985d7e9101b073280011ef6f9bc7610a6e9bab8300a3419d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853854, "uuid": "fcd4c85c-a9a0-4cd5-98d0-524ebe459349", "value": "T152058D22B2D0C07AC8375371982ADB2924B7B9754835010F77E9662E6EB33D35E35E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853854, "uuid": "409a5a1e-bffd-4c20-86a5-b439787e5ec1", "value": "bf084102e13441ce39f8d51d9bf55857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853854, "uuid": "1e083f02-6779-4db9-a71a-661ba3753cfc", "value": "24576:z0wz1d5bAbWhrc56zQ9T4Ole+5PIuklOjB:Hd5Vhr4IMTbeGPJHjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853854, "uuid": "6aca0896-f5ba-4602-8bc1-f077a7620d51", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853854, "uuid": "5a8ec558-d117-4689-a91f-702e02a8fff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853854, "uuid": "26642c7c-b9d9-418e-9d82-675f587784dc", "value": "NoPetya.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f50534b-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658817750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817750, "uuid": "545410a9-4ad6-47b2-becc-f0468ec40083", "comment": "Malware payload (SnakeKeylogger)", "value": "066d0b717adff810f9e9c16fa882c580", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817750, "uuid": "46cd2c0e-cba2-4c40-acb2-9ecc7c3e278f", "comment": "Malware payload (SnakeKeylogger)", "value": "4c3c535a153cf0d3c3e3545638b81d2c078fa7107424fa044d5e19e6f1c24db1", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817750, "uuid": "3511b216-72ef-4cba-812c-0d062fe25684", "comment": "Malware payload (SnakeKeylogger)", "value": "f68af42f931880f9d5629426d2e1a1c8b0c97d51", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817750, "uuid": "300cc39b-a01b-469f-be97-22e24bcccef6", "comment": "Malware payload (SnakeKeylogger)", "value": "129171b09aec5e27ee7fdba4b6446a8f7a43fa68998550f2adc792ba895900c0593448cee904a83b00667b25bde3d187", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817750, "uuid": "9a3b5d34-4f07-4e77-a630-b9560bd7faaa", "value": "T1F605337075FFA69AA2E0D4E6C11BFD88E0853D8F105C51F67B5AB91DE0E6C7C8258E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817750, "uuid": "6011973a-bc8a-476d-ac29-c764ec7fb382", "value": "24576:Y8r7+ZziBAD8fh4t2GWgWUsvt+JUBvIJXcIdKOC1XdcJv:Y8YeBAD8fE7WtbwUBMsMYhuJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817750, "uuid": "2629083b-3aa8-404c-b7fa-610dfeafcfbd", "value": 803001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817750, "uuid": "92904c42-7311-4e65-adb3-92962a528898", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817750, "uuid": "e841120b-e559-44d5-a3ce-05afb520173f", "value": "Document3495869..tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27a90a5-0cca-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658830050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830050, "uuid": "851d05de-a439-490b-a26d-8cf22e6bc714", "comment": "Malware payload (GuLoader)", "value": "30518a80b9db664c96199b69c86e4e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830050, "uuid": "7871768f-00fe-458e-9edd-ca60e71c1542", "comment": "Malware payload (GuLoader)", "value": "4c91a0b1473528bcae811fb58a5306617dc04b64ea4961c0dff0c48f1dfc3e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830050, "uuid": "4c95f190-6065-4d87-81fa-c3e6ecd7af45", "comment": "Malware payload (GuLoader)", "value": "766c1c8be8f0576fca679914fff6d0f779c51fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830050, "uuid": "bd1aa48b-938d-464d-953f-039ba1765663", "comment": "Malware payload (GuLoader)", "value": "931a411f1eaeb69a00429c81168b4355a17c4c9a539d9549c019339e573089216d9f8d609797a64443d383893a4bb6f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830050, "uuid": "a3c2c7eb-a8ef-45fd-a979-581271afa917", "value": "T18CB3E1412664D423FEB24F324A7ABB238EFB89645860533707A06B5C3C327919E1F75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830050, "uuid": "25e59abc-d1b3-42c9-ba92-3610bdce4bed", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830050, "uuid": "c11f3815-f25b-4690-8849-7a1b227e6285", "value": "3072:G3yddvw8pSupPLb5BOWsELc+b/P9V3Ax5pv5GGuV7W1XUpvA7:G3yztT6hrU/H3aj/uVo+A7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658830050, "uuid": "1cdb6c31-3829-4725-824e-5ef6439361bb", "value": 112544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658830050, "uuid": "5890d21f-66c8-4014-9516-95ed2f7a4c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830050, "uuid": "e965aa1a-a848-4b5b-a3c9-b73c771f5c34", "value": "TT USD56,670.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b335d95a-0d0d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658858801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858801, "uuid": "d4d6bc02-80cb-43c2-8620-d7090785deea", "comment": "Malware payload", "value": "10e7fa9b1cdf6a901e170c900cdbbe91", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858801, "uuid": "2c01e89c-9537-488d-8a71-20dd9f1407e0", "comment": "Malware payload", "value": "4d83ea2172cf708ac8ddde013f1fb26f0710cc327ec6c54ec44cd6f64eb01382", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858801, "uuid": "eb48ed1f-ee5b-44a2-b23d-6ddd3be6a0e1", "comment": "Malware payload", "value": "be29db7268140f9c2e9f3c390b60314f5f4e2f67", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658858801, "uuid": "468c6e91-dfbc-445c-ad7a-5d2ee9fda9f3", "comment": "Malware payload", "value": "c33f57e8ba9e59015aa75a1e0bf0868f3ad54ec3f691635c509d517f661731043f10b6f0d848def975cb32d88864ac1b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658858801, "uuid": "325ac4a2-6eda-4211-98e0-ec0267096046", "value": "T1BD3633634877B8B70D39BA818ED5462D9BB7581B656770707F30221A8B1E7EBF8D10B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658858801, "uuid": "703f920e-b240-4b70-8557-665b10a414e2", "value": "98304:fx7VWPSnf0EzkfhxRv4T8URNXJDeYX6fvPHhCZMbAGNMua6Tt/frF2+xZa6Q1:fVVL8WshDwwUPJrKvBjbTNT1T0Ua6Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658858801, "uuid": "1f04c919-0742-4372-b7de-730ad01ba039", "value": 5236894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658858801, "uuid": "0a807181-fce6-4469-94a8-4f8f5478e7a9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658858801, "uuid": "63bc840f-6551-460c-9742-8a478c44ce94", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d357afe3-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658854989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854989, "uuid": "a739d685-de97-48f3-9d28-678d677e63e8", "comment": "Malware payload", "value": "3eb2859fbf65eb19451f5789df4f8508", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854989, "uuid": "8e999a48-63ce-4cd7-8ebb-678ee3f3db90", "comment": "Malware payload", "value": "4e056b2f0017483766f1ae3772da8bacf97cf4daffc8c3e35fd9e326adc2ade7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854989, "uuid": "14f8fb28-4a2a-46b8-82a9-df59bede2091", "comment": "Malware payload", "value": "e528f702ad8916ca72eeb721b2edfc5990878776", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854989, "uuid": "280fedc4-5045-4b07-afd7-1d0803196b03", "comment": "Malware payload", "value": "057054da017273f871f31f6e0d6572b264cf2e8c2798dc25a97e2c338bcd6166221eda768eace5734b901fae4696932b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854989, "uuid": "bb7fe707-f186-41a9-9474-28144da9b24b", "value": "T1DE152220FECC9EAACB6481396237AD1D21EDBD4C0348D4FB4396B49B617876A07F7125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854989, "uuid": "79a99ed1-392e-47b2-aafb-bd1c6de79458", "value": "24576:IfYV+ZwqH+O8w063tSXHUaX4FK+id6TMk:IQV+6qkXwCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658854989, "uuid": "ad669918-dab1-45a3-9394-43d5404de485", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658854989, "uuid": "10735516-3252-4c4b-851b-821a2bc2b8da", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854989, "uuid": "9623cd07-39cf-4edf-91fe-2a6a1dae1961", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.10563.29137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e0209b-0cf0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658846449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846449, "uuid": "ebeb2366-6539-45c1-b86a-12cae448a06c", "comment": "Malware payload (RedLineStealer)", "value": "4da6ff4eefed0d6c2db351ddbdd33adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846449, "uuid": "af235305-3142-4201-a2ef-fd42db6d97d9", "comment": "Malware payload (RedLineStealer)", "value": "4e53778b6d2025b040ac38edf07dd9c31cae71628c231b227a7256c12a788cfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846449, "uuid": "0789e541-f39f-4933-910c-fc55e275031d", "comment": "Malware payload (RedLineStealer)", "value": "5d9938e3f47088dcb714770087c666b7da4771c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846449, "uuid": "3f030a8d-ad02-40ab-bcd9-bfa513265b68", "comment": "Malware payload (RedLineStealer)", "value": "cb702c2d23df0b53613820d9f0411a993cbd66a9a850c678b56997c7dcda2a71b560adbe79b6b12281f0064a1a73d6db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846449, "uuid": "5465a300-036d-45ce-9f50-44382491fa73", "value": "T195C509136ACB0E75DDD23BB4A1CB533AA734ED30CA3A9B7BB608C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846449, "uuid": "ec5b0494-0a2d-41ee-a040-7824bf13de5c", "value": "da0a8429d07681e0f845d1d4f08ae833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846449, "uuid": "df80f7c8-9a9f-4766-916f-acf03c9add9d", "value": "24576:czckV/lGc2drYYXYaNvuJmxMmBd1mOCeGEAbjwUNm/X7TcALwLjD6Fbzl3RuQ55s:cLV/lGc2dFlBsjwMm/X7TcAkLjD83l34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846449, "uuid": "111108aa-7f35-4d7a-a31a-392c33e9001f", "value": 2534817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846449, "uuid": "0a4af3da-4fff-4935-b50d-1fc40842e6fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846449, "uuid": "e90960b3-a191-4b1c-b76e-53c067ff20f2", "value": "4e53778b6d2025b040ac38edf07dd9c31cae71628c231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1724dfaa-0d38-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877007, "uuid": "e385c180-4553-4249-bcb3-40a02753fda8", "comment": "Malware payload (Mirai)", "value": "2799cb3ed50e9f82fdc2083e6af086c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877007, "uuid": "587aaea5-d142-4b1a-ac6a-5601987b7a30", "comment": "Malware payload (Mirai)", "value": "4eae3df7d930bddd2ea50dabb19e344b0945881b71da463a88015fdc1543059c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877007, "uuid": "e0a415fa-5b71-4550-8313-beed6637d0e2", "comment": "Malware payload (Mirai)", "value": "7eb2035645857d84e66c87cbdb2f09db1776929d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877007, "uuid": "f7df5d1b-f48a-4021-9775-dd6e763dd91d", "comment": "Malware payload (Mirai)", "value": "9971d10eea5ae9b12b81c7a11e5605a8b5249e62ce200e0e0bb170d6e87004f939967371860aa2a815260645f4b9e6fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877007, "uuid": "65ae2554-989f-4f22-9173-d7d00e939e67", "value": "T12D533B32FA362E17C0E1A4B961B78B15F5E51BDE25A8C64A3D720E4AFF606406503EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877007, "uuid": "da980f7a-b94d-4069-8e08-122df02baaa1", "value": "1536:QwIyzn7SceItuItYhio0zhwAI2K2/eIfiV0w:h6ILYhbweNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877007, "uuid": "1a91a7fd-7f75-4034-8ff5-3feed20129a0", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877007, "uuid": "2b6c8005-8d45-4494-909c-24dbdf24032b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877007, "uuid": "dd07d6ac-a72c-4ad3-9ebb-535b16d26120", "value": "2799cb3ed50e9f82fdc2083e6af086c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16c3ece-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827015, "uuid": "b6058e29-fbd8-49b0-9fcc-c3703d5dc75c", "comment": "Malware payload (Mirai)", "value": "3d7f66033837b68f2545247aae3b450d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827015, "uuid": "dc535b1a-6d91-48e2-9927-b8e1ce821664", "comment": "Malware payload (Mirai)", "value": "4eb33433beeb8764f2d95c75bda0821af3caff0f5149c5054dcb2724fbdfb1c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827015, "uuid": "96af0134-507d-4711-9395-8a43634893c5", "comment": "Malware payload (Mirai)", "value": "062282b74b0cb1be1f21ec7bbb2925a98e7cc9ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827015, "uuid": "e6060c35-025b-4230-8228-3eb596a1d86c", "comment": "Malware payload (Mirai)", "value": "15fdc92e4aa0f602c5870bc7d3db94aa350849d476d0d27cb82fd4cdf164e3b7110830360df9f318233fc65b2fe17b4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827015, "uuid": "76a31d6a-ea67-4920-ada6-b826a3e22174", "value": "T16EF2D0BCCA0B848ED71994FD87E02B415F200F723283BC86F9D697575ACB8A179424DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827015, "uuid": "744b064c-649b-4aef-b065-31e367b96971", "value": "768:YuZ+b8qYpcRMVuADtgNhD+fDZAYlZXWr79GupPNjEUJgGlzDpbuR1JYC:Yukb8qWcRiuAD2NhUNZOJGCPNAMVJu+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827015, "uuid": "e0bfa6a1-790a-466a-ab56-5d0dad18f7d1", "value": 34592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827015, "uuid": "af71bdea-92f4-40e6-b31f-491c4ae93287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827015, "uuid": "92f62441-177a-4bf2-ab72-f65c8f5451df", "value": "home.mips-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786e12b7-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1658850971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850971, "uuid": "d2396892-c922-4a41-bc7c-b34154b4c451", "comment": "Malware payload (Socelars)", "value": "ca705bdf6dc0b9531cc72e5003798ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850971, "uuid": "018caafa-c469-4bb9-a055-45d30f7595b4", "comment": "Malware payload (Socelars)", "value": "4f76198f110f216e5d8ec808b5880f9cc3c9006952f68b54a84bcd89886d5c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850971, "uuid": "70803fc5-211e-459f-bfb4-6f4b8c1b433f", "comment": "Malware payload (Socelars)", "value": "0341104df554b46866206c304ee1aba61f86b190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850971, "uuid": "b4a657c8-8461-4a54-a9b3-0a38820633ec", "comment": "Malware payload (Socelars)", "value": "736b8ba5d7c9d1d26d7ccf8e00713408c3d97525fd3a41c28b5c8124459593cda1647e72025b0f4d9b0910f50cc8ba1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850971, "uuid": "3c616c09-a9fe-41a5-a520-8363804534ee", "value": "T19C659F11E7429036E9E300B2C5FF5AFE8D28BA21031850D7E3C47D699E716E27A37A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850971, "uuid": "7c2242be-bd29-4fa2-aaa5-a1c8749676ab", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850971, "uuid": "734f23fa-e894-4c15-8878-16d3ae86af53", "value": "24576:FLvpteBrVtMLwQe1Qog2SoWXaJSwXjrLAmPbHMvlko/HNwd:lvpm0MXdh8mPbHMvGo/qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850971, "uuid": "ae41e25c-ae13-4df7-8309-687fb34ee9e9", "value": 1524224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850971, "uuid": "948a1660-d027-4499-84b6-aff8438c6823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850971, "uuid": "bcfaeb01-400c-4ea8-94c7-6365ef2bda30", "value": "ca705bdf6dc0b9531cc72e5003798ef5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e43c2e1-0c81-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658798636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798636, "uuid": "cd41c28b-1111-446d-92c5-dfc40cd2ad77", "comment": "Malware payload (RedLineStealer)", "value": "61329c023d67de85decf92ce55a3c196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798636, "uuid": "c75837e9-4503-4b01-b51c-37aa50fb65b1", "comment": "Malware payload (RedLineStealer)", "value": "502fe5ef79bd707b4b31d35b6ac4df2ee14a59012080abe632aa51cd1908fd15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798636, "uuid": "27c16050-22c1-4b51-bb78-5dea55348c98", "comment": "Malware payload (RedLineStealer)", "value": "962c1796851c8b9d053860722bc866e567072ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658798636, "uuid": "cd04f8bd-b0d3-4569-baf1-0f2ef177566f", "comment": "Malware payload (RedLineStealer)", "value": "9e4191e6a9d3a846f399cdf4775d891598d7a3f028c098f47720c81ce8ea46682241abfe28455d3a92a6ef5dc6fce220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798636, "uuid": "80da2d59-732a-4035-ac15-2c7ba1a93d27", "value": "T19CC52A139A8B0E75DDC27BB461CB633EA734ED30CA3A9B7BB608C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798636, "uuid": "a57a1474-8446-455f-be2b-52925b5d33e7", "value": "e1888d3e3e34368cefc07e8f747b2817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798636, "uuid": "34f3f1ad-63b3-47cd-83d2-7fa1ffb9c48f", "value": "24576:VxyIH2C3ORcXfYrYVMq0ZK5zMifd+zCvmjGdKDbXNWRUM83zpPO0/Lxke/sYp6ly:eIH28ORcNLksU93zpPO0/1F6l3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658798636, "uuid": "a3e9e0d2-2e89-48a1-af0c-26c70e8ef7a7", "value": 2582647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658798636, "uuid": "37bce7ae-ada9-4c75-af1e-efb9ca7bc516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658798636, "uuid": "cef1d8ff-d730-4bb9-bc49-6535bc248128", "value": "61329c023d67de85decf92ce55a3c196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a555407-0ce6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658841794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841794, "uuid": "55f8c96d-d583-410a-817b-b7f614afa96d", "comment": "Malware payload (AgentTesla)", "value": "12f75da6d1b318d1bc237d9dfd63b966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841794, "uuid": "4ef2d6c3-4f95-45e1-a17e-ff20072aa8b4", "comment": "Malware payload (AgentTesla)", "value": "50502231aefd226a54d0bc83ada8c90943d7838d0045ae2fec0093a7e23593ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841794, "uuid": "8e907830-4fbb-4996-b9d9-6f89d7f2847e", "comment": "Malware payload (AgentTesla)", "value": "4ca237a32b3c5aa2572bd950362aa3a7edf21b31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841794, "uuid": "f2773c07-74d1-4239-bad4-c0132292f5cf", "comment": "Malware payload (AgentTesla)", "value": "9edf796bd462b06f72d4e4a8d43c30653c02c779b27865b9382ebfa7cf5a302419040d7a3ffd09f55aa9821693737dc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841794, "uuid": "f08f867b-eca8-4dfd-84d1-dcd1f62fad6d", "value": "T157E47C983592B6DEC917C8728FD85C64EA60B437930F9217942313ADDB2DDA7CF150B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841794, "uuid": "55bcbbd3-bfcf-4ffd-863a-128b91fadb47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841794, "uuid": "0629ad7f-6221-4d4a-8736-95c8ca306e9b", "value": "12288:WJJt12iNDXR0V9NiLR/qKoWNrHjP3pVPJpqAzUJYHEZwqpkvVmSOWnJB/rku1:WDt11roILVqtWNrDP3rz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658841794, "uuid": "3c793c55-fe2c-42a3-9603-ab7bf8a9e1dd", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658841794, "uuid": "1c4327eb-faa2-4c91-b87b-a0bec7e46cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841794, "uuid": "04c81d58-669a-42b0-9978-60f62e361e45", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c63cd9e-0cfe-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658852159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852159, "uuid": "137be26e-df19-4819-87fd-f39868293a8a", "comment": "Malware payload (XFilesStealer)", "value": "7944f1f915ea06c164cd7f94633f4b7a", "object_relation": "md5", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852159, "uuid": "131fdd03-2a22-49db-bb67-9ebc670b6aaa", "comment": "Malware payload (XFilesStealer)", "value": "506aa9e26a8962c561e5486356913ee40e53e5ea2434363e4b5827c126b0ce6c", "object_relation": "sha256", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852159, "uuid": "08c3090e-b3ff-49b0-8d86-1bb8d33ee774", "comment": "Malware payload (XFilesStealer)", "value": "0a0a0b86ec7374efdbe2fc01254c962fa9c2243c", "object_relation": "sha1", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852159, "uuid": "39bff23b-2ec3-4198-84e5-b18a8c4b9039", "comment": "Malware payload (XFilesStealer)", "value": "c674f7856f1549a197ece31f7384fcf763bc0c5fdb6fd687396e76f1ba20ae1aa3669a504998a011e73b7c01ef54599f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852159, "uuid": "7aa8fd6f-f08c-45ce-a82b-18f386b7d7b7", "value": "T1C6E4130BC8B40AF5C77061F7A6217592E3237201FE329278E7B93895E5F71794D462B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852159, "uuid": "2f063556-ddae-4ee9-a13e-5c99385ef1a3", "value": "12288:7kCyvdcmdFTjrcZYy/cdsoE4XkwxCcG9jGDWmRMJ9ZqMfa+0Y1k+PQR9w:7kf6mzriYy/cd7E6kidG9j4WmRnn+0Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658852159, "uuid": "81b644c9-1fbd-4c78-bac3-a81b5e1a9454", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658852159, "uuid": "80276b3c-9452-4a85-803d-2fbe847ab780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852159, "uuid": "e1d86453-8b6b-444b-bae5-b0ce0b6f1ddf", "value": "PO#MP2218_potvrd 220623052GZU_170914140GZU-001_CDR V4 z3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b44a0a7-0cb6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658821287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821287, "uuid": "f3a4d3ac-00f3-4efd-b6aa-1946c2e5eaae", "comment": "Malware payload (AgentTesla)", "value": "b7ffce03c5a71fd9bedf85b22fddc6bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821287, "uuid": "7e014546-7b7d-4f1e-ad9b-bc44cba989c4", "comment": "Malware payload (AgentTesla)", "value": "506bd94dec0c3bd58f4c910d2cde67c03aaa53bf86e9b272881269de53257bdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821287, "uuid": "ed379269-0b98-49c8-9476-347617e16384", "comment": "Malware payload (AgentTesla)", "value": "f2d9678401df27d5ee6d54da21ee858050a0884f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821287, "uuid": "04c6fc82-88f6-4e7d-b63e-a637377cbfce", "comment": "Malware payload (AgentTesla)", "value": "37fbd3355cc96c33c23841cad1b757a74fc9aca3656f94cda6b09c7e0acb5356ea858d2dbb936526d0c174f25a1201f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821287, "uuid": "48150703-5d90-417d-90aa-7607be5873fc", "value": "T14D2512281BA88F07DDBD8BF94120400467B47A253493E7685DC2F4DD3FA6FA1994AE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821287, "uuid": "a5d93d38-d81d-40b2-9792-921c09aba314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821287, "uuid": "fb95ee7d-df2c-4133-82a5-034af827e81f", "value": "24576:u402cdw4UZvybcv8v4ZwGb8DXdTurwSHv7fXwx9P:C2cd6d8AGjXdjSTfXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821287, "uuid": "70b684f1-5290-4f1e-ac5f-a1c219c47a48", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821287, "uuid": "4e88ab9f-459f-4cbd-b7b9-583fd8847e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821287, "uuid": "6bc7ca02-08b9-4a4d-90ee-b31e6dc8139e", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.22184.16359.5847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e1b9b5-0cda-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658836877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836877, "uuid": "4e8f4bc8-1884-4fe4-8844-17cd5df45aa7", "comment": "Malware payload", "value": "82029d53a846753b7b682b808ade320c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836877, "uuid": "449bd98f-80ad-4ed7-a5e0-6d822a2f9377", "comment": "Malware payload", "value": "511cd893ce47f7b6a662314ba039ab9e76086527adcdd3c8c5a83368174cc8a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836877, "uuid": "ab8608e6-167b-4a57-ae7a-46ba86d4ebfb", "comment": "Malware payload", "value": "fa79b1c2e54e2a8c211e90d2069241634d915944", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836877, "uuid": "86aae7b3-ee9a-442d-b271-3cfc43baf51e", "comment": "Malware payload", "value": "8a1904971c65bd566aec4d7b9c245889c1d25a56bb01b76417ca083abe9297c89a3eb7886a37ec39a08a67af65603b8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836877, "uuid": "f0050a8a-3548-4b2a-bdde-ee96443ca2fc", "value": "T1EE624F697205D677D06DB7728C6ADAAE6330FC08BFC322173980736E19723444E36C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836877, "uuid": "29bcf9b5-ec10-4cd6-bf90-81ce06076336", "value": "192:5t43k+PWV2E2sSFwK3fiI4H89K+D0+/w3SxPRaI:5tkQ2E2skwK3fir1+D/w3YP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836877, "uuid": "cd495072-6499-4fe0-9cfa-b732c2345fdd", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836877, "uuid": "db4464a8-567a-4234-bf3f-fa760b4849e6", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836877, "uuid": "123902b3-38cc-4ef2-9c08-daf75411614d", "value": "SecuriteInfo.com.VBA.Amphitryon.3742.6849.28290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08468516-0d15-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658861950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861950, "uuid": "cf3fc085-c978-40a9-bd81-841420efd8de", "comment": "Malware payload (AgentTesla)", "value": "8c02a2b7b47f8ffc4b7c9665a338b591", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861950, "uuid": "472ffffc-8d01-40f7-b658-7c3f59ace546", "comment": "Malware payload (AgentTesla)", "value": "52a6856faf3bd45d6fe1c0b6c19e07e7d7555f3e2e38edba6b238ede2f984bad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861950, "uuid": "e7be3489-4eb2-46c6-93d4-0a37bf55a736", "comment": "Malware payload (AgentTesla)", "value": "0cc5cf57353dc16cf949b78b9bf7c09081b9f8c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658861950, "uuid": "1cf7e010-e27c-43e8-a1ff-77e92003ed64", "comment": "Malware payload (AgentTesla)", "value": "c2838345099d15d1df719bcddc40199c5fae05f8c68e19cbeb4a1a7b22d9e6929fceb6349b745c4ce3910a52b9ea6ae6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861950, "uuid": "8cbafcf6-ff8f-47fa-b702-83c6d59eee67", "value": "T18334D098BA50789FCC6BDD7299640C34FB307876270BC683A05356ACAE0D78B9F051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861950, "uuid": "d5cbf821-63bd-49bf-b1b7-e32aa3690faa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861950, "uuid": "88c8ed6f-6ef7-4325-bc05-6d80d7489fe1", "value": "6144:EnWicAue/NgutPQdNlGw2h/4D5VYI48Z6Bg:Eore4f52hwDE4Z6Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658861950, "uuid": "25e03900-e6e9-4917-9b08-c83a3cc4f573", "value": 233504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658861950, "uuid": "474e77c8-cf24-4b78-9df7-6cfa1c4adb61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658861950, "uuid": "7f775d50-6c14-4368-afc7-fd84eb91891a", "value": "SecuriteInfo.com.W32.Kryptik.MA.24921.30079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efba09af-0cac-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658817241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817241, "uuid": "410e4558-df9e-4cb2-8435-cbdc0bc56f18", "comment": "Malware payload", "value": "f2e5d2a42941350dd14b32bd31e275a1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817241, "uuid": "0f1b3e13-9fb4-438f-9e3b-591e9d7658d2", "comment": "Malware payload", "value": "52a963a67be575893c152a466a931c1d453156f9a267d9b80496b7d8c44f3fd6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817241, "uuid": "668827a6-0c94-4166-918f-66b11d252856", "comment": "Malware payload", "value": "0ca54793e1b3c3046f6fa85a6f3f9fe45fcf9e7f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817241, "uuid": "16d8d2f9-a5a5-4922-8471-e3a83b34dcee", "comment": "Malware payload", "value": "0b2a6f929adcfa0a8ebd7cf3df199ec28bbd76d31acd08fe0cda4f922bad23c6d2c9059146d7f6be102bf4abd8f337a5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817241, "uuid": "7fb3d2f9-2bcf-4e56-a679-7af456cfc8c5", "value": "T1D4A5117A3094A243C53877E9F252E13D7BD070B49A7026C1FBA4B457EA9C4CE8CB5E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817241, "uuid": "4089e65c-2b83-4dd9-809a-730bde867199", "value": "49152:VxjYFQ8CQ3r8wo12wBEgrJELjDFnoSpmWRCaHqqC4Ohg3jIsRuUh2:4a8CSr7oAGhrJMnoSpP+4Ohq95I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817241, "uuid": "bc0e5bf6-fda5-48f2-ad65-35b34c7f0c4b", "value": 2251432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817241, "uuid": "953e93e4-1d6c-4975-b068-54c09d174cf2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817241, "uuid": "3e5cedcf-5c4c-428b-a9a0-c9a6b26ecb27", "value": "CheatArena.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288b8e8d-0ccf-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658831939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831939, "uuid": "7f384148-578a-41e5-b1d3-bbda84b1eb0c", "comment": "Malware payload (SnakeKeylogger)", "value": "890e0bdd40abd6dc949d976950a955a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831939, "uuid": "72fc9c0f-122e-4e00-95fb-b036465dafec", "comment": "Malware payload (SnakeKeylogger)", "value": "52bda5e5d43125887f80e15a1b4332beda95c996d230f4bc3eb053939e0c3b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831939, "uuid": "8c1ef693-6ce2-45c4-9bb5-355af4a674a1", "comment": "Malware payload (SnakeKeylogger)", "value": "f82d67cb630a04db74b3e9f5b73732fda08a380d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831939, "uuid": "e989146c-752b-45e9-87ad-43c763f00568", "comment": "Malware payload (SnakeKeylogger)", "value": "ac3eed4e7be4522f6052adcc2795b2882d0e3fb45985f3e2a55ff81cc9457644aa118134ea6d84c3b67ad2fc1474ef15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831939, "uuid": "00adcf80-609d-4b5a-a572-d5afa008cf0c", "value": "T17C459DAC352075DFCA67C6B9C9946D28AB2038B6570BC607901731DDAE3DBA7DE050E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831939, "uuid": "c237f572-8b35-430d-8506-105c405eb815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831939, "uuid": "5d0872cc-5b56-4fb6-a9df-66637f7d2432", "value": "24576:YQCPpw4UZvybcv8vU9mY5qmHWV6hqYXMdFxnSHsvLe:i6d8emK52V6hq2WSHsvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658831939, "uuid": "f988b03b-f109-4087-b228-1aa22c679d1e", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658831939, "uuid": "84d048aa-3d15-4be3-8adb-fda646ad528d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831939, "uuid": "5d197ad7-0844-4985-bd8e-b9c4984e8309", "value": "Inv00000000000023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e09328-0cb4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658820501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820501, "uuid": "ed45fe1d-dead-4dc9-8131-f48351f75f01", "comment": "Malware payload (Loki)", "value": "4634c4b10c619f2023966dc25250a7e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820501, "uuid": "c1ebf3ca-b746-4ade-9d7e-2a62ca18906f", "comment": "Malware payload (Loki)", "value": "52cfe42d15d0f1fefd1468e01935f771ba9dfa10001b36de60ab4d805997804f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820501, "uuid": "f28dd230-3c26-4663-9f09-cc6d964a0255", "comment": "Malware payload (Loki)", "value": "c4205364c90d344fb2c4f2c60404b44c3f9058da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820501, "uuid": "3c241f76-cd07-4c54-8d09-50b66536f3d6", "comment": "Malware payload (Loki)", "value": "574bdf4ad8b1f14a19e200b3661dac07d58860b42653be5e31212d63129180c5fc6f216188f49f012229515694c2343e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820501, "uuid": "a6205c93-8e70-4aaf-b194-75e2d0bc6474", "value": "T1DF0501286AB49F47DDFC4BF94420060857B4B9253442E7685EC2F4EE3E66F61894BE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820501, "uuid": "872b83ba-dab7-4c48-bf2a-63a2a8ccb113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820501, "uuid": "69cfd050-204a-42e5-93bb-918b12691654", "value": "24576:BcOw4UZvybcv8vrAWYp4F4ff3B/zIuxzP:BcO6d8cp48B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820501, "uuid": "9a032f35-f83a-47d8-bae9-e53ed666f972", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820501, "uuid": "547d0492-a8c8-4321-abea-a3753caebb10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820501, "uuid": "198eb1cd-1f77-4cb1-a4df-09de01078e7f", "value": "4634c4b10c619f2023966dc25250a7e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3554933-0d0b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658857969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857969, "uuid": "f0362630-5ec8-484e-a351-1ec4a36869cd", "comment": "Malware payload", "value": "a5610e4c7ed27e417926d014a2520c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857969, "uuid": "87023896-183e-4e7b-9916-22ffdd437f3a", "comment": "Malware payload", "value": "53866457eeab4724f107e6407cb25fe40e596185f8503267ee2d307580d8bcfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857969, "uuid": "d780993e-8355-461b-974e-4dbbbcee8ab5", "comment": "Malware payload", "value": "a331a272dc0aff7c25a316f4aba4a4aafece9897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857969, "uuid": "383339f5-229f-41dc-b399-96fe61c8e645", "comment": "Malware payload", "value": "f3a6025b5146dd4f56d016d70dd6caa3d19e713d1acf9f4405d7bdeb97c81c85c589c5e818bf41a2b11ee90e568fb014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857969, "uuid": "6752c320-8ede-43d6-b30d-53f5e87b9a17", "value": "T148F301006A62C8B7DD650E7009FC6B3DDFF6935511962A4B87601D993E9338A8B2F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857969, "uuid": "3ef38da1-1b98-4ec9-a169-9871d95bd8d5", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857969, "uuid": "60e5d7b8-ef39-4e38-95fe-cd4e7f88bd99", "value": "3072:HkBGWOsTIJgIDU5A/cJbHNmdMl0GYbqDRpV0DaHofMl5oaL5Hk5wZ1fSxp:H1ssj8tmdMbVR/eaaMDoaS5wfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658857969, "uuid": "a846c545-8a8e-433f-ad02-d51c25d5cb7c", "value": 167744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658857969, "uuid": "57e368a0-1b48-4ed7-bc14-678e3c7e14d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857969, "uuid": "29803a2f-5554-43ce-a7bb-b04ac6da86ab", "value": "Product inquiry0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3955c8-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877928, "uuid": "c56e3823-521e-4f90-b328-7035e3f69793", "comment": "Malware payload (Mirai)", "value": "b9175999b1e68f6d49acc0b8c28e687d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877928, "uuid": "5455c68e-cec1-4053-9147-51e990229e45", "comment": "Malware payload (Mirai)", "value": "54c3e85544355a4e4eb37b7e3865e3f358becd63e0c22bc0857c536e9e13cad0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877928, "uuid": "d7ae9d85-6f00-41b2-bcbf-bbdb1633586e", "comment": "Malware payload (Mirai)", "value": "fd3452c74600c1d9188ba880b5dbf9fdc8b7e861", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877928, "uuid": "2fe3ba18-7968-4427-9859-f1ca22bf0beb", "comment": "Malware payload (Mirai)", "value": "283be108cc251465ea8aa50797268d772145aa561607a7aa7b0021282e0044670b257f6fda894b50879c0d9c2e37a8fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877928, "uuid": "34d8b5ff-f43d-41ec-8993-cce38c933502", "value": "T1B173C70A7E229FBCFB9846354BB78F159A5833E627D1D541E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877928, "uuid": "598421e9-8069-4ed9-9e46-572615df64da", "value": "1536:bpxe5qoct9fdlQBI6rPEnUFnglR4tYG9CJa100D/:Fx3oANdgrng/4mgC4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877928, "uuid": "2e604fdb-acaa-4a09-bb51-f1808e02352d", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877928, "uuid": "4c751963-0858-496c-a611-a4e3ba9ce364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877928, "uuid": "b68f2f03-5541-4226-acda-13b08dcb15c4", "value": "b9175999b1e68f6d49acc0b8c28e687d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafa6de7-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1658824857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824857, "uuid": "88d8c90b-4048-4fb4-8f76-0d96b41f44b4", "comment": "Malware payload (DBatLoader)", "value": "6850a8a279bac7c7d452c02ae85f9cb2", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824857, "uuid": "104078a5-d3e5-4f5f-bf67-90c65bc261ef", "comment": "Malware payload (DBatLoader)", "value": "55dd0dd50f0aaf3255a1c1e5c04be347c9ffff3a5c21d5b0eba3e199b21cc9e2", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824857, "uuid": "89581468-30f1-4da7-8438-bb3492aeac3b", "comment": "Malware payload (DBatLoader)", "value": "5d25b8baa7e66988460c9bb5f7f4c4ca8869771b", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824857, "uuid": "735943d6-769c-406a-b99a-361a9d0e7d2d", "comment": "Malware payload (DBatLoader)", "value": "1ebc1653be5e7f00db604dfaab773192103c5ee11392826502b4e61a02a0f458a885973578092afa6516b5498ecefae7", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824857, "uuid": "2c554568-af32-4fcd-9b20-2561471815f5", "value": "T1E3258D31F3D25433D573277D8D1B46A59939BE003A78DC862BE92E881FFA64039392D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824857, "uuid": "6def4887-e5db-4bdf-a277-fb587a002a02", "value": "205f6434858f3f8cc9e8b96d094507a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824857, "uuid": "236977e0-55a2-41a0-9e6f-32323de5613e", "value": "24576:5DA1mchKTwkH17WtMBhiUDxvHiMYStUtVSn52pAf2rDNtl2aCHX:5Dhc8ZPbVI5Sn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824857, "uuid": "c8d32463-cda0-41cd-80d3-8fc4dd11e93a", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824857, "uuid": "9a1950fb-28fe-4957-b50a-c46e016dfd84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824857, "uuid": "10447955-0ddc-413d-92d2-6ae31abdc54a", "value": "New-Order7393483843.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d70849-0cb4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658820425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820425, "uuid": "836bd7b0-a37b-458d-8b2a-1b96cc0e7bc6", "comment": "Malware payload (Loki)", "value": "f3ca40761855857e602fa648d0895199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820425, "uuid": "d376d6ee-44fa-4964-bee2-b38e41757c13", "comment": "Malware payload (Loki)", "value": "566de8b087ea649b425ac340760d12e6c31de2a10f2329ebd1160aa7adf3ac69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820425, "uuid": "bcc33f53-3bac-4ee2-b353-fd87376cd5bc", "comment": "Malware payload (Loki)", "value": "6000294279ee9b5d8a06977921877ff3989466e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820425, "uuid": "4c225eb0-0b41-4907-8e3c-a9566a57ea71", "comment": "Malware payload (Loki)", "value": "3e0fa37f73dd253c130672d215f14a635ba86bda3da514360287591607ac979c3492594f7caf458f4803998f5c059567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820425, "uuid": "66f6e355-ee14-4502-a7e3-6e8b5949b0c4", "value": "T128259DAC352075DFC86BC6B9DAA82C64EB60346B530FD603901355E9AE4DBA3DF054E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820425, "uuid": "935bed22-c59f-4106-bb65-0133c1f2d9eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820425, "uuid": "3007ea58-a24a-4efc-8715-def13c9dc1eb", "value": "24576:vw4UZvybcv8v0OG0LASpBDMQZFbmo9FqOx3OeHx:v6d8/Ggn1zb6o9FqEhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820425, "uuid": "56c69c58-a146-4cb0-94bc-13b50da463eb", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820425, "uuid": "3a570396-9c34-40c9-8900-e1d9fc778cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820425, "uuid": "dbe088c3-0ae9-457f-a487-6818209e2ec5", "value": "f3ca40761855857e602fa648d0895199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d7d720-0d1c-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658865147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865147, "uuid": "5a0253c4-1032-4fc2-a495-66fe75b440e0", "comment": "Malware payload (AgentTesla)", "value": "fe0d971db607f8e2cd5ff5bc89a74a05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865147, "uuid": "75aa0458-30e1-4e34-ad96-0ceb5643b7dd", "comment": "Malware payload (AgentTesla)", "value": "598d889e26dc0788680e1fb6b634afb99cd153604c3ee7265cf3b3081e9fa46e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865147, "uuid": "91c77932-2564-4318-854e-74ccd428ac64", "comment": "Malware payload (AgentTesla)", "value": "2aefaa239583fce6db9d70569ea3e4bd45fca839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865147, "uuid": "68b0aa79-68e6-400e-9079-003b205cc349", "comment": "Malware payload (AgentTesla)", "value": "1b7c6cebaf6ef0bbb97d5599b030632f36799026502a6f3bcfa883604aabf35c03b666eb8368cff7893b0fba29e0d386", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865147, "uuid": "6e8650fb-a16e-42a3-ab71-9a9ca276bba5", "value": "T17DC412012B65C73AD93ECBF8942420147BF1B65E7302E37D4FD654E26A9AB450780BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865147, "uuid": "aa6e1cc9-e2c1-4611-b5ee-5612507fefad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865147, "uuid": "47ae2dd1-9696-4822-9cfe-abb04cb7d592", "value": "12288:Pjku/v30uhaXpp8pt4cC15A5IxRHauV49JXV1Sy0UDPEfJnU8Six8:Yu/vE0aXLyrV5A5auV4PXL50UAh7Six", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658865147, "uuid": "ab37166c-d257-41d7-8ba9-f3c7371cff88", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658865147, "uuid": "b31b89ba-1b87-44b1-b7f6-b81e5a150fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865147, "uuid": "f172266f-0dff-4101-9536-0ddc7e762b60", "value": "DHL-26-2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ab43bb-0ced-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658844843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844843, "uuid": "a3c1f988-aab2-4c97-a256-f38129f60720", "comment": "Malware payload (RedLineStealer)", "value": "c5906ae3ce0c2bc2a88c40e1822320e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844843, "uuid": "92397389-a072-4a51-89c1-23ffa65b5d6c", "comment": "Malware payload (RedLineStealer)", "value": "59cc3561cf457f8e258eaac0dcaa33e9f2294400b92af8bfb5c5b66290322236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844843, "uuid": "0d6a76b6-3be7-444d-bda7-0fc8bf05ac87", "comment": "Malware payload (RedLineStealer)", "value": "dceb0549838da324b782d1cf59ea1eba48f2c435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844843, "uuid": "bbf091f1-987e-4a45-93b8-b11b81135c0c", "comment": "Malware payload (RedLineStealer)", "value": "14133fafb7ceb229cdd74288a5525ca49692e85f799c5760d1b3522d4cb6b10914fbf61f951f6411a689f1b0ccaa0003", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844843, "uuid": "a25c32ee-c517-40b5-83b3-8b2f40b4b4f4", "value": "T121656C29EB0619B4DA239771C5DEEB3B9B147A248022EF3BFF4ADE08A4331137C55156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844843, "uuid": "6389f850-7f1b-4c05-b32f-1b664e909e2e", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844843, "uuid": "19685160-6f37-451a-b8ca-411e65b965ab", "value": "24576:NKK1BxJ7Sjo7XtqYkYKLvlL67Mm0dOisD3aHQ5LVB8ZoFC3/L7A:nSjob/twCaZoFC3/3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658844843, "uuid": "6e9c2468-96c2-42ea-9c7f-0a01891510f6", "value": 1426840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658844843, "uuid": "8e0826a2-6476-4882-9af5-ffbd7aab4163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844843, "uuid": "8005b133-4489-4751-9b1c-c475139aa7c7", "value": "Genshin Impact.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f23ddd0-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658851331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851331, "uuid": "1e3decac-fc00-470a-8861-a3d165f87ac8", "comment": "Malware payload (Formbook)", "value": "3128692094abd246c86a0b91b487418e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851331, "uuid": "819f9a6a-e207-4933-b229-d201370322b2", "comment": "Malware payload (Formbook)", "value": "5b0d7778bb71245d4a049ae6ec1d5952c0630dbd74a64f1961d0fd563652a28e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851331, "uuid": "2064446f-eb13-49fc-ad45-e81aa02c560a", "comment": "Malware payload (Formbook)", "value": "63015159c389ed86d8b11c58a0b5638240471ea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851331, "uuid": "380245d4-4ecf-4d55-9fe4-3942aa7601ef", "comment": "Malware payload (Formbook)", "value": "7ff7fd46a733506a472d39f192cb0e72b24e013b0934b51e2ce8042561b9ad339c9d751862d1af8b6218a3601b54dcfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851331, "uuid": "ddf67e9f-3fdb-4457-8e45-444d56b51d3e", "value": "T12B13B11173B89B27D07A57F954B24424B3F678563321FB582E8274CB19B2B8C8693F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851331, "uuid": "f64e7a49-74bb-483f-903a-023b0ef9aee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851331, "uuid": "b2284103-1e14-45c4-9fc9-fea6cd16df21", "value": "768:QTTRZ2gZlGSgFfSeZQAx/jmhRCl1aMIWpN9wV+h+Mf/Jw+ni:lZVKiHIk9HQmK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851331, "uuid": "88417af7-407c-4e1a-ad73-73052e8c83dc", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851331, "uuid": "f1407048-36ef-4fb4-a626-62eab7ed00bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851331, "uuid": "6d97d9e3-c7f6-43ec-b1a8-965c8e30c04d", "value": "3128692094abd246c86a0b91b487418e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe74b119-0cd5-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658834875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834875, "uuid": "fc7b033b-2cae-42c9-a22b-235afd0f8116", "comment": "Malware payload (RedLineStealer)", "value": "d273d87bc16cdf54cb89e5c99475be7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834875, "uuid": "8178617a-483b-4466-9d2e-4fa16714e391", "comment": "Malware payload (RedLineStealer)", "value": "5b7d20ddd066d63ad0751c3dd989d32a91225ac4e2793fe10e1d7f08279d405d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834875, "uuid": "a9a1a3f7-3c9f-4808-a690-d1839c904736", "comment": "Malware payload (RedLineStealer)", "value": "b28dfaa701e3e233b86ff8af95b558d5353b16b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834875, "uuid": "80a7162d-8806-4eee-9414-52449c0eaabd", "comment": "Malware payload (RedLineStealer)", "value": "16c451c2d9083ec798905da2b4980f8fc5255836e0f68bc4b8225f7ee28137d81d33be140016e93326f3c5a7b2f15b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834875, "uuid": "5fbd911d-4d15-45ea-9517-96db498b1d5e", "value": "T17AA5232C7B6C8806DFC853F4ACD4427896B0EAC5B607C79BA00DAAB53ED6370F51915B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834875, "uuid": "833acbaa-ae1e-47c2-9534-1c019b9eb191", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834875, "uuid": "ad30d376-7fe2-408d-a15b-a0bfa6b115b0", "value": "49152:0LhGNeUJaJlUkRKzmoCKF38F762qa2dqoRgU5YCoLJ14:guNylTIClsq3RCQ14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834875, "uuid": "380f410a-066f-42a6-b91d-4f43717e0125", "value": 2255104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834875, "uuid": "b1f87a26-caa3-4d15-8f86-92228862af25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834875, "uuid": "41c957ef-c9c5-404b-887a-daac6ae112ca", "value": "GENSHIN PRIMO HACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb00cc7-0cfa-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658850765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850765, "uuid": "2588a93c-aa84-4c6b-acb1-093780b5c27a", "comment": "Malware payload", "value": "7ed391152658aa87e92df9ade8ce4fb9", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850765, "uuid": "fa73e90a-8400-4d31-b895-4de3b0d53a92", "comment": "Malware payload", "value": "5bca4ad4a8d6ea1420739f658c552a6b2f0063d4eae3629bc26bba4fcbde4f78", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850765, "uuid": "474aca16-c003-46f4-aeef-8ee7f23e13fc", "comment": "Malware payload", "value": "e0b074b71b4a523778c1af1739a2aadb3fd4c840", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850765, "uuid": "00a4e763-af50-4f8c-ba48-5795fd1e02b6", "comment": "Malware payload", "value": "cf5426ec86e5a0f368a3fad9d31ca1661b19d36d20653681b649a4c009d3f63c92e261f9dd6baf525de02877850bc540", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850765, "uuid": "653e028e-cbde-4eb2-8e98-28ecd05f5c71", "value": "T10C247D2332E1C0B7D6E352304DF5AF79B6F6FA504F318A8767905B1D1E31A818A29763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850765, "uuid": "432e61eb-7df0-40a2-808c-51ce6a8813d1", "value": "1eb1b9afdfd1d92eed1cc72d13b4129d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850765, "uuid": "497534b4-1b69-44ac-b77c-7ca8e1eab694", "value": "3072:jqgXGNt5j4rK9mIDOxUrAM9WeYDfUrSbpoTOhzo8dTKX31y:ugw5j4KLDOxZM9WeWPK1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850765, "uuid": "1662c217-b006-4ee3-8b88-68f42015a8a8", "value": 215960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850765, "uuid": "73ac311c-5efc-48a4-85d3-1b314e3dc300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850765, "uuid": "850761a7-b109-4d5e-99ad-dd47af7cc4a6", "value": "kezi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be513986-0cdd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658838203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838203, "uuid": "20efccf6-05e4-4904-a43b-5541beb2de7c", "comment": "Malware payload (AveMariaRAT)", "value": "82dd6cb3dbb60479a5cc35ffb70a6355", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838203, "uuid": "1b95bf05-2393-4f81-a03c-449eb002919f", "comment": "Malware payload (AveMariaRAT)", "value": "5c60418e0f72c3eb550775b8c0fee8672ded9e2c130c9157a239112a5f9f2307", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838203, "uuid": "93bd9ea5-19fe-4cef-a9bc-44119c461067", "comment": "Malware payload (AveMariaRAT)", "value": "3a6aad7d5e62b4c0fef313baf2d9048b2822baf9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838203, "uuid": "bf88d058-e6ac-4692-a6e1-d07604aa2d57", "comment": "Malware payload (AveMariaRAT)", "value": "b85af0a0322fd28730601111baed9005c8304fda64869018be1aedde321b3c4bb319f9ff7655703e3f7397b8f48f210a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838203, "uuid": "9a92e556-292b-4f76-9d12-c42ebf8e7ee0", "value": "T11E15125D6AA49F07EEBC43F94420021457F53A563562E7284EC2F0EA3F66BB0594BE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838203, "uuid": "67d3686b-1824-4663-bd01-c6d7ae423489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838203, "uuid": "dce39463-f201-49c0-a70c-892d394586cb", "value": "24576:ecLw4UZvybcv8v+VE8NRZ9xx3FaDz7+Q6xWP:ecL6d8mVhN6fqQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658838203, "uuid": "572307b2-eebc-4196-b5af-152af147bf89", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658838203, "uuid": "bf8b3eec-1f54-49cc-b946-9277b0a8251f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838203, "uuid": "e6820eab-b08f-4da9-b3ef-32a51b6a49e4", "value": "RFQ Number OQ22018931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7934f66-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658824904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824904, "uuid": "b896a794-7352-4d0a-afe8-2370983bdba6", "comment": "Malware payload (SnakeKeylogger)", "value": "830d02f20db00690135de1b3b91f8c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824904, "uuid": "be92b405-8f15-4c36-b065-6cd08b90e8cc", "comment": "Malware payload (SnakeKeylogger)", "value": "5c625ac71a0a084ad0bc6c1cba64598647d40cadf93ae5f2d8efbb9653f657c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824904, "uuid": "3ef7da51-70f2-414e-93a8-6cd114d9e58f", "comment": "Malware payload (SnakeKeylogger)", "value": "b27a8b1a7350f711cdcb5bbbb79cff90c3285246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824904, "uuid": "1507ca82-ded5-4f38-ae96-7f99655a591a", "comment": "Malware payload (SnakeKeylogger)", "value": "bb62a456fff98bd495569fe6e65126836be96e569e1e433378d927077d2391df8ca79ecaf2a3f79e335fedb3354c3ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824904, "uuid": "bd876444-020f-40ca-9124-ed2599f05453", "value": "T17745AEAC351075DFCAA7C6B989946D24AB203CB7570BC607901331ECAE3DBA7DE154A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824904, "uuid": "4dd29e06-ab22-42b9-9c6b-3c7e462c2209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824904, "uuid": "3a037273-8ba1-4c12-9844-4b657f8c96b6", "value": "24576:Zw4UZvybcv8vJ45GDCE6w83ga6YxnIPHZvLe:Z6d8h45fE6Jwa6JPHZvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824904, "uuid": "9612dc0e-b637-459f-b27c-b82fa05c6a7c", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824904, "uuid": "0b8dafd0-a1dc-4438-b89e-6cf60c030038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824904, "uuid": "ceb3dbed-bd13-44b5-8aa2-588f35e38ede", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7499.10185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effa855c-0d21-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658867492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867492, "uuid": "77c4bff0-cd7a-4a55-aa1a-7a2874096a47", "comment": "Malware payload", "value": "ca440503d2d2b7ae5e849b0910c53566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867492, "uuid": "6df7428b-5308-49f7-b27e-254a5b6aee54", "comment": "Malware payload", "value": "5cdca77b21c0831877df4e8510074d56319e3080edb43990c4a7c11c85881ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867492, "uuid": "5d473816-fb7a-4fa2-a0ae-7ba5a34196cc", "comment": "Malware payload", "value": "a187dbf643dd906568d4d1d0e6b69616dfc25c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658867492, "uuid": "133a847f-f19b-4795-af87-7b909147806e", "comment": "Malware payload", "value": "6f6ffaed923d9229221d7fcf65e081f3bec6d74dea0390ec1a073014cf073b9be5c70c8b40f66923ee09e83ce59ab924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867492, "uuid": "a12216ef-6516-46b9-8023-9dc20351dccd", "value": "T195954BE3512CCF3AF01157F65A0246BAE813B65590F72FBC7DB08728AE662257450F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867492, "uuid": "a6db7120-b505-404b-96a8-bbf2e9879469", "value": "81edf760848ebcbb96ad3bd218fd7dfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867492, "uuid": "a1c39ecf-bdd9-47ae-8fa2-c7a1bcb8607b", "value": "49152:gpLTEUbngNfr+wcYMWiDqQ5oVpI/Rz2CO3Inrst1mJKt:0LTHATR18oPwRzT5ntJKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658867492, "uuid": "ddc65905-3443-4730-ba5c-ed4d79dd191c", "value": 1952696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658867492, "uuid": "cac43a88-e7b4-4c49-9eaf-da37bbe40a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658867492, "uuid": "4123ee56-56cb-423d-97a4-7e231add775f", "value": "Genshin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6521cb-0cee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658845584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845584, "uuid": "5909d90a-0666-4f1b-88e2-e33cbaecf289", "comment": "Malware payload", "value": "bc4b1cd84c906b728fa3a5a3266c87f9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845584, "uuid": "f8a26d0c-e046-488b-bf48-5395cfe37b86", "comment": "Malware payload", "value": "5dc83930672857fcfa8c2db7409887eebc5c31a4b95127f87a1177fedeb1675a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845584, "uuid": "e130d4a2-a9bf-4e14-8c8c-12b14b87f6fc", "comment": "Malware payload", "value": "8900ab2d382aa3304bc561410b727313e1fd371c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845584, "uuid": "5f9445ef-6b87-4006-a451-5c205fc7af85", "comment": "Malware payload", "value": "d2ac48d1e4bf9c6e9af5a6c09a6347d948195cb028aac0d42d2ff18aa48b9d598f8abe1a6025b43b7fe7ccd3870a0c41", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658845584, "uuid": "7fb2b301-e823-49b1-aed5-1fdfd4c1f005", "value": "T14E61626273F5C5E6AA0220E2044D802620F9D33324796C89F1EDD383EF496B0B8DD77A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658845584, "uuid": "4e10172e-9a88-462f-bea2-9ad62b9f46f3", "value": "96:DCDU85rkN8UHMFj7jQtUQblhMnVJy8a691MG1MG0MbxEsrkOOQfeJiC:yVkN+qUQ8nVJy7OeGeGllE+kxauiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658845584, "uuid": "545a4d45-401b-4bda-97d3-a04336dfef4d", "value": 3366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658845584, "uuid": "078f28a5-37fc-41cd-b58b-494794ea081c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658845584, "uuid": "d826fee6-680d-4213-981b-8b41b4d048b0", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d95b42-0d1c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658865216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865216, "uuid": "a43642ae-bc89-4cde-ac54-ea9133343fb6", "comment": "Malware payload", "value": "43826786a639479252ce89ae86a1d63f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865216, "uuid": "91b0613d-b780-4dbf-b160-8de677c4feb3", "comment": "Malware payload", "value": "5f132286f647d41186fe3b64f3deab79eb708ef3af274f1b89dc9c6f672b6bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865216, "uuid": "cd250ee6-b5df-4e3b-bdfa-c61973e150bc", "comment": "Malware payload", "value": "02bab8e64ec1fb6d36bc6d2d53f63bde27989344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865216, "uuid": "86e6f5ca-92df-4cb1-bea9-67fb02f98da1", "comment": "Malware payload", "value": "16a286fe14481cde0f270e015b5a9fdb2ee4c5e734d50d36f893cd8fafc51fe0ab9734add6db50ad62f52d8aecf9c4c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865216, "uuid": "985994bd-c544-47a4-8d92-29ff722f036d", "value": "T1EE438C69E88834D6D56D41B6C6427DAA323277958ED9CCCAD028BEE312A3F31FF05741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865216, "uuid": "e9291bdf-3321-4587-9385-a16666b0cf69", "value": "1536:k4U9n2bKNJp6Os+rOo5qgn+gtTkiHhKC:q9n2bKNr6f6Oalkio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658865216, "uuid": "8ecae326-04b3-4a3d-8ffa-d0d4cb92d7a4", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658865216, "uuid": "c0b6e622-a1ed-4418-8e4d-ab37f2d4499e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865216, "uuid": "816d1038-b7b6-48eb-ac4d-f7b534e69799", "value": "5f132286f647d41186fe3b64f3deab79eb708ef3af274f1b89dc9c6f672b6bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e8eea1-0cb6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658821281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821281, "uuid": "fc924d8a-ec4b-47f1-8080-7f9fb0eab05c", "comment": "Malware payload (Loki)", "value": "4279ce9bd4471f0528b5f97f169772b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821281, "uuid": "67338855-3cb7-458e-a84b-726596c693f4", "comment": "Malware payload (Loki)", "value": "5f3106c4d1ca3e2b65c50034ff4b9fa597df5278265686760a78967b32a5a78c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821281, "uuid": "6306d7e3-9a74-47f0-9c6f-d3e2cf41de6e", "comment": "Malware payload (Loki)", "value": "ea38f8a1bb39f0c3951e04b2d6e442aedae97fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821281, "uuid": "c473f04d-3ea3-4572-bd2a-fd41e4249e04", "comment": "Malware payload (Loki)", "value": "8356193864666ad745b04b6e4982796cd940c25e039c63f439234e4e8b86faf6dc05d3368aeb1cabe79f0caba6472a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821281, "uuid": "f3750fb9-5d1c-4d74-b6c4-d9adc805d046", "value": "T14254E13DB7A5C817C4C109B49D72A99FB8F0AD1029689A9776103F3EE63D283DA1D317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821281, "uuid": "25bf8266-bfdd-4f44-9524-43a0cf099a85", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821281, "uuid": "a487bf37-a776-477c-a8ac-be62932c492b", "value": "6144:iDYa6lZYbjBwcuPnpvAkBcG4k/Ox3jV/qXRCfB:aYzZYbjacCBq3jwBCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821281, "uuid": "d2c20779-ba97-4b06-93bb-e648f4a9df6f", "value": 297664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821281, "uuid": "3134d462-0268-4555-922a-53d9ad30af73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821281, "uuid": "ebb88213-4834-4871-9172-c918c7c2eba9", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9343.22981.32711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3bfe18-0cde-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658838599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838599, "uuid": "621d3762-4d5f-4639-b6bd-badee5844abe", "comment": "Malware payload", "value": "21c0c10510485cf916e1450135897463", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838599, "uuid": "4c960409-f063-4e0d-a77f-a5d88048519b", "comment": "Malware payload", "value": "5f47668ceebd2e8b4b78d34a3a4b8fc18e9ad570201855360af01ccbef372b14", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838599, "uuid": "e584a644-abbf-4cb4-a321-5898a8d7656c", "comment": "Malware payload", "value": "d535f797fa55a728555e1bece9df9de173425cf7", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838599, "uuid": "d868fd58-aa4c-4c51-abcc-bcf510705088", "comment": "Malware payload", "value": "b575abafe36ee4c54ed9e0ed1ca335445a63dcc5aa3d9d9980104da83b8a851ea46860108a11d8b677dfbc4dc1a95a57", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838599, "uuid": "32f54246-9906-4604-b8c4-f5690c71196c", "value": "T1490733E1ECD49A07EE7A52B2202DD42416DC07EE9ADE2183CC5AD6177219237D70F6E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838599, "uuid": "208d0ff4-51fb-4cd4-918e-c5859b4a6adf", "value": "393216:bUzqt9hi2Kd4UUA51S4sf0eME3AJBbs51uViVfg:boqPhiBd4lmg1M57i1uViVfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658838599, "uuid": "60545ebb-3ae6-4f5d-b7ea-6882a0cbecee", "value": 16822129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658838599, "uuid": "93ec3479-24b6-4acb-87ce-9857d9734c44", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838599, "uuid": "0fcac8e3-663f-4baa-bdd5-a35f9a7f42d2", "value": "MalwareBytes Premium.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b7fa4c-0cb4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658820658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820658, "uuid": "e584bd6f-ef61-4d33-b033-2081f7612493", "comment": "Malware payload (RedLineStealer)", "value": "be0fa98d2bec074cc3b5cc7b1e5d4bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820658, "uuid": "06a9f2c3-08ff-46d7-9635-fdd72a170d2b", "comment": "Malware payload (RedLineStealer)", "value": "601ddb608c894200875c864df531c61ebedbf9351ae21e17bd735dfd4abf4d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820658, "uuid": "147187e1-c949-45ca-a675-24118b4872ff", "comment": "Malware payload (RedLineStealer)", "value": "1904baf289c462d8d361d9b1a4305046c9f6024a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820658, "uuid": "1b379889-6937-4227-80e8-ce9e7b7655ee", "comment": "Malware payload (RedLineStealer)", "value": "c429e63fa9c7481548e2f141165fb06ca8662977c232e0747ab1be94b2b90e561482159a2df728357b3daadfdd5edabf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820658, "uuid": "c47ce32d-3727-44c9-9fe9-c34e11f3fd27", "value": "T18F94CF00BBA0C03DE1B312F47975C3A8753A7DA0AB2451CB32D67AEE56356E5ECB5207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820658, "uuid": "62b8053f-6810-450d-a95e-c487c5d69d43", "value": "e6c3aa777d2861625d0bcdf9e9a3689d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820658, "uuid": "72106722-e902-4141-aeb5-ce7f5938e3a7", "value": "6144:7SsCFsYZB6hxST55YfdxrteI1EJvtjJnLj4VmJpUyYkr0QsZB612/kF3Ch0mNf:7indKteI1EJvt5Lj4VmJuaOp63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820658, "uuid": "be50fa70-01a6-4263-b9c1-95e75d55f9cc", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820658, "uuid": "2ee665b7-7949-40e7-9178-75400e13d3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820658, "uuid": "7de017f4-dd83-4686-8952-59c08d390ec5", "value": "be0fa98d2bec074cc3b5cc7b1e5d4bc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3496b29b-0cf9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658849998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849998, "uuid": "d74de911-e573-497a-ba92-d66ae8750567", "comment": "Malware payload (Mirai)", "value": "538ecf74f221254a76d4f4fd6528f8c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849998, "uuid": "9ff7034f-eada-40e5-a484-f550dc8a27dc", "comment": "Malware payload (Mirai)", "value": "611fa4da8b4f139311acf4b407d24db8ad44539346c5f9957fd3f1fc50a5a726", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849998, "uuid": "ad91a34f-796c-437e-b489-9d80aa5dfc9e", "comment": "Malware payload (Mirai)", "value": "28ff1a469e355ac13d77e8202aca563b9f952a9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849998, "uuid": "ec736fb8-3d34-4088-9828-9f8442f00be2", "comment": "Malware payload (Mirai)", "value": "57ee3d3147f1a82add6da7a560641b7f3911f8ec527ae17c286244de11c00a2aa15002ef2512e76fb370d0b3789f7344", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849998, "uuid": "8bc8183e-2dfa-48d7-abc5-27978a4416c5", "value": "T14A336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849998, "uuid": "6fd0a425-ff19-40a3-a33e-61933e1c4fa6", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849998, "uuid": "bd05c3c6-4631-4f48-b622-609184e457cf", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849998, "uuid": "c7aaf5d6-e619-49a4-ac33-80435bee804b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849998, "uuid": "2548d12b-2064-4b43-aab2-cf9cee2a4f39", "value": "538ecf74f221254a76d4f4fd6528f8c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b0adf2-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (BitRAT)", "timestamp": 1658851206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851206, "uuid": "e9e467ce-71f1-412b-b7aa-4e0508f845c5", "comment": "Malware payload (BitRAT)", "value": "c0aec085c4a40d42297566227d175847", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851206, "uuid": "1e18036a-1f4b-499a-a371-9cb84762a3db", "comment": "Malware payload (BitRAT)", "value": "614d76652c2200e394b860c180e9b44f3bccf99f172bea1469db0b9379c99dc2", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851206, "uuid": "24101aaa-1bee-4ace-9ba9-356e3658a937", "comment": "Malware payload (BitRAT)", "value": "109514c9f0e1738b359db8623e3208c40f9dfd95", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851206, "uuid": "d385162a-2002-4309-af37-d9d051832031", "comment": "Malware payload (BitRAT)", "value": "5e6a512a0336bbe1a5f3dc4c3810aa421e5fe8eddc7cc556170c8264580d99e21ac4060e65c5de92bb3f5b7e3d61b059", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851206, "uuid": "4973c243-b0e7-46b9-aefd-235e0a5d025e", "value": "T1D86533E11A4F977AF55A883C75BB0D03CC78D6A2216715067F6CC4BE60FFA512C88CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851206, "uuid": "b6e775ae-374a-44e8-9b4b-49b15b351e4d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851206, "uuid": "4d4da0e4-3d50-423e-99d6-d75f5de2b946", "value": "24576:AndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzNaBbXW86xqP:iXDFBU2iIBb0xY/6sUYYlBn6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851206, "uuid": "8a14c618-8cfd-4819-976d-b8bd0b7457fe", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851206, "uuid": "8154e4d6-74e3-4adb-9af3-cb49c6f20f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851206, "uuid": "e4d6f7c8-30a9-4a75-a681-b92aa3527dbe", "value": "c0aec085c4a40d42297566227d175847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a7133e-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801650, "uuid": "abdf08fb-f20f-4ad5-876e-d22b5f221e78", "comment": "Malware payload (Mirai)", "value": "b610dd1f7cdb4c5a3ef4666b45cc9689", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801650, "uuid": "c658f303-a411-4408-9c4c-855548094868", "comment": "Malware payload (Mirai)", "value": "6173f8f935e82aec316a863dca88073b4f028f229bb3c6087d445b361ca5e2fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801650, "uuid": "6369d1b0-faff-4793-9a96-a4814b04d8fa", "comment": "Malware payload (Mirai)", "value": "30e04adc0e4d14d422751156b0270aea6b5af487", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801650, "uuid": "7fe2e086-7999-4676-9486-983e62d9a654", "comment": "Malware payload (Mirai)", "value": "29ad1bef59f9dafdae9dd241406db224a11c8e99091131942c882730616ed2077c27d46c27b5f1ef278c53b285fd0630", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801650, "uuid": "dbd1aae3-da51-4810-9953-f8f94252ca51", "value": "T1E3B2E1F014FDBA84F7A02E74D6AF8A06D6B543FED38170A02A962140E6D52472DFD5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801650, "uuid": "4f900356-b2f3-4a33-bf70-08db94e09ba4", "value": "768:cw7pmvTDwnQxVKjojJ/zqqBa4ciKB/JKs3Uoz6:g3wwVvlDrciKpJHz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801650, "uuid": "cd01d0d5-cb59-4c31-95af-b17824de239d", "value": 24928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801650, "uuid": "8f05fd98-51c9-4958-8b95-54f59f5d8513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801650, "uuid": "011e08dc-42bd-4130-9153-a5c8c8e735f1", "value": "infect.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a11ddea-0c96-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658807487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658807487, "uuid": "a721aa48-7c3d-48db-8cb4-d0a85b41076b", "comment": "Malware payload (NanoCore)", "value": "6a0a1dd8044b5cddf7ec891217feb166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658807487, "uuid": "5e76f3b6-58a8-49da-85c3-8f6cb1c2ac5e", "comment": "Malware payload (NanoCore)", "value": "6233857ad2249fc7c394d63442e734ecf6397b55abf1cf47734e446a890fad28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658807487, "uuid": "01b437ea-d7b0-431b-9161-f1fe893c1776", "comment": "Malware payload (NanoCore)", "value": "95c2d588d5002848637afa7a9d8e873a05d93e03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658807487, "uuid": "b84cedde-eb19-448f-9789-09bd2a6ad0ec", "comment": "Malware payload (NanoCore)", "value": "356f0a6fa39163d9524455fbaf42cd79f46289570653ecca4f50877fc4ba644e34e70cc2ee22b1ebd4705e26695cc9bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658807487, "uuid": "d33cd166-be54-41e7-9aa4-15cb28de8bfc", "value": "T11505010473BC5F92D8BE87FD55A5548113F6260FA12DE34A4ED2B4EF293AF804A50E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658807487, "uuid": "b847c50a-81c3-45f3-9baf-4ce7e275a535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658807487, "uuid": "50f9a593-9ec6-4c3c-97ed-0aebef5b8eae", "value": "24576:Xq/Nl0jGsILtATQQ4QvCFx4xHwWqNaPmPhbwDQOvi:0l0jGh2jm+xQ6OCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658807487, "uuid": "8414e0ad-db26-4adc-b89c-867212c306c0", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658807487, "uuid": "629af062-b477-49f7-a897-cf98534d61d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658807487, "uuid": "9a2a353b-356d-4b76-bd51-9f3a8bbce3d2", "value": "6a0a1dd8044b5cddf7ec891217feb166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69f1ece-0cd1-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658833036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833036, "uuid": "5debcf65-5848-429f-9132-0f9367dd9177", "comment": "Malware payload (RedLineStealer)", "value": "d851b704656be866ccc03157091e173f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833036, "uuid": "270d0599-8359-443e-a199-c628469af081", "comment": "Malware payload (RedLineStealer)", "value": "628b602322965197ac592bbfbb1e68bc64f7be1c1cb0868e12acecc513da8ef4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833036, "uuid": "7662fb01-d997-4ecd-807e-92528ba68382", "comment": "Malware payload (RedLineStealer)", "value": "f1efecaead237efe0e053a7db6085f63d0a7b8c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833036, "uuid": "16cd971f-027f-41d5-acae-fd5049c230e0", "comment": "Malware payload (RedLineStealer)", "value": "46275f5c114720756444f2e2e3a6c258b0ee64d077d050c5fea689c149cfeb355b276b400f1521377b3f2d298e1a477d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833036, "uuid": "8503b677-46e7-4353-98f1-d1128d29480e", "value": "T14B648E00B7A0C03DE0B711F4B97AC3A9A52E7DA05B2055CB22D57BEE56386E1ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833036, "uuid": "60cd6bad-12ef-452e-8814-7973a78a4a7a", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833036, "uuid": "1ff3b3ca-0d43-4462-a946-8f6a65b23a28", "value": "6144:SWWmxzBsCoXffMErUHXFHJiDuYHiXBaxaotc5k+O:S+ItrUHX/JY+ax7tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658833036, "uuid": "4dec8e23-597b-4e1f-89bc-a038d77b9062", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658833036, "uuid": "071cc601-a548-453f-b00c-23a80e63d1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833036, "uuid": "28756560-ccde-40af-9e8e-47027dd3cc87", "value": "d851b704656be866ccc03157091e173f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa484e60-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827003, "uuid": "a1c65643-ad0f-42c8-b4d4-f7f9737c3cc6", "comment": "Malware payload (Mirai)", "value": "cac2f56dc580174b87bede4495a7085f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827003, "uuid": "eae856dd-79dd-4e79-9b90-2d688d58a8e9", "comment": "Malware payload (Mirai)", "value": "6319bc11dc13a43959eeeec1a019e5b67b8e0003341d471a88264546ba83194c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827003, "uuid": "20e416cc-4ddd-4665-ba80-fafcad760dbd", "comment": "Malware payload (Mirai)", "value": "18f6ea2cff2ff6595805318d7af81cc4cf1d6f91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827003, "uuid": "9923b93a-fcc3-463c-80ba-03e2377d587e", "comment": "Malware payload (Mirai)", "value": "a833638b9272514270e9e90b2314a893b86c4bd10be39f68446ed74b6a16f0c47e13ff68e59ea09f80e98e8a35196725", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827003, "uuid": "1491c247-1889-41f6-b8e5-d8bda14a190d", "value": "T120E2E0A986FE8739CAAAF1718A9F7B4C0844E15E7158487F65D0212FF9F0D383932791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827003, "uuid": "29609b9d-f813-42d1-8c36-171f049ff6af", "value": "768:EW72r+gDdLzh8mI8oNqwj3T4N1G691dLxyeP6OA4flnbcuyD7UtQRjW:E9igDRW8oN/3cN1Gs1pwyFA4lnouy8tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827003, "uuid": "b28dd8b9-133c-4acd-8782-fa8f19ee5e5e", "value": 33060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827003, "uuid": "1828761c-a74b-49e4-904d-1664655b0b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827003, "uuid": "b9871e03-c2a8-4bd2-bfc8-f21fa216b708", "value": "home.x86-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659d754e-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877998, "uuid": "35551bc8-b828-4454-b8e8-80bfb8d3b6bc", "comment": "Malware payload (Mirai)", "value": "6f14aba161c1d22d13986d7d26db7f33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877998, "uuid": "47193ac5-6193-49fb-b19e-925165ab2209", "comment": "Malware payload (Mirai)", "value": "63335ab1143d984754b40b5194ccb112fcadf73d65b3136e1b63c712b1ab1ba9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877998, "uuid": "1a365171-163b-4071-87d2-87a603166130", "comment": "Malware payload (Mirai)", "value": "21ab83d20b662762dca864f58f8227229e70c1a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877998, "uuid": "ef826c6b-e7ee-4da2-9a18-15aab366cf0c", "comment": "Malware payload (Mirai)", "value": "22525fa61b93b4ea2f901c90e3b8ef3833d117b280df2d63fce411ce18fe6e64a74fcf70097fb370978b380bfb135a7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877998, "uuid": "bbb2ed6e-2e02-4bc1-99be-4a2064e5ddd5", "value": "T1BC534A51B8819613C5D4137AF6BE468D3B2523E8E2DF32179D222F413BCA82F1D77A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877998, "uuid": "c0cc6f86-e4d1-4530-87bc-0c10396cb2f6", "value": "768:1v6aHMLIZ6hMuu4B7PBdxnNIDKU0vVeNSA4sjKd2GcNMbhlQHBc3wJZY10UOZvBO:kaHmIjYbbnMKU0NeNSA4aMD2FJa109B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877998, "uuid": "3a1f22f7-752f-4eda-8371-7e40210a47d5", "value": 60768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877998, "uuid": "3517b8fb-a32e-40e5-87da-2923aa85798e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877998, "uuid": "2dd1948a-f1a1-467f-8659-e7714acd6e35", "value": "6f14aba161c1d22d13986d7d26db7f33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa061c6-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658824864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824864, "uuid": "2a7b6fb2-6721-4a8e-9216-f72cf90b2de6", "comment": "Malware payload (RedLineStealer)", "value": "9ed47f3a0445bd28e919ebf7acdc1836", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824864, "uuid": "35c79758-96ab-47cc-ba59-a363a3da8a57", "comment": "Malware payload (RedLineStealer)", "value": "6420ffadafa7040c82dfc3a6d2b03526f193ff1f30238089d29033404649261a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824864, "uuid": "24d0fa5c-e390-400e-b0d0-3af89e2657f7", "comment": "Malware payload (RedLineStealer)", "value": "290fffbbff7dfd1e0395bf8dea8315a47d057a0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824864, "uuid": "6eb156bc-0f06-4d42-8b80-aa52053a8b49", "comment": "Malware payload (RedLineStealer)", "value": "3770472a35fa31f59eea8793d9614a7f7a903b734c29918480417e85de424fa4b66538b80db4abb22bba74838e47a3fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824864, "uuid": "ab93574c-48a3-488b-9797-c4e18687bc09", "value": "T1E694CF00BAA0C03DE5B721F4797AC3A8B52D7D909B5051CB32D53AEE56782E4ECB431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824864, "uuid": "840f7599-88da-4c51-bbd5-f69d5274ac1f", "value": "504d97a665c5990d2e90f1479886157c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824864, "uuid": "c3874285-9462-40aa-a521-064b5714529c", "value": "12288:pQHeS96dU337H1bM8K6aDFIMJ6Pk3XubS2:QeKl7V4vsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824864, "uuid": "665eea8a-86ff-4ff2-ab7c-c20767b5f1da", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824864, "uuid": "e893a707-fed6-492f-b762-976baa79e8e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824864, "uuid": "fb58e909-0894-4177-ad4d-890ea7ba0675", "value": "9ed47f3a0445bd28e919ebf7acdc1836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76e7cac-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658817979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817979, "uuid": "3904b2f8-3a26-48a8-a6fb-e3bf9ed389f3", "comment": "Malware payload (SnakeKeylogger)", "value": "4934aa26c6b0551cd0023ab0b7b2ab45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817979, "uuid": "0fd249a2-1672-451b-b5f8-74a327caa789", "comment": "Malware payload (SnakeKeylogger)", "value": "657b739d214b81d4f6a3b5a5ea325b0ecc4fbef2e26a907175b4517924f56d30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817979, "uuid": "d12e9d12-5762-4d2d-a747-e742cc516041", "comment": "Malware payload (SnakeKeylogger)", "value": "02a254421255922445cdccc0095adb226c3ebd53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817979, "uuid": "8307146f-2e7e-4024-bec8-145defc52f08", "comment": "Malware payload (SnakeKeylogger)", "value": "4cefea0d68f73ded2dc1c26957abcb278a070cf2731e9de97241b5488c3775e6f4d1195b2168c0c11a41506461048116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817979, "uuid": "f61a06b9-1183-43f7-8f0a-af022369edd9", "value": "T1A1F10E2CEF884277DAEBC331B8630A01F5FC51672732CE2E96D2224D5E0B646B557369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817979, "uuid": "7fb3b332-4dcd-44eb-8fe7-9ec10a3e0317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817979, "uuid": "931e49ec-17eb-48c6-8a41-53b1f2ee6626", "value": "96:n5jsOru3ahbecC6fAgjEgjbQw6fTudO5ehk6KxVZoUyc73xzNt:J03EFtfAEEgjbQvCQJbZoUy4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817979, "uuid": "6ca35246-a0b4-4798-9f77-78e60e926460", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817979, "uuid": "12e9fab6-a83c-49cb-8fdd-ef061490e7b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817979, "uuid": "f3afb637-1270-44fa-8ba1-3a924bf50ca4", "value": "mLTQD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f452bf5d-0cf0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658846454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846454, "uuid": "7377c0e1-79b0-4cdd-8992-4ea527afe026", "comment": "Malware payload (RedLineStealer)", "value": "61c65e7d8f3b8d3d91492af45bd6b2df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846454, "uuid": "26a739d4-e5e2-49c2-988e-e8f5eeedbb37", "comment": "Malware payload (RedLineStealer)", "value": "659fc25606a80029012436848c7901b37fb1c580506fbbd1c0617a2855a5b44a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846454, "uuid": "63493969-d440-40e3-b309-8103fa663f09", "comment": "Malware payload (RedLineStealer)", "value": "ecfc8eabc2782e607c2a5102616c4cdbfb3950ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846454, "uuid": "abc7d984-499b-40ea-bdb5-a76317c59c9e", "comment": "Malware payload (RedLineStealer)", "value": "bf44ea63aabb918fe7f434a2ae5cd8670c6ef5e8b218cea76d33fb1c1ea9c153d5ff70a6df235271e2dea8ad245e60ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846454, "uuid": "6a11e4f4-2d53-4258-81c6-70d245e7a3b5", "value": "T142E5D06DFB0655B4D663A2B5819EDFBB9614B929C031EE7FFF8ACA14B4330133905182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846454, "uuid": "881121cf-3fa0-4971-b0e8-8d553f625802", "value": "88b769756fdd2a37213ec16c474eaa33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846454, "uuid": "bb376eba-5be8-4117-b3f2-56262dc41165", "value": "49152:jkufeeYsuuPuV4PMdzgPO5+qBgL5/3iRbO8WbTaPVNYdNZMPIxHJi6PIhOF:jku3mVTMyoDnyV6NyPIZJi6QMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846454, "uuid": "f75ac436-d609-454f-b564-a3fbacb90727", "value": 3072512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846454, "uuid": "52c596a6-5cf4-4ec7-bd49-e7eec1cbcf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846454, "uuid": "8e2dc9b3-e2e8-47f0-a5af-fe636aec6f47", "value": "659fc25606a80029012436848c7901b37fb1c580506fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b067278a-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658828731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828731, "uuid": "0a24dd3a-e8dd-4be6-a7dc-9dcc8da7dab8", "comment": "Malware payload", "value": "3e32af04d1889f573f02580a0f9c7672", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828731, "uuid": "e6c33d98-a7f2-48d7-8a38-7e7bcfa15f21", "comment": "Malware payload", "value": "65ebe5a2cd3b0b8c3af7224c54454f8f9e7d172e2ddf8b4c0bafaa46bee11a4f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828731, "uuid": "d8f2979c-42f7-4995-ae0a-738aa2f1d750", "comment": "Malware payload", "value": "c2e2bbb8c82c1e7ece5c7499a1e9d63f491ea1df", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828731, "uuid": "5fedb153-91b9-46ef-95a2-344fc8c9e0ea", "comment": "Malware payload", "value": "e8a645dbd6576fce25c5ea59a73c03169875ec2bf5644cdf255c30074bcc78e25e2059bab578d7d0faf651a30c63d6c1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828731, "uuid": "e3ad76d6-4fee-48ee-a2fb-4e6d67ec1616", "value": "T1AF161505D17DE6D9C337A730684D5FFA8F789408662607B36184D124FEBAA208E71DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828731, "uuid": "cb9915a0-398d-45f2-8ee6-d5c943cde39d", "value": "24576:Z9PXMpsuLQY4irQ5QrilYqhti0Wj7aTL5MT2FYfSB0betgH6p8Dm1IPCxkLOdQeN:ZOILtgglpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828731, "uuid": "0c4921f5-9ef3-4d98-80a8-6c38760007e3", "value": 4020736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828731, "uuid": "eb34a408-fe24-42fa-86fa-135e90be039d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828731, "uuid": "4c47583b-8798-4149-ac20-790ef5cdd4c2", "value": "SecuriteInfo.com.W97M.DownLoader.2730.4223.5363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ad70ca-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658851127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851127, "uuid": "9011770a-f622-4e5f-86b4-979203ed0fd8", "comment": "Malware payload (NanoCore)", "value": "f4afae9fcd187aab035053c38630ffcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851127, "uuid": "ea911e9e-63b3-44e6-81c5-33685886da95", "comment": "Malware payload (NanoCore)", "value": "66ff672b93bcc0ef9e19ba4a45b6f6c1943c21fe6256d2a0e448bd73049a7a6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851127, "uuid": "8283bb94-c30a-42ad-b218-58ffbde1f23d", "comment": "Malware payload (NanoCore)", "value": "c68526bd091d50197b52d73e494de011eb0eb7f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851127, "uuid": "84e63048-8677-481e-bf34-703a03293afa", "comment": "Malware payload (NanoCore)", "value": "4b11c0078d21aa203def3364b9ee07f17297f203b26d3ec1fc0e9b0af572d1879d48035c4a6e184fab7adbc456da93a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851127, "uuid": "fa2ab7e5-3585-4e71-a4ce-bead8e6e25c8", "value": "T10B35AEAC351075DFC86BC6B98964AC74EB203C66530B9603909359EBBE0DBA3DF054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851127, "uuid": "91213085-8539-41c6-b53f-08cf25892885", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851127, "uuid": "8ff685de-c9e0-48e0-84de-594723009448", "value": "24576:Ow4UZvybcv8v4M5Prvi/CBgdUx8oyeducQcx05lxwCH:O6d8FPr6aBWAE3c8ICH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851127, "uuid": "c320c750-da88-46e9-b722-b81336e4783f", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851127, "uuid": "79e216cc-3fb7-4288-b133-35803e0a456f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851127, "uuid": "24a56dea-1338-4e53-b82f-ea29a964ad85", "value": "f4afae9fcd187aab035053c38630ffcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3e6457-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877984, "uuid": "ca62ac60-c916-4e05-91b1-52c0b2d602b7", "comment": "Malware payload (Mirai)", "value": "0756da31e13965bdf56f5a4bb2bd2688", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877984, "uuid": "d5961b91-2a52-4683-a511-fc3a186a70d6", "comment": "Malware payload (Mirai)", "value": "680d74430092958d3d1dce5bf9f7af63ea0526e483357f942b4a8ccedeeff7cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877984, "uuid": "7ace6c43-b210-4104-bb24-cd213f14565a", "comment": "Malware payload (Mirai)", "value": "6cccc9bff06fe28e040c97e98fedd41467a617cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877984, "uuid": "bd849cf3-faec-4810-8aba-58ead5e464b3", "comment": "Malware payload (Mirai)", "value": "3037c5e626d1c23f61db61eed1676ec17239e34aece29a942c4c233ae5140d40d9483aba65ff5068bed133fcf7243258", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877984, "uuid": "fdfd4ae5-1efe-4086-be9f-964046ba6885", "value": "T102432B95F401DE7DF90FE6BD44164E09BD3063C262830F2A27ABFDA36C720666D16D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877984, "uuid": "9019f3f2-ade0-45e4-8859-324f54c243f5", "value": "1536:3iBzsT8nLbAy/lFw4S+aXLbTXVwZAfuN9MiKQi8bNLUWQ:SDnvToPRwZAfwMDQX1UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877984, "uuid": "4811b20c-ce81-4cae-9934-1c1cf23fe2d5", "value": 60456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877984, "uuid": "fa2bba89-6f30-4c20-b978-d5edd5c39893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877984, "uuid": "50315364-4b9a-4700-9aa8-7dbf8ed58c58", "value": "0756da31e13965bdf56f5a4bb2bd2688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c7636e-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658878005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658878005, "uuid": "6d82110b-fa8e-4db4-a0e8-eba856632b14", "comment": "Malware payload (Mirai)", "value": "5f6ceee5129cc6faf36f40d58474a21e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658878005, "uuid": "31886cbf-9b80-492d-a239-fa94152c2c98", "comment": "Malware payload (Mirai)", "value": "685f12dafbf345c152fafec1db70ee76e586c6a33f51b5c45a82fe9a06295d35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658878005, "uuid": "2a43a70d-1e33-494c-a00c-f07f055e3506", "comment": "Malware payload (Mirai)", "value": "5b267b8858f4cd446fea832a6bae22f20e0c03ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658878005, "uuid": "4ce56b20-a896-4d11-909e-586bf4c3d0a5", "comment": "Malware payload (Mirai)", "value": "e207780605255337f0c32a275ec9872b46acd07ac0ae6f5a888353ee35293e734b33c5e0730d63c97b620f04d4e187c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658878005, "uuid": "1fd9ccbc-3e69-49dd-805c-f074854462a4", "value": "T135438DB4E42A9D54D0850174A8748F750FA3F2C883621DF73AAA43B1544BEB9FA0DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658878005, "uuid": "f2502a0a-f23d-4e2e-ad8c-d1775bac8672", "value": "768:bm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfnA2JCHo1AAlbC2WwJZY10U:bm+JDpP/Z7VrGQDkA2Jb1lbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658878005, "uuid": "1290c253-fc16-4f94-9fba-e74e1684d48b", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658878005, "uuid": "37a36cd7-542c-458a-9957-d59518059f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658878005, "uuid": "e750858f-4178-4afd-b81a-cad9e4e55ec7", "value": "5f6ceee5129cc6faf36f40d58474a21e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab19b77b-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827004, "uuid": "2c1df623-bbf4-4372-8063-88ec180cb128", "comment": "Malware payload (Mirai)", "value": "f5c6dd27a0afccf8106d8f1c7efd0092", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827004, "uuid": "0c2e32d2-d461-4e42-9bf6-e16a57069e6e", "comment": "Malware payload (Mirai)", "value": "68870f0243b4ed928e7f5f91e9a720c6c4af51fd60f61b693f521a90e41ec782", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827004, "uuid": "5eff4e10-0dc6-42d8-8f52-6888d7a71144", "comment": "Malware payload (Mirai)", "value": "8cea71eb493fa3123ad290b53bdd753bce2fd5ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827004, "uuid": "5c57f95a-d474-46cf-86b2-f7c30587949c", "comment": "Malware payload (Mirai)", "value": "c39419a315d93437e0aedf638a61dc23adbc50b67064ffa3ee68b9330b0c961569f145deaca05a3d3a51ddd4a8037279", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827004, "uuid": "66614cc3-50db-4807-acbe-c115330b48b9", "value": "T114E2E172B2A85D74DC7460369A67C343A7AA3FFEF1E8706A36A486D490C081668F2543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827004, "uuid": "5cfea7a5-70d3-4049-860a-e1efa237859f", "value": "768:AH1SBk0CMcGDnZ7424PUYQAz22ZaL1Av4L9J1aYUD3iKrQwJ5ys3Uozv:e1SK0CMcGDZzRChZSVz1aYFM5zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827004, "uuid": "ec3ab80d-179f-4011-b48d-51a59d721e5e", "value": 32368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827004, "uuid": "269fee97-ff36-4e62-8a8f-b23f38b9198a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827004, "uuid": "85ef0947-2644-49fb-994f-7f9b06cb2ec3", "value": "home.arm-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed03331-0ce5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658841399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841399, "uuid": "5cc23350-4aa1-4e38-8118-6bd89c63fac9", "comment": "Malware payload (SnakeKeylogger)", "value": "84afae782259a0349b30807ecf1c468b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841399, "uuid": "f2f6695d-54d2-4672-b077-f19ce39f0eaa", "comment": "Malware payload (SnakeKeylogger)", "value": "68b959c62e1c7742a54f7660844ab2b633761155717d4a06bcd30c417fb23ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841399, "uuid": "784eb713-a835-4a54-b8a6-ebfde4def3da", "comment": "Malware payload (SnakeKeylogger)", "value": "2bf0fe01f8ccc3767e4a7c24aa8323cb6ac6f171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841399, "uuid": "da9807d2-77a0-4642-b43f-b75d48b325e7", "comment": "Malware payload (SnakeKeylogger)", "value": "ac6a9df8ba7b8e49a3421f1c8751c5c99ece573492ff0f6e6162da8bc0b6e36a5c97218c9dc728df1620f511c478656b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841399, "uuid": "74a8fe15-596c-472c-8fc0-d683ba020331", "value": "T1E8259DAC362075DFC86BC6B9D9A82C64EB6034A6530BD603901311EDAE4DBA3DF154F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841399, "uuid": "e92efc47-fd19-4c44-9fd3-3bd706fd3bce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841399, "uuid": "2df10d42-89a6-4081-bdd6-7e5210545991", "value": "24576:7w4UZvybcv8vs2662SDCFZSO3fNt2i056BhfxqLHu:76d8m62ug3fNtjOLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658841399, "uuid": "2381f31a-f8a7-43e1-8100-2cf33afb4876", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658841399, "uuid": "5e5f32e9-f681-4b42-a935-dd62b38bc393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841399, "uuid": "4a643557-021d-418b-a3c9-04cf79f78f34", "value": "Quotation Forms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46eb58e-0cab-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658816766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816766, "uuid": "fbf96851-b825-4415-ab5b-d09eaa2c333c", "comment": "Malware payload (Loki)", "value": "061da41411d1fd6f31eff7d308c04744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816766, "uuid": "0ff929a7-32d6-45b5-93af-265f941c3b45", "comment": "Malware payload (Loki)", "value": "68f59307fa2bbaeb969dd93da896001011f256205a06446f7f5ccaddf2f23c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816766, "uuid": "581bbf9c-8805-448a-b9c5-4558b723dd67", "comment": "Malware payload (Loki)", "value": "816d1dbc1da2b589322528afd654aefe703de318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816766, "uuid": "851adcd4-f237-4ff5-8449-dce721ea784b", "comment": "Malware payload (Loki)", "value": "800ddf2521a841553777449508190f30ba08cc69ae7287cbbb0f4c972d58493e3c887294647949ab35c346c05c0ee7b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816766, "uuid": "1a66800d-4959-4ef5-a3ff-70be5b71bc66", "value": "T13815021D2AB48F07DDBD87F94024050897B529263453E76C8EC6E0DE2F76FA14A4AF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816766, "uuid": "a69f2d9d-2e14-42fa-bc24-224d67685106", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816766, "uuid": "615f4394-bfce-40fe-9807-a850758a8b78", "value": "24576:XBc2w4UZvybcv8vI9/7cNfXXd3ycy5ONm0SfEx8P:XBc26d8Q9jcNfXd3ycy5oafH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658816766, "uuid": "06ac0063-6e37-4593-bc31-23cb34f06ed9", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658816766, "uuid": "fdd9d2fa-1227-428d-a42f-910a5d1646d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816766, "uuid": "2eccf948-c812-4adf-948d-8332ec8afb5a", "value": "revise invoice-26072022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48d76b4-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658851152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851152, "uuid": "c0652c8e-5d8c-4adf-b457-094896f10648", "comment": "Malware payload (NanoCore)", "value": "bb0c5b641434a05cea8ca07f625d9c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851152, "uuid": "1e7c9d4d-9c19-474d-87bb-ea8b6e5797b0", "comment": "Malware payload (NanoCore)", "value": "6976fc507b7c16f4bd34d26590f918b01a338754f23445b2f0876eb8e9a77580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851152, "uuid": "d848f047-0552-4ecb-8d09-ef9b0b06e237", "comment": "Malware payload (NanoCore)", "value": "1fa2320468e4131e5e50696637df42ab484a3e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851152, "uuid": "6eb1134e-0d54-4ad6-88e1-c23748b0ef2a", "comment": "Malware payload (NanoCore)", "value": "06fd807e71db145c1d9382d4bff27c7f2026892d0f5d10721c9f23e79e050f467df93c6812dad7873f6035fc564aca73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851152, "uuid": "3a20b551-2fae-4814-b881-1ce0e20c2287", "value": "T13C14CF563BE9492FE2DE867A602251139378C2E398D3F3EE18D454B35F267E50A071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851152, "uuid": "d349fcc7-315e-4d0f-8651-c33d975a2161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851152, "uuid": "7dec3e16-bdd1-41b4-85dd-70ea139d8746", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIJyuGTziui+IOIB3089u1L5WUj:gLV6Bta6dtJmakIM5VNilOIW8uxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851152, "uuid": "1487794a-df7b-40f4-8280-e1e6746219b1", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851152, "uuid": "85c95dc0-beef-45f7-a732-5baacceab8fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851152, "uuid": "a6284c87-2b29-4eec-913e-d45f5f5cf2f3", "value": "bb0c5b641434a05cea8ca07f625d9c5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e68a68-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658849254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849254, "uuid": "d626e814-545a-4788-a271-454fa1fdaf18", "comment": "Malware payload (RemcosRAT)", "value": "29e34f6ac4428d885814569fde955321", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849254, "uuid": "a8933d0b-8816-42a6-a233-ae94d4afa438", "comment": "Malware payload (RemcosRAT)", "value": "6988a0aa635c18ecdcba1e5d5adf79d97b7724ee531bdb3497d7fa7294a7455b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849254, "uuid": "0ab30f27-0db4-450e-90cc-f8d687be70b5", "comment": "Malware payload (RemcosRAT)", "value": "acb427f920b588403c088dee736ec4084c9cd948", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849254, "uuid": "f05580ce-194d-49fc-8979-d6d6ee16973f", "comment": "Malware payload (RemcosRAT)", "value": "0c0b1a72e6134aebcee5847f15a7aa42b9c56dc5c3e65ff80ba9a35440bde1ab4109423d906d37b3c388be5e855e9fb2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849254, "uuid": "ee7d3b7a-d8f7-44e3-963c-d501d94c0b61", "value": "T15904025E74184784FD60A3B7ADCBA760C8ADBD616D347B3750EBB59DA27EE0340A004E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849254, "uuid": "dcfbcb80-658c-416c-95a9-83b252cb3b7f", "value": "3072:Xwk0Rkhrl6OWJV59UtqPW2VflCY3OIh+aHy0Rn2EWy:AKhrMVV5QqPW2FlCY+IlH/Rn2EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849254, "uuid": "a12c53be-bb56-4a80-a5f1-bd66855a564b", "value": 185960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849254, "uuid": "5d19e4f1-a07a-4fab-8f77-869a08efbdf6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849254, "uuid": "54978b90-d510-4df2-b377-552ae3de987a", "value": "PK03522R0014343PKKHI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f10116b-0d24-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658868645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658868645, "uuid": "04c0c6f1-369b-4678-bb61-0fd972014a5e", "comment": "Malware payload (njrat)", "value": "26dc605946143f14420cb2213b006b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658868645, "uuid": "36bba8c5-88b7-4b0b-85d4-77070161f117", "comment": "Malware payload (njrat)", "value": "69cfac4e13c63eb0cbeaad0a395102f4e54bf6712d80838bdd012385c6fb617d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658868645, "uuid": "afaeb4ec-42c7-4690-bceb-729f5d718867", "comment": "Malware payload (njrat)", "value": "bffb892c1ac0db6e60a06e835decf5267f42bdbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658868645, "uuid": "fb25e8ae-9f2f-4007-bf78-285e1adb18ab", "comment": "Malware payload (njrat)", "value": "86514fc0a1f6f3b8ff0434d8b7e357606626185bd59d39feb7e023536a2c0917b05e135fc67fe04a0be9c3a24480a2f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658868645, "uuid": "f9e68c24-92de-420f-8158-acb305da3090", "value": "T15F940201362483C2DB4542F380EB662A23B6BD57657275CABB4EB7DE0F33367A91450E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658868645, "uuid": "f148f53a-27e0-42e0-8cf4-d42292eef17e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658868645, "uuid": "1bb2bcaf-153f-47a3-8d8e-bb86aa738561", "value": "12288:8ImaNhixDmWRR0GqvWRaRuzguaJhs0KIkUUR:lmKhQmCR0HcAuzJaJKlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658868645, "uuid": "ed08d3fb-e8e5-4045-a5e5-71a65eda6009", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658868645, "uuid": "3e5433b5-8626-43b7-8c8f-9f11905de343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658868645, "uuid": "e129adba-13b0-4c11-b9db-d829bed51d86", "value": "26dc605946143f14420cb2213b006b2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd88328-0c93-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658806205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806205, "uuid": "1e15d0ae-016d-46ed-abad-2d783f148194", "comment": "Malware payload (SnakeKeylogger)", "value": "c08f05d7046fdfc1953be17188ffa954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806205, "uuid": "45480dd0-6ca1-46a6-b6bd-bf868d6e4883", "comment": "Malware payload (SnakeKeylogger)", "value": "69fe492283320d5d9f00610d549c9a557093ca6e967416d522f0512cbe9dddae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806205, "uuid": "b77c1274-6c7e-4f4f-b40a-0686b96a88ae", "comment": "Malware payload (SnakeKeylogger)", "value": "b51dfe807db55d2af141df0617dc6ff620cf40ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658806205, "uuid": "b61b5f3e-60a1-4d42-a59f-a59273e97301", "comment": "Malware payload (SnakeKeylogger)", "value": "0a5a9338aa105f33ea69ba185d65693b7464c4f29a19204bfc56cddef783e045171f57c707d6411ff75ff74829f2ba43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806205, "uuid": "f01b5c77-5361-46d9-9cb4-6bcf99405b3b", "value": "T1BA15122D2BA42F47DDFD83F9442010009BB57A253597E3A85EC1B4DE2F76F614A4AB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806205, "uuid": "a4fa0821-01c2-4ea6-9d7f-8d5a45e6066e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806205, "uuid": "b67623fa-f164-4a6d-a02f-af92a17a4093", "value": "24576:VqcCw4UZvybcv8vqHBTMS6q/eptXP5CLdHsxYP:4cC6d8EMSaP5CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658806205, "uuid": "1df6be33-fb1f-4570-a3c5-7ac07f2eb998", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658806205, "uuid": "e5a70117-e266-4295-ac15-2ce7a56d27eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658806205, "uuid": "247397b4-b7c5-41f9-8e5a-b7f7e8f9ef57", "value": "SecuriteInfo.com.W32.AIDetectNet.01.6466.9900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe27da7-0cfa-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658850682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850682, "uuid": "058c0eba-f458-4e1f-9776-cec19a7616a6", "comment": "Malware payload (AgentTesla)", "value": "530be5e4562bec19cb5688609150704f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850682, "uuid": "b3622799-3f7c-48b4-9e67-fc5670290cb2", "comment": "Malware payload (AgentTesla)", "value": "6a3d0bdcae8c69a7b023a16a3d59d600080f1170e4030aab7431cd65f8c2ef09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850682, "uuid": "60817b16-c21f-4352-96cf-583510c65338", "comment": "Malware payload (AgentTesla)", "value": "27de6f83caf46d45e97d4262c41d84d1fddbce42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850682, "uuid": "b55ba2f5-690a-48ee-870d-f2e31c2e40c7", "comment": "Malware payload (AgentTesla)", "value": "6f0317fa38ffe672065731e6be1081a341d13b491b328282591d783299730f20949b9ce4f83b2b4315c49952c509db8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850682, "uuid": "3c126b29-b8d1-470c-b1b4-2e08f422fd9a", "value": "T180D46B9C3692B69EC917C4718FE89C64EA60B837970F5217942313ADDB2DDA7CF110B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850682, "uuid": "aa5a46b8-0c5a-4a6b-a8ff-39ff39fdfb43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850682, "uuid": "94d10e2a-3e3d-46d4-8726-9e61d7806983", "value": "12288:Xy72iNDXR07NsqCeG9E28AqR8G6qzWpmX+yydRYLmmr2GvdhyPgof14Enu:i71rCfCeotrG68upMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850682, "uuid": "799b9c8e-6f1d-4357-87c3-16c2b631f143", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850682, "uuid": "267ab041-59f0-4c5b-8cc5-bd3841da893a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850682, "uuid": "b594d35e-326e-456d-aba1-829443381bed", "value": "BL-SHIPPING ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85546314-0cc5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658827800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827800, "uuid": "c2d48efe-2d71-495e-be86-97cf75b7b65c", "comment": "Malware payload", "value": "b9bae75be99cd347cb405b951ac3b612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827800, "uuid": "827e130f-f0c8-434e-a1c4-1302d5359dad", "comment": "Malware payload", "value": "6a4494f8358270180bf4ae499fbad16e37da1b072c71b5bf762f83b513f6ec78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827800, "uuid": "75c43de6-017e-4f5e-b9cb-77f2bff82adf", "comment": "Malware payload", "value": "19dc612a5aeef2f1fb5d10d6a4e000520f09b0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827800, "uuid": "4556a19a-1a7e-4a2a-b77a-0764ddc076fe", "comment": "Malware payload", "value": "1c416058607a1e6fa8e8b034fe5c34d3a3957c1f2dd08c352d2a2fabc73a19f247f62421804816bb57b76caef9c6e47c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827800, "uuid": "5494315d-b339-4a35-b74d-e76f3684cb89", "value": "T146A38116E7E90455FAEAD6300ABE1B354566BC225B39DBEB0B54FD0C18329909E3231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827800, "uuid": "11118b19-9a89-47ea-adfe-45268167b96f", "value": "1e2520b7ae560c4e9fbb840bba3be2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827800, "uuid": "00c582de-1cd6-4765-b717-82dff1dc9803", "value": "192:zSonQW905e3tOGOrjNbWBh8KPBhJq1oy3s+p6l/4NWjdi+RCmwNbLZ3Rukp:HQW908nO0o1m+p6l/aCdKm2bVIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827800, "uuid": "dea21203-0c0a-4c6c-b515-17600483b4e6", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827800, "uuid": "7de1e2d8-08b0-48e9-858f-a4193eec9840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827800, "uuid": "ccff987e-432e-493d-8001-1dcb6be78413", "value": "Shortcut.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e45139-0cc5-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658827660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827660, "uuid": "839fae41-8168-4dd8-a33f-76909e4a7f6a", "comment": "Malware payload (njrat)", "value": "a95e3e4dbedcc98e826cc682ef8b3fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827660, "uuid": "4ac7f6fa-680e-4967-84b3-2ee982dd0548", "comment": "Malware payload (njrat)", "value": "6aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827660, "uuid": "5975de33-b9bf-4f60-acca-501abe233615", "comment": "Malware payload (njrat)", "value": "54008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827660, "uuid": "09665e47-1157-4bf6-9091-fed710529cd7", "comment": "Malware payload (njrat)", "value": "0956a5f7cbced5c59f93035e7cee0080b4a7c65c888ced0f4957cd6b0174c37ea485823930bd64b603b94b2badb1c072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827660, "uuid": "032e1405-4706-46b4-b15d-28d8c3c60d3a", "value": "T14174BFB2AE524D72C94C79F5A31950E01B1C3E9FA1DC876216B8330530B99B7CE76B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827660, "uuid": "f066b70d-66ec-405e-a4c3-99263de7bf77", "value": "a38ad86d74cafc45094a5085e33419e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827660, "uuid": "615a7106-e54c-4fa5-8301-6f17ce57003c", "value": "6144:+cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37PcAA:+cW7KEZlPzCy37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827660, "uuid": "f24c50f1-a765-4c03-a5ff-3912e8d253df", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827660, "uuid": "caa1e212-a867-4c93-91c7-487aa4a0eac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827660, "uuid": "769dfc25-5f6f-4f43-9921-96cd70fbb3c9", "value": "6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48504a3-0cfa-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658850642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850642, "uuid": "3cdb20fb-51be-4380-80e3-5c6be854a6fd", "comment": "Malware payload", "value": "6a24c6c07c26f4a20e0abc941600dc76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850642, "uuid": "6340d501-41c4-42e6-93ff-e7afda8a8580", "comment": "Malware payload", "value": "6b4743f3cf0252a83a8645a2d29864a99b949714132b2d2189d00b6adf3fe2a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850642, "uuid": "2b0cf712-bf18-45bf-8a28-c946ad756d34", "comment": "Malware payload", "value": "ace012af22104e1af70e137963977b4ca211f700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850642, "uuid": "1aa4687d-b4a6-4628-b581-87ea7b10f303", "comment": "Malware payload", "value": "556564c6efe1102c2d4bebed4a498ba0e72cd0b933aef7937008f641ae3a50ec4aac1a58a21fae48351f17cc8c2de0e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850642, "uuid": "0057bd2a-2aed-4d17-b358-304de9304132", "value": "T1188533507B49791BEE354E79F1F10A09813FC9B8806AC7650A4D62CEDCB632F4B82F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850642, "uuid": "34556f87-1a6d-49cf-bcce-acea8dd26310", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850642, "uuid": "32797820-c2ac-41c9-8940-da7c9d1d497f", "value": "49152:DeQypM/GZ3fK6jSpn5GFw80fbb3DBMKCOHf7HU2uGpv8:6QYMY3fKF5kw1zDBMXS3xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850642, "uuid": "1acb9ec1-b078-48e5-8db6-373f77e949db", "value": 1797632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850642, "uuid": "86666f0c-6d48-4b03-aa70-bb79d461871d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850642, "uuid": "8c5c2c77-86cc-43e4-aedc-bc5f7d366ba0", "value": "6a24c6c07c26f4a20e0abc941600dc76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220c29fa-0c89-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658801863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801863, "uuid": "6e8b7002-53c2-4abf-a3df-5c9f188676be", "comment": "Malware payload (Loki)", "value": "d5d8d9981c33f2f21e6b1e3182dea4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801863, "uuid": "bab1f93e-85ec-4643-a95f-21439f6303c0", "comment": "Malware payload (Loki)", "value": "6b80632991c52ad6552c538d9743cb1006fe8db8ce80fbb58567e1a1606f0230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801863, "uuid": "a697025f-d113-4116-8a99-8f29aa8c6847", "comment": "Malware payload (Loki)", "value": "cb01f449421bcb1f2dbcdc375451c50ae812026c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801863, "uuid": "0e962719-ca41-49ec-87d4-2967b435a24c", "comment": "Malware payload (Loki)", "value": "a2405367b78fdd8870d3f507cb64ee93a32ae0265a1b990bd766a9e2daa9adbb76e5efbec3b0acaff0bf36b760429649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801863, "uuid": "2723650b-d6a8-4474-9aaf-d1b0d8ef8f7f", "value": "T1B454E03D9799C817C88109B49C61ED5FACF0ED1125A8D592BA103F3EE63D282EE0E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801863, "uuid": "8fb617df-685c-4d67-b16e-49d49fafc71d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801863, "uuid": "8fe65977-cbba-48a1-9052-1d8b1426b077", "value": "6144:8DYa6lZYbjBwBdbuBndUXJQTAZLWWyr4qynRg/8d:AYzZYbjanoqJQTAZLC5Os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801863, "uuid": "ca5e1b97-5be9-44db-97ba-41d6a0b63941", "value": 297608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801863, "uuid": "d7bb1a49-9e84-479b-bf68-5d8fe17c8a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801863, "uuid": "10a7ae7d-8b20-4e49-9eb3-02c0dfea926c", "value": "PO0002763_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ee2983-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848907, "uuid": "500879b7-b073-4060-9cfc-0776e1711597", "comment": "Malware payload (Mirai)", "value": "6cc06774da32f200d03fe1da3a27d0e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848907, "uuid": "a96dd812-a2e4-4dfd-903d-5f2c872bc007", "comment": "Malware payload (Mirai)", "value": "6c20888e5e03e76574aab271d800703f6e7fc3684b39657d1a32c9c70669a940", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848907, "uuid": "e799f1d5-504e-452d-98ff-29598c0a7891", "comment": "Malware payload (Mirai)", "value": "cc1c210986a235a375643d4b610a88bff1157d2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848907, "uuid": "852827ee-5375-49f8-9060-37791c5de2a2", "comment": "Malware payload (Mirai)", "value": "a79517afc051e0fcd4bf092dedb67440ec895bec95052f3ef17c5dc0fa68581860c327fda380033ec4c73e87523416c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848907, "uuid": "f857f10d-7b08-4cd8-bb1c-85543195f72d", "value": "T191A2D025D34AAEF4DFEF9C9453C2C3C276E543C6678AC8E240EEAF016516042BB89D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848907, "uuid": "f02e2a8e-9b8a-47b1-93ed-ea5c5db15d65", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5NRM4uVcqgw05VxJM:9RxsSVsMD6xiJJE5zRWNq4uVcqgw09+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848907, "uuid": "53097588-e46b-48d4-9b94-74bb2bee8ed5", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848907, "uuid": "09235744-3d5f-4a91-a8b9-e69296c72bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848907, "uuid": "c4638c27-a7ec-4e51-a526-f306e7a6ed99", "value": "6cc06774da32f200d03fe1da3a27d0e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be1d894-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658848776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848776, "uuid": "8be7d586-7668-47b9-8859-eae6eb2cf934", "comment": "Malware payload (Formbook)", "value": "93c1e36edfd24911eb389ed3d6e735e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848776, "uuid": "d08f688e-b915-44a9-a5f4-8615d45334bd", "comment": "Malware payload (Formbook)", "value": "6d5a01dedfcea8fed1d6df29d4c72a592176bc9214fe1cfd8aadcc2a6a21c31b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848776, "uuid": "8eda713e-c910-46fe-a181-463dcb280a42", "comment": "Malware payload (Formbook)", "value": "61a0faa480edc2ba3d26abffce8ddbbdad278de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848776, "uuid": "c436bba2-2c36-4764-ae37-eb0a0437f433", "comment": "Malware payload (Formbook)", "value": "1fc28bfeb22314f00ec1571febe757531a8ed11a28e54e7e9c19a6153695b210d0b2ef48059a712e4915e4590b727312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848776, "uuid": "484d4d48-0309-4de4-97d0-9bf19ee990d2", "value": "T18205226293E5C5AAF0E72BB40DF007131B31BCA059B6F34FA202145EDE76994A939727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848776, "uuid": "8695cdde-0e75-4a0c-a7ce-662a52be18df", "value": "b83464d8132ecd9f810820e192566e15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848776, "uuid": "e989a9cc-833e-4a33-a0ae-07a0be923d0e", "value": "24576:4MA5J1vEKIdXfqDseo2hjiYqEH/mt0eJQMPF:0INOoqjiYqEHaJ9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848776, "uuid": "202238b5-9f0d-41f9-8a91-dc2f874653a8", "value": 848096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848776, "uuid": "88601090-2448-4d27-a4c5-c5ecaaa67e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848776, "uuid": "8b30edc6-08f8-4c36-bebd-98cdd7307f20", "value": "93c1e36edfd24911eb389ed3d6e735e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165a3a86-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658851236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851236, "uuid": "7558b322-0487-456a-b6a2-7f153f0263e3", "comment": "Malware payload (AveMariaRAT)", "value": "608dc7fbe2dff9f8e3369cf42cc9d14f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851236, "uuid": "4435c200-68b5-44fc-9ed3-df2cb073e4e1", "comment": "Malware payload (AveMariaRAT)", "value": "6d728c9e4c26986174ff5e7eb8d8aa494cf173a3f7dad211d21fa106eb354d1a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851236, "uuid": "834324fe-12df-4b4e-854b-4730c3810b37", "comment": "Malware payload (AveMariaRAT)", "value": "43af1c4d81b86341e14d034e8a2bfebc284856e0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851236, "uuid": "e3b88ab0-387f-4ea4-ac55-6700ffef2ac3", "comment": "Malware payload (AveMariaRAT)", "value": "3f89dac275241fbd01f5ec5386ffce977108c907b2c8fdf0cc2ce6b09dbc6dfc4d7d15ee3d980d407d337a914e0e5586", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851236, "uuid": "b50e8a28-daa4-4727-8700-eebec5fe05e3", "value": "T1EBD39E13B7AA4035E6B702B02DF93E3A8FEDFE311635C55B5394948A6C72484EA39353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851236, "uuid": "75bc8ca0-49ad-4b6b-b9e5-2302eb39ae00", "value": "ef804870e7f7c9feae20101fdf049fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851236, "uuid": "47534f69-635c-4782-9560-de20381897c4", "value": "3072:+T9d8ENJxID078Ia0W2t8GhigMCeLg/Qj9LTJD:+pqENJy1Ia0lt8GhiNlg/W9LTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851236, "uuid": "ede8baa6-8c61-4adb-b037-04a4de2b7b1e", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851236, "uuid": "72b0a4ff-caa3-4919-baba-c276073bcb14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851236, "uuid": "ce1fd174-9c3d-4d0e-97f2-f43ffe7b0ea3", "value": "608dc7fbe2dff9f8e3369cf42cc9d14f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b79feea-0cfe-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658852157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852157, "uuid": "60d5f05f-08de-4eb3-a127-a283331c89ee", "comment": "Malware payload", "value": "b268634676f1cf50e5a38053ca23577b", "object_relation": "md5", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852157, "uuid": "6ebb2b9a-e2f3-48c2-8afa-902b2e48ceec", "comment": "Malware payload", "value": "6d8250885b38619aef68f7ed7d7be6b862cf96e6c0c1e112a4d587aee2157155", "object_relation": "sha256", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852157, "uuid": "1260a199-aa65-42bd-b641-2c350795e8e1", "comment": "Malware payload", "value": "41befeee0ce1b1cc868dbc3657bed6c834099f04", "object_relation": "sha1", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852157, "uuid": "3378d441-edcf-42f3-b79b-3362231ede3e", "comment": "Malware payload", "value": "c7631d0930fe6d62428279058b2bcd73d553f398b20632ad1af627f1bf7437ac8aa4ec668901232af304dff50ef1e6f2", "object_relation": "sha3-384", "Tag": [ { "name": "CryptoWallets", "colour": "#7BD142", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852157, "uuid": "f9f108c2-2c62-49df-802b-258e5bd32d26", "value": "T15DC34A4677D98B63C7849576C0D3511403F9E1EBABB2E70A7E8413762E833E19E11BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852157, "uuid": "c7816900-db31-4d36-846c-e0ce4525550d", "value": "1536:qLTJcjaVWOqbT4cb7FWbKAENnCuKT3erw+uBUX+hHgp:iFcjambTn7cjWnETOrw+u2X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658852157, "uuid": "ba5b682b-34a9-4783-b592-7dd94079b36c", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658852157, "uuid": "8cfeb48e-2938-4664-b716-51f7f821de70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852157, "uuid": "64e5129b-4b1d-44e2-8781-625c621cf082", "value": "Rnfgfje.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada7e698-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658851490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851490, "uuid": "ca175b65-2933-4ee9-96bd-ae38c5bda42d", "comment": "Malware payload (Smoke Loader)", "value": "4d4444c4425e2cc3801f007c33c26ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851490, "uuid": "105cf27f-cd46-4a89-b992-edb0f97ded69", "comment": "Malware payload (Smoke Loader)", "value": "6d989f864e6d73092ce413bea83d6c03868aa41b2823e1c0809c6df1fe1cb2c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851490, "uuid": "4b0c085e-e296-4746-9cc8-43ae96de0f69", "comment": "Malware payload (Smoke Loader)", "value": "13d1b7b546b824e1949b7554b2aa3afe6829dc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851490, "uuid": "1774db00-07d8-4c37-b607-bf76f195bb8e", "comment": "Malware payload (Smoke Loader)", "value": "52dea47294868c8130667377d201d67767daccef9ecfff4eb64c79c331d51a64719b71135fd41042ed8306da9d0a4cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851490, "uuid": "0e46dd60-6d75-4405-a3df-ec4df4576282", "value": "T16E649E40BBA0D03DF07751F4797AC3ACA529BDA09B2454CB62D27AEE56386D0ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851490, "uuid": "31335a5e-7fe4-458c-b701-9ba8ca927456", "value": "341ace376080222d26a7767debb6055b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851490, "uuid": "c08398c6-16d7-4f81-9806-d87793c54390", "value": "6144:88PyldzsrEYWDUWoqLI9YBmS3qiG5R0K13Yz:8FpDUWoqaegXp3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851490, "uuid": "8b285a93-b3dd-4cce-937a-d91f1e47f4aa", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851490, "uuid": "fb9f69ac-032d-4667-90f7-deb4e1af238b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851490, "uuid": "a8ba3779-7b74-434d-a855-1b5a715f178d", "value": "SecuriteInfo.com.W32.AIDetect.malware1.23625.23621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4340c3-0cc8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1658829154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829154, "uuid": "606221c3-77af-4079-aaf4-54c0020a7564", "comment": "Malware payload (Stop)", "value": "93a9c2b65e55ef474c2f052f1a3c22fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829154, "uuid": "3ba584f1-db06-4e5f-87fa-e17875e714c4", "comment": "Malware payload (Stop)", "value": "6de4db89e9461df6e0372bf489831779ce301a232e38306dc46300b04681097f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829154, "uuid": "e9909b44-7d54-4354-b47b-f1b5e768aff5", "comment": "Malware payload (Stop)", "value": "974cb7992a802bd92240faca33895cf623578d28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829154, "uuid": "8ce2db43-cdd9-463e-9c07-6a1f2adb5ab0", "comment": "Malware payload (Stop)", "value": "3fdb1cbb8c29dcf1037cfbb4e75dc423a18bf20a26887fbf8b34633ba1403cd3bd6cea313b563df895192b7b5393fa64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829154, "uuid": "c97f9fd9-1f50-44ee-9293-562116be85ef", "value": "T112050200BA60D03DE57702F0B936D2A9752DBDA09B2455CF62C27BDE563C6E1ECB520B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829154, "uuid": "da6d0c69-860e-469f-82b7-e40c583c3ccf", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829154, "uuid": "31cb5f3d-3df1-41fe-8993-1747c193f417", "value": "12288:GCihNWGO8OEd8AHGy/xZLDNhRr8Yu8kPgUOI10EYcBdE:wU2J/LLDNbruPgUOp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658829154, "uuid": "ebe2e0fd-16b0-4024-b0b9-97cf399ee59d", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658829154, "uuid": "5c053d55-2811-4d79-b507-56b9ab29a5e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829154, "uuid": "95d04047-6151-4dce-a5c4-ec7d7100b447", "value": "93a9c2b65e55ef474c2f052f1a3c22fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b339116-0caf-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658818253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818253, "uuid": "0a1bdf5f-a15b-4c12-b32f-0af6accf022b", "comment": "Malware payload (RemcosRAT)", "value": "29181730d2aaa36086166c2601191a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818253, "uuid": "95273d91-4ac4-4a98-a274-759211484e4a", "comment": "Malware payload (RemcosRAT)", "value": "6e32755e959eedb7b200382f137bf89e6319644ffab4b52322c70f1d0e4f11e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818253, "uuid": "a8e78e78-7a4c-4953-8d74-61ef9d80ee10", "comment": "Malware payload (RemcosRAT)", "value": "f14542c56a63624bb2ab97b8ad736326ba803250", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818253, "uuid": "42a05f6e-6d82-4c65-ba22-f36574c2f2aa", "comment": "Malware payload (RemcosRAT)", "value": "9a29f6a53ed6cc02554a8c0a43a9c23ccf0b9c53be2b71a7551685b33610bd8a61692130f0f88d998462a6bfa4678338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818253, "uuid": "06722733-c07b-4820-a98f-bf5e7e7822e2", "value": "T196258DA9365275DECD77E4718BD86CE899E06CE7C20F5D1374A3127AA71C8728ED00B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818253, "uuid": "bb8240b5-3e39-4320-9922-387755fa8c32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818253, "uuid": "66256408-b05e-4e16-a24c-3ad3a389bbea", "value": "24576:H3J1rhVBLB8aCMPMmHI5yKI6cQlCOYJwOkYGc++:H5NRxqLyKlcBOYxkYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818253, "uuid": "b47e1c68-bc29-48b2-86c3-25fbf1a86101", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818253, "uuid": "34fd6b22-7592-4db2-a077-51da073d7309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818253, "uuid": "06e652ce-e08c-43b9-91a3-ec1cda5eccb3", "value": "ORDER JTX 298809 B.ware Corporation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45509012-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877944, "uuid": "ccbc94cf-c31e-438f-b9d0-c22e361b702b", "comment": "Malware payload (Mirai)", "value": "ddea632cdbf7588a42ff53e72e654c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877944, "uuid": "a0c21cbf-9fc1-469f-a2b4-02ca0190de7b", "comment": "Malware payload (Mirai)", "value": "6e42936fb6cbb8894fd687bba6958a6a4022da459f83b00404df8dab29a4f6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877944, "uuid": "aa207b72-664d-42a1-9689-e4e2dee0c238", "comment": "Malware payload (Mirai)", "value": "3b70c2f708561b2db74470f7874960c15002b235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877944, "uuid": "5c1231c5-e63a-4686-a0de-e1882a5179b2", "comment": "Malware payload (Mirai)", "value": "0f3a67ae89399de671e675ac9a0b4740bce77ce2dcd38d542d7201469cb20d5a1afe68090a2c0132c3d7d651f19b4f7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877944, "uuid": "df7b8587-c3e6-4e5c-8149-34e02903eb60", "value": "T1CFB39DABF20715A1C8A346F007CB4FDE6E1722C29F57C4E37C6A253E58750DB590AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877944, "uuid": "20a6a1ca-3100-4654-b319-1e0cc39163a1", "value": "3072:q4uLcytU96KeY2JCl0oO7qVq+gbWKqmo:Kul0o22eNqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877944, "uuid": "ad67c9dd-5e2f-4941-9da8-ff5fc1c85c12", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877944, "uuid": "8d310e74-d6f5-48c8-93dd-d26ce830dc6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877944, "uuid": "c254044a-a761-4b1f-a9f8-888d20d080ff", "value": "ddea632cdbf7588a42ff53e72e654c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f235f4-0d1c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658864981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864981, "uuid": "398142cc-0082-46d6-8f91-d44efefb233f", "comment": "Malware payload", "value": "4535190349c16eef5ad9921fad54791c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864981, "uuid": "01b6bd78-6eab-4525-b2b0-1e512bd0a5ac", "comment": "Malware payload", "value": "6e9c61198478075bc0662fa4c8faf5e183cd43f97fff11296c2f9e371bf6d49c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864981, "uuid": "565a66a8-ef18-4ec1-b9b0-dffeb19cc91e", "comment": "Malware payload", "value": "0f57ffdf84beb17760275a1e53de5bc777b00fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658864981, "uuid": "11dd1399-9b7f-417d-b765-05e6d3be9394", "comment": "Malware payload", "value": "8b7a64bf1a46a4f8a74c58cee5c490e243ae43b4137d81b1c1dd719fed6c600ecfafdf12828496fd5713595803bf3a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658864981, "uuid": "3f8c6d15-5c84-4285-ae49-01f3d742ff0b", "value": "T185E633D3F582349CF89B817775CA8A76E4D17C4A6A02691202B03F60BFBDEC39B4465D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658864981, "uuid": "3d819c69-e33d-425b-b4d8-b7902ee3a4f3", "value": "0d29bd8bf9dcd1e5820ccb1eb99fb2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658864981, "uuid": "24b07fbe-ec93-42cc-aefa-906acca2ddbd", "value": "393216:zp3yDZ866uhSdLSb2sWAXPR6Pvv7opYUZJgaQlC+658Zg1:zpM96uhSdOb2sDXPR6Pv0pYmJgaQTceo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658864981, "uuid": "899981da-348d-479f-b16e-3574485a471b", "value": 14230750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658864981, "uuid": "dbf5ffb7-8f09-4680-965b-c5445b6877cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658864981, "uuid": "427516ee-3de8-4c39-9850-bc0a5d6e4f27", "value": "SecuriteInfo.com.Win64.Malware-gen.20796.18706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b122fdc0-0cce-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658831739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831739, "uuid": "317e02da-fcb1-4736-94bf-411ea2c89c0d", "comment": "Malware payload (Formbook)", "value": "5b27d0a3b4d9a2a3f65d4887738266f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831739, "uuid": "d17fac89-0a68-4b8a-9d40-41bed66e5036", "comment": "Malware payload (Formbook)", "value": "6ecaea9142fce685a1bc8ad9a44526eabaff947329fafc70057840268c74e1fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831739, "uuid": "29911ff6-0b21-41fb-b7aa-3b9f808e1602", "comment": "Malware payload (Formbook)", "value": "c564ac38412e43cdc94320181257aa16a6718d43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831739, "uuid": "3df32267-020d-4f1d-8011-616012b58618", "comment": "Malware payload (Formbook)", "value": "cf123528cd14b08edf040410adf6c84568ee6b19852bd3dbf871a902a017c7a4f47351c787aaa2336d79b6fa1f90563d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831739, "uuid": "8bef12d9-3cfc-4901-8a9c-c4eca5dab13f", "value": "T1FC35ADAC356075DFC967C6B9D9A42C24EB203C66430BD753905362EDAE6DBA3DE010E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831739, "uuid": "8b9cf6cf-b952-4b27-a81c-4915b2a9b02d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831739, "uuid": "dfe2e8dc-86a7-4817-a37d-a113eb6aa52e", "value": "24576:0w4UZvybcv8voRbJR+gyknmmBy1XFFbqxb5H:06d8GFo9j5bs5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658831739, "uuid": "d50739f9-6669-4127-95fa-f1c70a083da5", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658831739, "uuid": "10c2ced5-e2fc-4ce3-8479-d368b6963da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831739, "uuid": "9d899c31-31f8-4221-affa-5c0a0dca6079", "value": "SecuriteInfo.com.W32.AIDetectNet.01.9357.31800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eee0166-0d35-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658875705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875705, "uuid": "8b999f30-fd59-413e-af3e-f4ad2d3f5108", "comment": "Malware payload", "value": "401c40af0b9eb39f3d7bf157150f89e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875705, "uuid": "342f1b57-35b0-46ba-985b-6af731bac936", "comment": "Malware payload", "value": "6ede5512342f04112ae1921f29ad45f73823fbfec9cea1511c803ab22edb459e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875705, "uuid": "626aea76-106a-4cd1-8e9e-0368c8382332", "comment": "Malware payload", "value": "a0dc6c43d022d046de9ff8d79924a2cf87167fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875705, "uuid": "40a09c87-606e-4d24-80de-76963b7da31a", "comment": "Malware payload", "value": "09aadecb0bea4beeeb7dd192bff1b11a10395d820bff5a7c3820a6ac62eeb30481becb73c7a68e49637bb405a389644d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875705, "uuid": "2ddf3724-b76d-4b9c-b85b-89612b32259c", "value": "T1D3B40793F042208CF8DF8277B6DA8E76E1E13C5E0953181152713F64BFAEA8297D4A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875705, "uuid": "9d50f7bb-8813-48f7-bdb5-75e08067ad10", "value": "0d29bd8bf9dcd1e5820ccb1eb99fb2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875705, "uuid": "df2f0f70-7469-4c06-a0ea-19be4934997e", "value": "6144:NwWWyRrqEaW+GVVRcObBJbzFV3AdAycJJJ655ZZomRc9G7rMalI2U4dVF1D9NN:m6ciQxC9IgiLFB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658875705, "uuid": "8278f1e9-ff2a-4ae5-9699-6061f9d37420", "value": 518300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658875705, "uuid": "67cea10d-7b8b-4ad4-886d-9132607412c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875705, "uuid": "c89b81e0-2c8b-4fd9-8092-6c32e7405f51", "value": "SecuriteInfo.com.Win64.Malware-gen.6164.15807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93841a3-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843322, "uuid": "0bca017a-f829-4e7f-b852-412bae1e5aa3", "comment": "Malware payload (Mirai)", "value": "0b7e6dc81a8217fe83c591374700723d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843322, "uuid": "bd7028ad-4d43-4ec3-9256-07f4ae772b69", "comment": "Malware payload (Mirai)", "value": "6efcbe7d600e4fc1c585f3d35b4480720083575d7e8bfe1d62bb566dc74c38bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843322, "uuid": "6d1211b2-ce18-4e27-9d29-486eae13b3c7", "comment": "Malware payload (Mirai)", "value": "ffa004e10d07c9187c66720361bd24ad674bb177", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843322, "uuid": "084919d1-4f36-4447-b2bc-42a06900ea6b", "comment": "Malware payload (Mirai)", "value": "91e72b2443195fb80c5d2acae8c51694471cc8da4574eaaf51ce7012ff64dca8f1ee96f32ca58ae92bc5f3eece9cfc54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843322, "uuid": "76cc5f61-4a71-41b0-98b3-27e2c2f4fd09", "value": "T1A9235BC4A583DEF9FC1506302176EF329BF6F53E2018DA47C7A9A9329D92603E54329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843322, "uuid": "3b877579-0386-4fee-bd46-f961de5e6916", "value": "768:NgbY+WYu7QasNUKF5J+gWHO0Le+re6cIo0SE/oE2kS6upL6Iagx:ObOQ9NUKF5J+gWHFxr6j0zl2F6u1Jag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843322, "uuid": "02756956-619c-485c-80a6-a3fce73937aa", "value": 49968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843322, "uuid": "1c608a3c-95c3-4f8d-a886-321c497d7051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843322, "uuid": "6f435778-3879-4856-ad5d-8e466dc89cab", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979e0187-0ca9-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658815805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815805, "uuid": "2ced308d-7680-430d-ab4d-f6769cbedae4", "comment": "Malware payload (AveMariaRAT)", "value": "423a07a437bc889d36ab9caf3c15ce44", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815805, "uuid": "f36c1b8c-e7fa-4886-b6dd-daee1f85b794", "comment": "Malware payload (AveMariaRAT)", "value": "6f3f0601dfed94ebbcefb8305de5fc98b9f055e094ec617e5b718c3b991abd82", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815805, "uuid": "bf11742f-3acb-4a60-a350-7fee845a7ede", "comment": "Malware payload (AveMariaRAT)", "value": "47941610f1b47ad15fb6f847d2029a320ceb0bc2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815805, "uuid": "41b7bfaa-42aa-4eb2-8c27-38c9ee1834f5", "comment": "Malware payload (AveMariaRAT)", "value": "9d11e1153c7b7fbb8ceadd3efd8f14a9b93df11c711b23152350646ebac36919118bdfa3a7a022b729d8230bcbc5d2af", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815805, "uuid": "b8a831b1-dc39-4342-88d3-4fe389e82ecd", "value": "T102E11A7DDA5886FCCB89B2E03B15BE8C405D799093D9A0A27E7CB3104F574BE912E052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815805, "uuid": "a1829b9d-0cf4-49e0-941c-3a44b51a0d3c", "value": "96:txJM6RvnWFCS15WCowlvparWtgYFoV/r67+uejrkuQfE3PlfH9SLyyCfkYTPY085:JMKWfdRBQWtgYk/O7+DjrLFP90ybkuV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658815805, "uuid": "73415589-1901-48bb-afc9-53805e34564c", "value": 6921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658815805, "uuid": "fac7c483-11c2-47bf-b72b-c1f7bf356e21", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815805, "uuid": "922ed2a2-3660-4938-acf9-aabd593990c4", "value": "PO ref. 220013040I .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c4fcdc-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877964, "uuid": "79e73d52-0baf-4bdc-8667-a13fffd12b6e", "comment": "Malware payload (Mirai)", "value": "120211cfd5b033fa1e8c42ade25017c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877964, "uuid": "9cc234df-373b-404d-af4f-db276edde0df", "comment": "Malware payload (Mirai)", "value": "6f413697e11cb88cd8134c5991ccc6b60119d9f69a4584797baa0bf5b18b3bce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877964, "uuid": "9660bc15-5ed5-4104-88fd-fad1c1224a0e", "comment": "Malware payload (Mirai)", "value": "7475818fb9eebb3f7ace0ae1a18df05b93614bee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877964, "uuid": "88458a53-5132-4fcb-b423-e09c1ed05a86", "comment": "Malware payload (Mirai)", "value": "fe41b6dc2af339e90d5343883d1218132b7d1ef6d31d554eefd6d403a9447520523d0a14895ab9ff92bc89c3d8653063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877964, "uuid": "f13b4ef4-3d15-4823-b1f3-6a43d1357c51", "value": "T1FE434AC4F143E9F5E84301741026EF379F72F2EA1158DD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877964, "uuid": "78b3eeb2-1618-4d37-80b2-4986ef6f391f", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcuDOdLqO9vWnLIweBH+4sToQLDAlv:Yn/EsW5qhSh6amSflWn8wGH+dNLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877964, "uuid": "e6ef3caf-ef12-4b08-8d98-c56db980af4c", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877964, "uuid": "ebb89c2c-1340-4834-825f-7ebabc0c89bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877964, "uuid": "7315288d-214d-4b22-a8f5-6cb9b7f690d9", "value": "120211cfd5b033fa1e8c42ade25017c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54a90a8-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843315, "uuid": "0ad5da12-9709-4f07-8da3-572873c3e7f2", "comment": "Malware payload (Mirai)", "value": "40462ad78936272b7661360d14b7d3d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843315, "uuid": "d0be57e6-6696-4d08-8029-8be75c353f06", "comment": "Malware payload (Mirai)", "value": "6f8adc8dfd81e14eb62bfd7a6ca02ab5790830d0a183830bd2a249227ff1c03b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843315, "uuid": "9ef991b5-1188-4aa2-89b1-a6a329507042", "comment": "Malware payload (Mirai)", "value": "c32219842926caf2fa1cdbd13469c7a8710d33ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843315, "uuid": "4a249a8f-d348-4ded-b54f-c4c5d9006faa", "comment": "Malware payload (Mirai)", "value": "b1184a4b4629a580c996347980e4c63b0e28e212bbc92ab2af9b5dd03c54c3ad2338d7f972669258d8a3378ee6ea5f22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843315, "uuid": "04742adf-e6ba-421a-a388-c7799b09c3db", "value": "T11A638309BFA51FF7FCABDC374AE91B45258C651A21993B39BD34D818B24B20E05E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843315, "uuid": "8872cc10-a782-4591-9bd8-2e2772a293fe", "value": "1536:syQI/HsV7QK9s2jCbIJpgdvkx+NnzambZ0ns1e:sTI/HsV7Qgj9Mue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843315, "uuid": "23db0aaf-b839-4fa5-aa00-a5a1494aff35", "value": 71668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843315, "uuid": "7489b3ab-d3de-4267-8031-5d7734f1dd97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843315, "uuid": "d27e7705-b709-4453-b9ae-66d2dd9dfc42", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dca008-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848232, "uuid": "2d6fec41-1852-429b-9a1f-861e91274f4e", "comment": "Malware payload (SnakeKeylogger)", "value": "f1864c05258ee5d0f3c933f17e606add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848232, "uuid": "2550c3f6-8e82-4dae-aa5f-d9bd488695d8", "comment": "Malware payload (SnakeKeylogger)", "value": "70807cc3153e2a77fd5b7323226f779021b5e266c4bcd21f621ebf6c6b6d1b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848232, "uuid": "890edefd-17fc-4a26-84f8-5df44b9659ec", "comment": "Malware payload (SnakeKeylogger)", "value": "998b9142a109a331e003ae5de36fc2abf8d70c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848232, "uuid": "0322bade-acdf-4bf3-8fb0-460cd0ee3296", "comment": "Malware payload (SnakeKeylogger)", "value": "3df73d86ad4217d25ef4cebd16a64d6217144c001b3743262308f4e53d2d4501c107a1c06e68898ffdcbe48f888b79e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848232, "uuid": "1dc3dc38-247b-47a9-839e-7b8e4e293ed6", "value": "T1FF359DAC3520359FD8A7C6B989A42C74EB603C66530B964390D33DD8BA3DB92DF054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848232, "uuid": "f37d5009-2eb8-438b-96fb-5dfbf04743ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848232, "uuid": "993b76dd-0409-4479-a484-a514e073f239", "value": "24576:K4w4UZvybcv8vY9MWqlwqsIQ2sk+oSVyxL6H:d6d8A9MWqlwqsaa46H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848232, "uuid": "14afd06e-5394-4ef6-a63d-101c43c776e0", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848232, "uuid": "d9422f3f-05e0-4617-b0af-ef40942539ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848232, "uuid": "27eb669e-730f-44e7-a095-1718572b9f0f", "value": "f1864c05258ee5d0f3c933f17e606add.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49dbcc0-0ca7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658815102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815102, "uuid": "11954719-ebda-4665-badb-8e9e9d00b1c2", "comment": "Malware payload (AgentTesla)", "value": "abe5693c0dc704239a610fbcfcaf29ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815102, "uuid": "beac536d-d512-46b6-ba1f-2eb64ee80720", "comment": "Malware payload (AgentTesla)", "value": "70c7c374573397448b07b30890372fe0b9e764c2f88c1f199b80b9d7e563a5c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815102, "uuid": "ca7a38fd-9499-45fe-a77c-4d07b4caebb6", "comment": "Malware payload (AgentTesla)", "value": "880e00243e16e35e4fc3d05554e26818e364a078", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815102, "uuid": "57317f95-1f37-41ff-b075-ea2dc5b0625f", "comment": "Malware payload (AgentTesla)", "value": "35eb561c9802ad10e9f888acc6b028f08f542e4beb12de5ff4bc82a6b0ae8c2719de13fa5666d16a750086de7ac4437e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815102, "uuid": "d49a1867-793d-4fe1-aba4-8958c014e954", "value": "T10ED402396BB46F23ED3D4BF96861105003B8706814A3E39A6EC674DB7AB2F715980B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815102, "uuid": "2d6b9310-3fc8-4722-a9fc-b46b8c91f46d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815102, "uuid": "5a580e6d-e22a-4f1a-8b6d-73edd6ee02e8", "value": "12288:WYiu30ut1/NYbb+JCMMy5yoKV9WDsuKKHulR3b7ZTsKdbCLyfkAy:tiuEVWsMMdoKSYrlBdWLjAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658815102, "uuid": "295eaca7-808f-4d1c-aee0-887c221bf75e", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658815102, "uuid": "a2063334-308d-4829-b482-cd95e5ca15cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815102, "uuid": "5ce021ef-2697-4ea0-b365-d4c242a0038c", "value": "abe5693c0dc704239a610fbcfcaf29ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f290c91-0cac-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658816891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816891, "uuid": "b54217f2-2476-405b-85be-1ac3f1dd1872", "comment": "Malware payload (AgentTesla)", "value": "2af656ae211c7c82af2c9b1083b9f7e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816891, "uuid": "a6f8f06b-7a1e-4485-b6b8-98da386749b2", "comment": "Malware payload (AgentTesla)", "value": "70db25522fc2805d35392ffefd3bf29148d99416ad81838f12b56de2262ccb79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816891, "uuid": "9e9f4761-904a-4dfe-aecc-b58b6e0a1213", "comment": "Malware payload (AgentTesla)", "value": "18e36be16fb40eb1b15491c2765078c7e9e2239d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816891, "uuid": "f1b2bd6e-8745-4813-ab4b-439716a55a25", "comment": "Malware payload (AgentTesla)", "value": "948ce3c69a95d1bfb7bfda1937d0f5803a8482bc038407bcb1fac2ef8e22439278489a64e1cb459ffae4af22f28898e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816891, "uuid": "05642f81-0601-40ce-a2aa-a8ca1c95864f", "value": "T1E52512192665AF07DDFD87F8812000048BF53A257457E7BC8EC2F4CE2FA6F61594AA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816891, "uuid": "4ff139db-6792-44cd-8409-e7ad16744ecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816891, "uuid": "f3b05586-8c57-42ee-9d72-034282a0d18b", "value": "24576:VcOw4UZvybcv8v1wAlo3WH/dhWAYuvbY3X2xuP:VcO6d8hlyW1hW2bYHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658816891, "uuid": "4cf5506c-24fd-453b-a215-ff81efa8fe71", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658816891, "uuid": "5d6ea9df-f95a-462c-b24c-2a1bc8665387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816891, "uuid": "c2d41ad7-d1cf-4825-aee6-97a5e29d61a3", "value": "Purchase Order_Request for QUOTE Specs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74d8914-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1658854996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854996, "uuid": "3cd1ffb9-d8b5-43ec-9104-0db24a44831e", "comment": "Malware payload (NetWire)", "value": "67406296d007073c77330165d3fcd96f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854996, "uuid": "d9d8fa8f-87f1-4007-af45-6201aa516551", "comment": "Malware payload (NetWire)", "value": "70e80eec016b8b98a206237820c30c16836e18899e94d87414c0f9c018da6af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854996, "uuid": "d5bb2f64-e3a2-45ca-a14e-c99370622909", "comment": "Malware payload (NetWire)", "value": "80817737d5aabf0a3186f45a58d2130975ae97be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854996, "uuid": "4e8538ca-d060-47fa-8202-4154e51e1f8c", "comment": "Malware payload (NetWire)", "value": "15f4c0f4fe4a6d0288e847cc3ad8e16201b4fc410dd8dad593d38f0fcea71523cfeb291e9bdd698bd566ef705350c3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854996, "uuid": "b66e6e4d-81e5-4579-be1a-106c62951d94", "value": "T12FF4121476AC4F66D17F47FA3071818D53BABE26E262E3497F8076CE2CB3710965068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854996, "uuid": "ce4e140b-62ad-4d5f-861e-2baa9c14f094", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854996, "uuid": "5abf16c5-f981-47fc-904a-0c06e015b6ee", "value": "12288:zTteWI2b2UVFdPBGjWENUdtrXxcqIaT967Y5vl6QqljWa6AWlh7yYqNcNFnk+3x8:zTt7HGjrqrrXxctc8Y5vl6Qoqa6AAONO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658854996, "uuid": "710dc47b-4b7b-4b9f-9f60-f47a2b4d4227", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658854996, "uuid": "b28a02e4-ec0a-47a8-b511-0f10e44d92bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854996, "uuid": "f1cfeb73-735b-4b35-8417-9a304d2bf1ee", "value": "SecuriteInfo.com.W32.AIDetectNet.01.28432.11526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bf91ff-0cf9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658849950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849950, "uuid": "b166bb53-5570-49e1-8834-e7567b934cfb", "comment": "Malware payload (Mirai)", "value": "5e35110f28d8ab5ba575aec12122f557", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849950, "uuid": "84b174fa-39a7-4885-ad14-020bd8765b4e", "comment": "Malware payload (Mirai)", "value": "7187f4a64ea98dfb6119b8fd407f434ee94c964378bc05b035e03deb988b1e41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849950, "uuid": "1be5aa80-5011-427b-af36-aba8248c8d17", "comment": "Malware payload (Mirai)", "value": "9f3cae019fefcece81c36dbdb490b832992abfe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849950, "uuid": "a176e12c-ddc3-4142-8b25-5973616edf4d", "comment": "Malware payload (Mirai)", "value": "82982bce3884c64bcd6cd80e296634a864bce3b6f067dc6228ba01d25dc4f0bed80c3c07f5dfae33945904d26cc1a469", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849950, "uuid": "5d7ab16c-d297-47ea-8d9e-e4cf999e818f", "value": "T157B2D03C1B121B98DE0EC0BD83AD1B613CB41B2591829D4B7206EDD7AF9A8747453FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849950, "uuid": "1c62c424-3538-47df-a5c9-44a5dbe4228e", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiSmdtJgGlzDpH7uNj1JA4S:YeD8ZSWvZHZbs1row697qohQvg9SitJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849950, "uuid": "be1b9eb7-297e-46e7-830e-db90f48e93b0", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849950, "uuid": "35845db1-f820-4ca2-9691-86c684c3040b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849950, "uuid": "35b0bd15-5887-4198-a232-0b9d97552f26", "value": "5e35110f28d8ab5ba575aec12122f557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63b7c45-0cd9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658836552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836552, "uuid": "f2ae6fbe-25d2-484f-b72c-fa86734ca02f", "comment": "Malware payload (RedLineStealer)", "value": "192fd410276609283b7c23929143894c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836552, "uuid": "0b966c7a-b1e0-4d89-9a56-1912ec4f0300", "comment": "Malware payload (RedLineStealer)", "value": "71b55d6c2a988cd5b84765f61206886c6f950a47eee3beec0d6de20329ddc8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836552, "uuid": "4b869749-9857-4ae9-b9b0-3f88a6a73571", "comment": "Malware payload (RedLineStealer)", "value": "22c61f40da182ebf4665987ec89f57f9acb268ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836552, "uuid": "97b848fb-1679-4ccb-bcad-f7164adcd10f", "comment": "Malware payload (RedLineStealer)", "value": "49dad5d19630c6a83bf3393cc143edb89feee18229393c29d69b61f4bf665936925eb5868bb2fa3c029542b5fdd37cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836552, "uuid": "83c2916d-94fb-4983-8619-357dfaad81ba", "value": "T1A494BF44BBA0C03DF0B712F47976C3A8B42DBDA0AB2045CB22D57ADE56346E5ECB5217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836552, "uuid": "a424b356-073c-4012-b116-562e4d1c74fd", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836552, "uuid": "f149ca13-a906-4d50-b9e2-aa21fabba108", "value": "6144:YvImxzCst5mzl+KRXp7hZRV7WlH71HkGIVMLoaHB+fbqSW1aoZDFKlnFU:YijzgKRXpLy7k5aUahfn1fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836552, "uuid": "ff5d007c-d058-48ba-b843-fefb645bf0be", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836552, "uuid": "fb85b30d-c7a1-4c7b-ac81-54b615420ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836552, "uuid": "98508198-8a72-490f-a56a-a5fc4815aa35", "value": "192fd410276609283b7c23929143894c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ca289a-0d05-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1658855443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855443, "uuid": "721e8406-cb3d-4fb1-ab80-9542cb2a8a2f", "comment": "Malware payload (DCRat)", "value": "531202dbbf1b9f5304b80a98cedbde8d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855443, "uuid": "1b372061-2bed-4aa1-9fe2-b14bacf87126", "comment": "Malware payload (DCRat)", "value": "726eb2c34ce1d06acc8f70927f52b05e27380b2616d0c9556146bd8dd1311df7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855443, "uuid": "91700b4b-9f4e-47e5-b2bb-7cea457b40ba", "comment": "Malware payload (DCRat)", "value": "dcab6e84e2b1f6919e459dd19fd540840b0d1a98", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855443, "uuid": "71b174a1-9cf0-4588-8993-8da66227a9cf", "comment": "Malware payload (DCRat)", "value": "d58438302033738aa67a9467a5ebdc86c7c2da1fae28fbdcd99cf5d923fc5925ba1c117a3a46b1ef9fdf168ac5a83183", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855443, "uuid": "0ecbb0b0-855b-407f-8b06-37378b78b4f2", "value": "T1B055CFDCB66071EFC877C8769A982C74AE5068BA830F7303D11715ADAA4D99BCF141B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855443, "uuid": "25e3f9f4-867a-42c9-a00f-eda02d91e2e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855443, "uuid": "ac4c2c94-dcf9-4ebc-b5e6-804c990f9762", "value": "24576:jTnWWS7zcUhgd2d40yk5gqQgY8ctqisH3Sa/0B7U7NqvFHh:HnWp7zcUU2dPyhqQx8Oqfd/0B4wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658855443, "uuid": "f67eaa2b-b69b-467e-b775-1cd81e0c721a", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658855443, "uuid": "a657010f-d27e-463a-8d80-176d0409f1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855443, "uuid": "c1e82de2-0b6a-4846-93ad-4c690dc85eba", "value": "726EB2C34CE1D06ACC8F70927F52B05E27380B2616D0C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec157e9-0cdd-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658838150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838150, "uuid": "9f42752d-18fa-4b47-9c53-221ab9371614", "comment": "Malware payload", "value": "3c96db78a0db4b979cfd73126aa12b77", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838150, "uuid": "b12b32e9-e869-4f16-8842-c4215968d789", "comment": "Malware payload", "value": "72a2b97b7bf55112cfac7f8b236fa6b35fb76276fb60495f300787f08d57c34e", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838150, "uuid": "ae39e20c-f839-4fbd-82dc-3ea82f1dd101", "comment": "Malware payload", "value": "e7405772472937c6409eb27ecbf0aaacdb2c5854", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838150, "uuid": "3e32fad7-a262-46e7-8f44-e13fee6aaff4", "comment": "Malware payload", "value": "d4f4756a3b1bcdabc7adb3b7c50acab449ed2a8640fe253ee729cc882c2ad43351f68af9d762c2bcb344956f9da6a667", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838150, "uuid": "6ddc0de3-5494-4b5b-a6b7-499fdea75366", "value": "T193467D13F280A53EC0EB1B3659379668A93BBA703E16CC5B57F4488C8F395407A3B657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838150, "uuid": "1563f4ca-6479-4882-8bc9-0d44cfb2d20d", "value": "98304:sAierjKagiGnD1CsIZlq8KCB3+Nj+ZlqTGY7A:sufBgi4DssIXF+Nj+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658838150, "uuid": "bcb1e6ed-b202-436a-b5ce-b90c41f116ae", "value": 5454848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658838150, "uuid": "e856e926-c361-472c-bda5-e564c6ea3cc0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838150, "uuid": "d555068e-e9c5-492c-a6d8-4096c9ed966d", "value": "Archivo.nopagoFactsRef26-07-2022.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614db0c2-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877991, "uuid": "b805cc14-2061-4a44-9ae7-fc0d4ef38b10", "comment": "Malware payload (Mirai)", "value": "6daf7a508cee4f6f2a1472ab13529e43", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877991, "uuid": "a395ace5-5c26-4a2c-9dcd-9e118bc7ed53", "comment": "Malware payload (Mirai)", "value": "72fbad677a2ca79e559fe7230832c030e6ad50a26d3b4c110b45a01ceebe5880", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877991, "uuid": "3d980fb1-7389-4b04-9145-489e6da5dfd6", "comment": "Malware payload (Mirai)", "value": "92a6eb889163fabdc55f034c5401a5efc6b338a3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877991, "uuid": "949d2a90-f2a5-4f7a-bdd7-be677edb435f", "comment": "Malware payload (Mirai)", "value": "1f2060ee02aebd1b810686fa4e0e936ae1f7d01beb20c40c7eb6a2162ed0bddd00ad877bb0f0bdca6def5a4034cec34a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877991, "uuid": "b14c6c15-c1e1-44bb-ac3e-b1ca99f18909", "value": "T170431817F94285FDC049C234177EBA3AE92735FE1229B2AA67D4FB263DC6D611E09C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877991, "uuid": "47c8e4f6-a790-4d60-82a5-8c7f656df2ed", "value": "1536:mkYb4siXqPToSxhoe8TJrPGbCwOgF0qBfkDUNL7:fYbcaPTxhoe2PGuwOg3JkDU17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877991, "uuid": "771bff4f-ead8-41b3-8b3c-8b2b94ed6cc6", "value": 58512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877991, "uuid": "59d128ce-bde5-4f43-95ee-1cd36812f763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877991, "uuid": "3e193f6c-8393-4769-8e96-bf7cfeebf9e1", "value": "6daf7a508cee4f6f2a1472ab13529e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41dcb59-0cda-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658836871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836871, "uuid": "cbb8b295-1ec4-4037-9fe1-4ec02ff1f6c1", "comment": "Malware payload (Loki)", "value": "67d3255f30dd929a6492d4c11304e1e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836871, "uuid": "9364393e-e11c-4cd9-86dd-47950dcd2a96", "comment": "Malware payload (Loki)", "value": "734fb6cefe68c150be6e9b31283606c47be648dfa3164d3e2e9d1d6a5680d4bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836871, "uuid": "baca7f05-8614-4e4e-a120-61678947c8a0", "comment": "Malware payload (Loki)", "value": "a27ba7164e147ace772a97cee96945f2cf9fd202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836871, "uuid": "884f8863-ddf6-4be0-98c3-b4e5a5c2763b", "comment": "Malware payload (Loki)", "value": "3f850b63d0880a30386170180d78272514e6e0836946d7919d3d8ae8a4be08e56173bf3672f9cebc8ddbc4222ad352a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836871, "uuid": "902f1dbd-6ec2-420c-a5e6-037111e0ec22", "value": "T1AFA3C371B6A7D760C55B4F36C49E750D23709F022623964AF89C33394AF33CF6A46A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836871, "uuid": "4c5fb492-f01b-43bf-b6f0-93c28a3668ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836871, "uuid": "4f5643fb-3314-4b87-a01c-38f9ddf0b745", "value": "768:EHQrp8MGM2MBswQR+kqcZxFmYosfwrVP2GLGa:ECp8SLB4qcZxFmFVrZGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836871, "uuid": "4ace9bd6-7ead-45f8-b13f-e29b58e2722a", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836871, "uuid": "24852c01-ac7e-4e2a-94fe-6214eb68c54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836871, "uuid": "63e6f6dc-ea6f-47fa-ab02-1c70ec4e6ed6", "value": "SecuriteInfo.com.W32.AIDetectNet.01.9089.5329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1fba4d-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658828721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828721, "uuid": "a421bc55-a12f-4724-847a-58efae0db909", "comment": "Malware payload (Formbook)", "value": "640719be9d01251afea013bc6d78f948", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828721, "uuid": "eb02f13b-e2d8-4d4b-88a7-5877cc871ac8", "comment": "Malware payload (Formbook)", "value": "7575405f2aa1499e0904370b2c792562ec71941cd81f0f86914be1fed935108e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828721, "uuid": "3d4a7558-c292-4e9c-84c1-ef6de6b678bf", "comment": "Malware payload (Formbook)", "value": "df1d9d6c8175eb21328385b6308cf3a076bc9533", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828721, "uuid": "673cf83a-f56b-483d-9cef-bd75afa63f40", "comment": "Malware payload (Formbook)", "value": "c475c5dc143b3265a3c1f83a50e7ae900ac51b530350fa5b572bfafaa385a1b4977ad7ca3b016dae3c75984b609286d5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828721, "uuid": "1b430af1-4495-44e8-93b8-0d12779d7cc0", "value": "T1E7E5C531B13079C3D31B0566565FBD894308BD87B3C66F8C405DFAF92DA29ABA70690B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828721, "uuid": "0a3c7fd5-ef66-4a06-a45b-a04f3a67a521", "value": "24576:ckRntMtJlIV6VWLQLK6Rgurr6Vx6vxVb5j+Ecacs7RWudTZ8oz/7vH4UX+csjns9:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828721, "uuid": "905f9241-e720-49ae-9b75-f33e9cb53cbb", "value": 3304423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828721, "uuid": "20ee28a6-befd-48f8-aae8-96178d5611e3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828721, "uuid": "283188e1-0830-4bb7-a3a8-b332b9876514", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.28177.30849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db1c641-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824673, "uuid": "d90c7998-4711-4d10-ab35-59787f54a9ce", "comment": "Malware payload (Formbook)", "value": "215eaa3641b8510e120e739e5928c851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824673, "uuid": "7acd60b1-d721-42d2-9079-e4fb1c54c6cd", "comment": "Malware payload (Formbook)", "value": "7605a345fa75ce61499e5f4d15cafb9f55a6918c82125d84a5ed45af2a28951b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824673, "uuid": "64c1bcaf-6b8f-446a-b698-df2854bcae9f", "comment": "Malware payload (Formbook)", "value": "1f81de0780c5f824f731e04d83c3944643c1f3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824673, "uuid": "4e4dc77f-5385-4e30-b43a-d2397ee271db", "comment": "Malware payload (Formbook)", "value": "2eeff4dcaaf846d9262c48b90a3f8eec442d0176f114744396163b96a73fed4f6d0e5c822199212c0f5bb6d4e37bf500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824673, "uuid": "aefb8a3e-7abb-4170-ba9f-9f242fc66814", "value": "T193F4613D364906ADFC1F8430590A0B26EF620E0F364479F36B9A35EA87DF3765E45988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824673, "uuid": "4b09a44b-dade-49d3-a8bc-8a737920534f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824673, "uuid": "04e2e5bd-1356-445b-a412-d5ef4a8e9964", "value": "6144:VEar0uHUU1W+tcP+Y0m5exx7vVwQOITdJBrMLKigzyx+Hoay+7+d/EDsgPwhhZ3m:VEKHrntsoLN4IBJBQL1CLH6EDsgmhZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824673, "uuid": "e5089efc-ca89-4e1e-87bc-1588db92235b", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824673, "uuid": "4518eefd-1b61-416b-afd1-41872d67baf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824673, "uuid": "c75ea2cf-395c-4173-8889-9491bf18edc8", "value": "Vessel main particulars_MT.CHEMITEC V2207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a802bf0e-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843320, "uuid": "d3677909-3f8f-4112-ac3d-872e7ab723c7", "comment": "Malware payload (Mirai)", "value": "c505970e2105dd7ebd918c9bed94216c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843320, "uuid": "b59347c6-f3a6-4c95-bbbe-2f1f85baa691", "comment": "Malware payload (Mirai)", "value": "767fbfcdd8489e95d2fca00b8c3a668474b38f2bf6e8be106d71b58db71bcf99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843320, "uuid": "327736da-944b-494f-8a00-23916f0a5981", "comment": "Malware payload (Mirai)", "value": "60122a3f38ba5c1cfca3f8858eb26414a565ad48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843320, "uuid": "74b5967f-5bdb-4689-9699-24442d7b41d8", "comment": "Malware payload (Mirai)", "value": "98f256b9239f768a13686f7c5d8d3918de07df7009fd16afc530760d42ee9bffa58938824b56f84ffb8064a4e0afbb35", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843320, "uuid": "143feeee-f069-4137-bd4b-8934c308793d", "value": "T12263734D7E618FBCFBA9863447B78B20934933A627E1C584E15DEA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843320, "uuid": "aae1ce49-f6cd-448e-9c0a-7d14e54e7a71", "value": "1536:0MQ7gwld5+gZNoEXrlXruEXrtl9AN/nuio8T8KTRdSHzIXTC3:Hggwz5xAocQ8T8KTzSHzIDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843320, "uuid": "4efc6eb3-9a51-48af-b1ee-8750baa2c037", "value": 71668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843320, "uuid": "e47c70f8-8d4b-41c3-bbbf-fcd6e86a0b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843320, "uuid": "ad656957-0845-4192-9660-d71225c2a645", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d497aa8-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848241, "uuid": "beff9b02-601e-4acc-bc05-0bcde7ee61d6", "comment": "Malware payload (SnakeKeylogger)", "value": "57a7667e69c0882f154decadaeab0ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848241, "uuid": "fa285b4f-3ddf-48cd-ad43-a033c7643dad", "comment": "Malware payload (SnakeKeylogger)", "value": "7699a3de76293713125c8a4422be456f36330b9819d3f4cb33fc3987f8322109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848241, "uuid": "f9158fbd-47bd-49e1-be8d-89edc6cc7dd5", "comment": "Malware payload (SnakeKeylogger)", "value": "5d77c2f016bf06ee8a1b554884fc887687d8e398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848241, "uuid": "1862e56a-7bc0-4a0e-bd88-4c3cc01e8a2c", "comment": "Malware payload (SnakeKeylogger)", "value": "51326074ababf055756a513b40733412e8851fdcedb12beb1975a78294f15f17fb1539e5e369dac2f9d522166dc7cbd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848241, "uuid": "21abc97f-07b3-4944-b996-7aa7450c4404", "value": "T11515012D16F45B07EBBC83F9CC60050057B42A143553E7688EC2E3EE2BE5BA19D47A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848241, "uuid": "f2e15f7c-a777-427f-a1b0-32496c44d773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848241, "uuid": "117b0158-7a91-4b0c-8db8-99a8d35b091f", "value": "12288:vw3UNNTaF11cjpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrSddSgEUbZmT0/5+b5Oq7Ddrv:I1cVw4UZvybcv8vUgf60/5+bAqlxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848241, "uuid": "d236aa07-51aa-48bf-9d64-c45522ec316b", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848241, "uuid": "2b71a2e7-5f0e-41e7-8d99-84f5f406188c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848241, "uuid": "1d62c8be-3c5d-4d44-a4e9-a34e0f5b0216", "value": "productlist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ccd1f4-0d07-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658856149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856149, "uuid": "040e09e8-d2ea-47ce-8bee-d77e4ce1e67e", "comment": "Malware payload (AgentTesla)", "value": "d57626d71651af3213f3ad7497fd9b56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856149, "uuid": "49413595-c081-426c-ab7b-73b3bd9dd867", "comment": "Malware payload (AgentTesla)", "value": "76c5703c884be893a5f6e5c6f2aa94d1c74d5c6b49e5163d8a88cdb30eff87ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856149, "uuid": "6a839cbb-dee3-45b9-967d-cbbcce750452", "comment": "Malware payload (AgentTesla)", "value": "98a79b2e10ad39b01669265d90a7b14256294439", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856149, "uuid": "a792fe9c-471c-45a8-8420-1975e4bbbb3e", "comment": "Malware payload (AgentTesla)", "value": "b9616a8aeb1771a1104185b9fad4185a84f46f0121f01326618a67cf8bc6958d939d85e08d2fbc08da7fb3ee069b5b40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856149, "uuid": "f55474e3-c7ff-4434-a00f-21dbc774bb9e", "value": "T136D4CF1120DBB724EB39F77412D8A0616FF5FC13D205E96E2EA533968377E604E32622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856149, "uuid": "050bc2f5-6c96-41b8-afc0-1d53bfda9848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856149, "uuid": "5c98e0c2-e516-4659-b747-3c2b9974f75d", "value": "12288:fAI2pu6jixgV2iNDMpMk7FxuO8fEK78YfL:fOixgV1GL77SfbwYfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658856149, "uuid": "24bffb89-28b3-41ee-a42e-98ff06e4ecb7", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658856149, "uuid": "44050978-1526-40f6-a6e8-a1cb24e55901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856149, "uuid": "3d462b10-e489-4b29-8a5f-d3507947a7c9", "value": "wire Remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cc514f-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658846866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846866, "uuid": "d2c38cd7-5424-444b-8f4b-82eb2818cf4b", "comment": "Malware payload (Formbook)", "value": "57a5462220f3154d7b179c3f1fe400fb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846866, "uuid": "73c7f95a-037a-48e3-bbfa-2a32db0db653", "comment": "Malware payload (Formbook)", "value": "77fb73da40af840f5e64b1b5135e834ae8271d07040548e92415df2c846553cc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846866, "uuid": "57fcf0b1-db07-4fcd-af4b-5dc0757576c5", "comment": "Malware payload (Formbook)", "value": "a095bf73ef6f83161539722d7d23a8d8e3afe291", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846866, "uuid": "a74a96a9-178e-48b8-a49d-87da327d8ee3", "comment": "Malware payload (Formbook)", "value": "ac782f93570d39b84012db2ed561e5d005cf8b5bcdff72e73b1c5cf9c62c990101689830984ae2ffa90bfaa848e079a4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846866, "uuid": "ca10a299-6dec-4d56-bf8f-170d7253472e", "value": "T19CE5D531B13079C3D31B0566565FBD894309BD87B3C66F8C405DFAF92CA29ABA70690B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846866, "uuid": "2e21530e-d684-4649-8d8b-ee68e30e9fce", "value": "24576:FASVR2eLN+Orr7HrkYPFjuB/Ynvr/wELKkGVNN93G+aiGrGmmI64iJYJ2VLoN68r:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846866, "uuid": "2c7edf0e-67b8-4042-819c-30f124065c37", "value": 3292135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846866, "uuid": "d1294922-20f3-402c-8db3-65ed30eb7133", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846866, "uuid": "5f28dbf4-63c2-4a7c-ab31-0b5d1736333a", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.15715.29556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2e20be-0cea-11ed-93bb-42010a9c0043", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1658843490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843490, "uuid": "bb6b8696-a413-4c03-abac-3dd9c824bdce", "comment": "Malware payload (RaccoonStealer)", "value": "5752a763b73a39f1c7f08c38483af078", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843490, "uuid": "b220a0eb-8b8a-4438-89e1-9f2129a71d4c", "comment": "Malware payload (RaccoonStealer)", "value": "78437d8b249dceedd12b0663e23a4ce63eb2c390a2c4a0054aa5c8e0c2fcd6e0", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843490, "uuid": "42dfd409-a4b7-4b48-a00c-7042a6c5b20a", "comment": "Malware payload (RaccoonStealer)", "value": "cb9e7e46489d96cb80df6ff25a891db31bbc44a3", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843490, "uuid": "ed3b0858-bbda-467d-a906-566e0ecc215b", "comment": "Malware payload (RaccoonStealer)", "value": "d7d6469a0307280ed226032cd33f86c7313ba9cff6e05c302e6a90baab1495f40ed2b4a4566a2b9ec91a6a59002bc3be", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843490, "uuid": "9a3b8bcb-0ac0-4981-9843-09bc4ee8632e", "value": "T11D66333C70E57093947DA7EAA643F0BD7F8636E1432511C9F6B5B883D94908DE8A0E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843490, "uuid": "5329703e-efb1-4eba-95bc-2cd7fd76cea6", "value": "98304:APNPWhO6IEMRJTPmBzoXJTDE5tQYG5q25yas6PO848OHrv+WF34ajsyVTSi/+pdb:AEOptAsTD+X25x61rmWF34ajT4dsZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843490, "uuid": "56b75e84-3c20-4446-b71c-31c33823eee9", "value": 7066775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843490, "uuid": "04e1ae82-8d77-4e55-b8e7-d7cf75a3c7cb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843490, "uuid": "eaa0419a-3c17-4443-a509-4b41987cf1ee", "value": "JSNCrack.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad65e32-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843325, "uuid": "a7cf201b-9e84-481b-a082-d9cd19fe7e59", "comment": "Malware payload (Mirai)", "value": "7fb9c87f671ff2b6c459e259132b37b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843325, "uuid": "c0db8757-c8b1-45cc-a829-e571785962ba", "comment": "Malware payload (Mirai)", "value": "78527ea32131fab303aef61189882293958ef0025bbe897b16404bee9d73474e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843325, "uuid": "a4d54481-b1cb-455d-ba2e-13211b8d0fb1", "comment": "Malware payload (Mirai)", "value": "c96c2680f38540e003f6233e215b2b28171f1f63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843325, "uuid": "5d97bb00-1040-4a7d-8877-9a5229a959d8", "comment": "Malware payload (Mirai)", "value": "2faf3834c9b63629fb0861de2fe30a446fd5c1655646a54da93ba94879e32bd076d111fd828f7270f11a85d6b5698123", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843325, "uuid": "eee4670f-68dc-4b82-bc44-dc3d04f969e8", "value": "T13133F8C4FA8B85F5D907493040A7F23FCA32D97D4071DA9DEF8A9F35DA37942921224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843325, "uuid": "b49a152d-fb23-4ae4-9bd1-a8977552da36", "value": "1536:Rh24UVHA1JqOMnjoMGhlV9Q8SaR0VMs4+a:Rh2VHA1JqOYchT+8VR0VMs4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843325, "uuid": "044df193-99fc-462e-9339-3f7ab9eed850", "value": 54064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843325, "uuid": "270d7629-dfb3-44d8-9649-79a34713770d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843325, "uuid": "f258d033-08dc-48c4-b744-94298899eeb2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8653c6-0cd4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1658834097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834097, "uuid": "ccd4a920-ee6e-4a50-846b-c38b1e7483ed", "comment": "Malware payload (RaccoonStealer)", "value": "1d72d9db1bccf3dacfe759a8001af865", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834097, "uuid": "26fe8a74-dcb9-4343-ae14-892b86091304", "comment": "Malware payload (RaccoonStealer)", "value": "79438db226f6df69f83940d66147d7caa952047c0b868a21d647d9bd293bd4af", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834097, "uuid": "aaf612e4-5b4e-4082-a93d-a046b76e68df", "comment": "Malware payload (RaccoonStealer)", "value": "e7d37576f904f32a10c81aa4620615d6416fc706", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834097, "uuid": "8e8c3910-f8fb-49e9-9f45-ea14be198269", "comment": "Malware payload (RaccoonStealer)", "value": "a0a45ae51b5287da2361ceb1ead9dfa647239e424e830f7a1b1af21a9ca0e3a2b34560d11587467beb15a0b354d08628", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834097, "uuid": "1c871d1d-a0a5-4c25-949d-c798bf559ad8", "value": "T199F63338B1C27D9BD61E27D9F257F97D79CA7DA443B104F1B2E4711BCA0C048C9A2A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834097, "uuid": "52c090cb-8e86-4c24-b4bf-551ce93c65bc", "value": "393216:D5Qo9DyMzfE4Hvf7RCqZ3/70S5KT2+EzmpyidfbQ8OIw4RgPC:FQyDTzsi37Qq1z75KC++J8OI/WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834097, "uuid": "a7dccca9-7aa7-4419-8165-9162f9d68b39", "value": 15523753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834097, "uuid": "13bf9045-005b-4240-8031-2ea7d624113b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834097, "uuid": "1c92639e-555d-474d-a4a0-17416bef7d12", "value": "Installer-2022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e690664f-0cdc-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658837841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837841, "uuid": "c0e4a447-9af3-4ebc-9601-bd8978c96023", "comment": "Malware payload (njrat)", "value": "e86d5a571ba88ed0144cd3f086ae6e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837841, "uuid": "d5b39413-faaa-498f-937a-efa00c1c5bfc", "comment": "Malware payload (njrat)", "value": "7981b053a1d15adb466e47fdd458fdfa9f842ded0781bcb5f409fd74d3473d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837841, "uuid": "11943ae2-70d1-4156-8683-c0b59f10ff92", "comment": "Malware payload (njrat)", "value": "4fcd620944d20b05c11b26a960ef6e5f8859e4fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658837841, "uuid": "916ead99-6524-425c-925c-d11faa7f9345", "comment": "Malware payload (njrat)", "value": "be0789f669d857b5c4b85ccfe815e77ec6821305a6e8a7b45db5b4a037d5264ccd2e95083722d1629a4b1ab59ae5a8c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837841, "uuid": "b6b67028-6331-47a1-9290-83291def90b4", "value": "T1F403394D7FE18168C4FD467B05B2E412077AE04B6E23D91E8EE564AA37236C58F50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837841, "uuid": "8aa0ca7b-546c-4710-a42e-ce4b5a25f3b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837841, "uuid": "122748dc-e075-47e3-8d07-c1c016d1e817", "value": "768:CryQw7zPOTUv3XI3MfrM+rMRa8NujvQt:ShoPOY/XIcg+gRJNkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658837841, "uuid": "4927d3ae-a7e2-430a-9214-131e1b823a1e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658837841, "uuid": "816691e9-a722-45b3-8ed6-cc1524d3e081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658837841, "uuid": "a56e6c04-be1f-4b80-b92c-e0bed6bb76de", "value": "e86d5a571ba88ed0144cd3f086ae6e79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84d1f21-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658846810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846810, "uuid": "586c7b07-0b36-4d14-8007-50cb5d43e4ec", "comment": "Malware payload", "value": "9615678ec8a4c223e98a868eafba663c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846810, "uuid": "cb46c728-a123-44f9-9393-55e68c13fedf", "comment": "Malware payload", "value": "7b3e0f37ccb39f365eb6df60adee32acb4ad3219dbbf8d022f4d5ed14efb7ea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846810, "uuid": "e4baf0a0-7c5c-41ad-90b6-f0d44bddf488", "comment": "Malware payload", "value": "d0f45c74e5287d86c00f51763318790e41a98a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846810, "uuid": "03634a92-5b9a-4527-9b2c-4a128e2feadf", "comment": "Malware payload", "value": "9c26664c63508291549af61d8a8e8e2e89a4a7278e9f10a6c0ee5bcdb7e4435a08aaa77334670ea1a1829cb0ac97d7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846810, "uuid": "3d1543c5-efa2-4437-8ca6-b356f1d7b474", "value": "T142E52399A15C436EE22BA4304A9DFAEA7FDBF7214CC000B2F0775D4DE316DE01A5791A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846810, "uuid": "e8708d49-b000-49af-a0a6-37e5fcfd0bde", "value": "f433e7fcc51e68080022754836705744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846810, "uuid": "59f19021-7a41-47c9-a2d0-3aa46e7949de", "value": "49152:LtUsGunG2LKMBoHExEjMokT4sABG8gAVay9+B/elUFvoUgnC+iT8vjgsdbFYi/ri:ZqunhoHE+Yoi4s0JFzMWlAo2+itAr0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846810, "uuid": "45aadb0a-a6cd-4caa-9908-96f43d1e7847", "value": 3183816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846810, "uuid": "f4b0b7f7-dd97-4dee-9e7a-ad1532ff64fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846810, "uuid": "1b255c97-cc90-43c2-be43-d3f37d9eccf3", "value": "zcbg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e981153e-0d2c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658872206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872206, "uuid": "d874ec31-f822-4350-b35c-6a6b8aaaf257", "comment": "Malware payload", "value": "f8d11b95455938ce9cdd01878af2eb52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872206, "uuid": "add33907-44cb-439f-9b8b-9bb5c20c7193", "comment": "Malware payload", "value": "7bf4272ee9d4a8e8c5e18d07faa5190f311cd1d32b928bf4bcab080a0af9adef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872206, "uuid": "db80b4c9-43ef-4547-b7de-3c4d5d3a7eab", "comment": "Malware payload", "value": "58727971a02a51dacb8846d7cd64a99d9725e72b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872206, "uuid": "3e523e1a-5e18-46b9-8eef-19281f9dd503", "comment": "Malware payload", "value": "a2d05f0e4b626a729dd737529b97cb2ef6857f0b08808733299f0f503b0239f8eab255470ece4647926d33b0bb30355c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872206, "uuid": "40c0db71-1acf-4bcd-b6c9-a898f28fb039", "value": "T11D356C99365071EFC867C976DA682C20FB60B577530FD207A05322ADAE4D6ABCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872206, "uuid": "da4c9aad-66e0-46c4-9b93-ee53a49daee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872206, "uuid": "bd75531e-207e-44aa-9bbb-045c26c02355", "value": "24576:/QfhGjkPlGCMfPOI4yV/RA9byStlkk93lR:/DceH4C/RMbyStj93l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658872206, "uuid": "bf480b85-c8ba-41e8-bf8a-31fefe8989ad", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658872206, "uuid": "3088be0b-90f4-46d5-beff-b0af67838564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872206, "uuid": "d033772b-93bd-4a94-a7ab-6b389a5dadc7", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18421.3909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b78ef2-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658824505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824505, "uuid": "261f8d7a-c49c-4638-9d0c-0ca9f390d362", "comment": "Malware payload", "value": "fc4a91169e3da6f62caee3a655beb883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824505, "uuid": "12f4dbd9-2df7-44f0-90df-1a70eaf03f08", "comment": "Malware payload", "value": "7c341cc565a504e52023b757f85d198d8ef81aee44f249997d7f3430512acdbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824505, "uuid": "52763e89-fef7-4013-b5b3-eba2e9cadb72", "comment": "Malware payload", "value": "5d76dc69224c9054297f891bfbe40a8580c12880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824505, "uuid": "dd0aad00-4b0b-4347-8067-f0d9aef0ff78", "comment": "Malware payload", "value": "aee52c7f7caef4f5a635bde35a6d0a3e4380d16c5f02c6f59a98898708aaef10b5ec245c475d996b393635fa94b05921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824505, "uuid": "5909b923-f93a-4429-9401-d6e061f5ba62", "value": "T1E0A41B2C3E454B7AED8ED53249018A14FF6E0A237280FAC257FB16CAC74F5652D76CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824505, "uuid": "a8c9c823-93e7-4cc5-a7e2-228f326526e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824505, "uuid": "dbb7cbfb-0212-4e35-b1f4-a85069fcf175", "value": "12288:eRCzzsj5j99fxt6yCbZdi0WatEgbLOfl0t5GsL0GcVpden9HsjVp37SGUybnDbqe:tdB9IB+cweFPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824505, "uuid": "dd428ef1-2f9d-4ea9-8b4a-022df00c563f", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824505, "uuid": "a1136e24-82d5-4c6f-b80d-9a7921ac03ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824505, "uuid": "b108f629-eb7b-43e5-b5f2-a9fc0408ec94", "value": "MV.YAMA HARU - VSL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc12f014-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658851111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851111, "uuid": "ac3d3431-cc59-408c-9637-9ac94d4ee8c8", "comment": "Malware payload (NanoCore)", "value": "50b50ac2a49ae89b21acd13f219a80bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851111, "uuid": "ff8f9ea7-54c2-43bd-a7b8-083addf2f757", "comment": "Malware payload (NanoCore)", "value": "7cf6987c1d9a592a6093dbf2826a28a3f6c1f4ea552f53c58f111fd047ad3e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851111, "uuid": "5ab3167e-785b-4603-8742-e445f45e91d3", "comment": "Malware payload (NanoCore)", "value": "da1464fbb1e15a55fd1d26b6970ef44732f9ee8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851111, "uuid": "bd011fcc-25f1-432f-8f7a-9aa7a18065cd", "comment": "Malware payload (NanoCore)", "value": "e3547031c8e8b8655b50045c3196596e7d8e4d65ae1efa8d9802c4c24ebd80a28a36dba80be55f0cab59046011bf6d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851111, "uuid": "73ee5b8a-09de-489e-b829-229d90a19b1c", "value": "T1DE2512295BB49F17E9BD43F8812106048BB979157546E3AC8EC1F0D93F67BA0890BF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851111, "uuid": "5182c711-9c44-41da-929e-562390f8e4d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851111, "uuid": "4a958e76-e41d-4d01-b1b5-8fe0caf3d563", "value": "24576:4ccw4UZvybcv8v0UwcRUJtLV262DwxrP:4cc6d88UwcaJlfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851111, "uuid": "eacae313-07c2-4372-b914-812564011446", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851111, "uuid": "c7753414-6763-4e26-a677-087745a906b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851111, "uuid": "2deac0cb-a8ec-4bd0-a9e7-4de74e83bb4e", "value": "50b50ac2a49ae89b21acd13f219a80bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9ea6e9-0ca6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658814365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814365, "uuid": "ff20d66a-de2f-4d23-8857-788b640b9304", "comment": "Malware payload (AsyncRAT)", "value": "7b0f0f47ac26e45e481d51b2d2105b52", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814365, "uuid": "b6f9d832-4bf3-4e3b-9ab0-e2ac943d8a92", "comment": "Malware payload (AsyncRAT)", "value": "7d1a981c48788249de92464d0fd7efd7c58cc7de0e73c5d65df4d63e82efb217", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814365, "uuid": "0759fdd2-d9fd-4d6f-8e50-dea7f5546856", "comment": "Malware payload (AsyncRAT)", "value": "1cc5a10fca7371f4f8e84e7ac86a81f10e37557e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814365, "uuid": "013df333-059d-4f1f-8f7b-11ceee80de8d", "comment": "Malware payload (AsyncRAT)", "value": "c63aed7857c8004d09307539c7feaeb90a4758bbe84d5d80cb49fe952993b3151ada9006620d07e84c095f7eb5aa8c9c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814365, "uuid": "0c19956b-2112-4d31-9cf4-87b95f145f5a", "value": "T1CE14082D7692C910CB984636C59AD4080261AFC75F62FB1A34DA7B7D0D323CEAC4DDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814365, "uuid": "5c7cea15-e045-4dfb-8c96-2862347c1896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814365, "uuid": "794344b0-fb1b-4207-b7d8-3721f65aad21", "value": "3072:ORRbIFJ2TPORetnwyWOtuB6RLXPmKBv2oKjWolAfjZ+TVLerZ/Jx:OgJiP2invWPyPmcOVAfjYT9g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658814365, "uuid": "9fb50896-aef9-4012-84e9-cbefc6cfc25b", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658814365, "uuid": "1f8a23db-25af-4414-b0e6-1d5d91548e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814365, "uuid": "eb633b28-898d-4605-b907-0336f3c2627f", "value": "7b0f0f47ac26e45e481d51b2d2105b52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfa4359-0cd8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658836106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836106, "uuid": "24631222-583c-4fdd-bb40-fa8559c58fea", "comment": "Malware payload (Formbook)", "value": "905bf4314f83c8c14846f709729a43bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836106, "uuid": "ae346796-3023-48f7-a59c-a084aa857d63", "comment": "Malware payload (Formbook)", "value": "7d85c6c8abf4c9f2fa6c4528991979d5cbedefc73ec3ce83c04a4839b50c9555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836106, "uuid": "87cab8d7-c6bc-4832-8f52-804165f246f2", "comment": "Malware payload (Formbook)", "value": "8784db2a7474c3316f9d987dd14792f725f6170f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836106, "uuid": "88845406-d1d5-4b94-b2d5-bd7eb2aa48df", "comment": "Malware payload (Formbook)", "value": "b2bc7ebfea92866b2684a012c3d4ba0edc91c08c07edbb22ab86f8286841a755b223efde536c1dc1ab29addc7f0e200c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836106, "uuid": "9c8be811-291b-46c5-a165-9e95a1743136", "value": "T195C52A135A8B0E75DDD27BB4A1CB633BA734ED30CA3A9B7BB608C43559532C56C1A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836106, "uuid": "256881f6-2a1f-45a4-a29a-311ffa4056a3", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836106, "uuid": "ab058cc0-8d99-47db-b105-c06eda9c0a62", "value": "24576:hdqzXlGRmna+mYkYjKjBL6tMGAdOesp0/KBlw592j3FP7KLLiV4lml3RuQ553138:kGRmauN5Lj3FP7KPiKml3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836106, "uuid": "71cdcd05-1921-4521-83f0-a0571720ae99", "value": 2593473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836106, "uuid": "3715cf73-9b75-442f-8d47-df87017200d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836106, "uuid": "c3830984-380a-4440-99c7-5467e2dce3bf", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dc84d7-0d17-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658863073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658863073, "uuid": "0ecb71b3-7fea-4d59-9e41-3cdca6fabab4", "comment": "Malware payload (AgentTesla)", "value": "07e7938c123033e171856f846f68fe99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658863073, "uuid": "3e2889b2-58ab-4a53-8505-60bf319f670f", "comment": "Malware payload (AgentTesla)", "value": "7fce1debba8e4503d2db2a9b5358415077e782228d5059917500f0b773eb0254", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658863073, "uuid": "3f539d51-2bc3-460c-aeef-a9a53df740ea", "comment": "Malware payload (AgentTesla)", "value": "79cbeb2e46371161564e623fb233e1a9af138a95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658863073, "uuid": "4b5e4863-2121-4184-8b88-c2d1ef6d88ff", "comment": "Malware payload (AgentTesla)", "value": "00e07053cc365db5aa0d38165a910a0c5059cff83f3cb725296ffe371b9a35bf9d41a67d399ce2f50e396c07015bfb48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658863073, "uuid": "2e19424c-9705-4979-b0cd-4dceebe20de9", "value": "T1B7E4ADC170CA3FD4EA29A7350FF4B1203BE5AC26D224ED2D1D56B2558773A63193392E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658863073, "uuid": "02591b5e-968a-4991-b50c-994ea74664d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658863073, "uuid": "c7599c9b-e8a8-480e-ab68-6cb9c5267c09", "value": "12288:wyo+8ZsZyZ/sFCbuDjixgV2iNDybIU6sGGAxnj6ibpTv/sUbM40Ry:wc8ZsZyZ/sF5ixgV10YP5oW/fM400", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658863073, "uuid": "634186c4-ee59-4c88-a4b0-1bbb3c9e113e", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658863073, "uuid": "82e97a15-f32b-4612-adb5-12c64cd0bab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658863073, "uuid": "582ca5ab-5773-458d-bf7e-be6225b63130", "value": "container docs with AN..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de45b734-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658851571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851571, "uuid": "70791d70-ebe0-4a5b-9a54-976aac1c667a", "comment": "Malware payload (SnakeKeylogger)", "value": "f18592fd1912ac0404565944991e77a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851571, "uuid": "c6e42c95-ad11-41fb-9775-cf2128c2da86", "comment": "Malware payload (SnakeKeylogger)", "value": "806bfede204f2390d3e142735dfb3ee25d440eef2ef1966ee1caca991ca5a60a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851571, "uuid": "7ffb340c-2886-41a3-b811-ae26795e1a6a", "comment": "Malware payload (SnakeKeylogger)", "value": "2e1223248dc170ca557345e9bd0a8cdf62f2986d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851571, "uuid": "512c8f10-0827-414f-895e-c73a730c3552", "comment": "Malware payload (SnakeKeylogger)", "value": "ff4918e8357e9e22e85b4ff11ef0d6f8f394a96d9683f37a56c7467ddd4b51daafc0426a44e1629e10c4aa3bbe9e92e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851571, "uuid": "b30ce2e6-0b96-4a93-a1df-abd9956d947a", "value": "T1A615122C2BA55F07EDBD43F9802046049BB47A663547E3684EC2F0DA7F62FA05947E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851571, "uuid": "64316a73-fcd3-4f10-a221-08c7a1697176", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851571, "uuid": "7642e95e-0ed5-4c54-810a-114910c7d05a", "value": "24576:0ccw4UZvybcv8vKQ0JJ+EEarHZGVQfdxdP:0cc6d8CQ0b+pS9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851571, "uuid": "66c4bbee-e155-4dbc-939c-4675358ad86a", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851571, "uuid": "d5febfb4-fa19-4bb4-ac1f-631bab4d2c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851571, "uuid": "ef8b33b7-3d18-4fa2-9862-a840f39c71b8", "value": "f18592fd1912ac0404565944991e77a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a250e0-0cfa-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658850644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850644, "uuid": "c2b81464-d45f-4e4b-ad1c-55e7f72bff92", "comment": "Malware payload (Loki)", "value": "88fecbd1c4389c213a9a4959e97ef103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850644, "uuid": "6c4ab3c8-032d-4783-8fac-6eef6570d620", "comment": "Malware payload (Loki)", "value": "8097912134d281982a17e6744241589c88bd6483de4c3fee8e7fdea14e9db25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850644, "uuid": "b68f7756-81dd-4b24-815d-4b88c788b1d5", "comment": "Malware payload (Loki)", "value": "ce93f40e82a50b684399d9ff30e588e6260c62d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850644, "uuid": "a82b7521-b732-4d3e-9c5d-e4e36a78359a", "comment": "Malware payload (Loki)", "value": "a3a8366a0e480a3246b39d2a6d493efc96e779417e821df866901c50b030e91bec019a657492423a92e1d1edf99bd97d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850644, "uuid": "e4fa70a4-d71e-423e-bcfb-8042f7bdbb13", "value": "T128548D40BAA0C03DF4B311F47979C3A9B92DBD919B2451CB62D23AEE56356E0ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850644, "uuid": "ceb1f459-0ffd-444e-aaa3-07b51c0b9f36", "value": "e6c3aa777d2861625d0bcdf9e9a3689d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850644, "uuid": "39957596-bc04-42b6-8a38-7f8fa3dd31f2", "value": "6144:9IGCWsAlmc/8YfzZObpNVGSMwgEkm/LSVpF5J+Z:9VfJpzZObpNVGSajmzUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850644, "uuid": "ceddc5e0-e2eb-442e-b4eb-01e54a8e828f", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850644, "uuid": "2a449397-57bc-45e4-b1b6-c61ef0c876f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850644, "uuid": "3053bf97-37c8-4e17-94f4-1236b4a52cf4", "value": "88fecbd1c4389c213a9a4959e97ef103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126f782e-0cfd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658851659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851659, "uuid": "1765bf19-fe2d-48ee-abcd-2f0d602ef06d", "comment": "Malware payload (Formbook)", "value": "34c6b505c0407d11b91b369f9c4020a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851659, "uuid": "7b16e337-ab36-40fc-867f-9ec136ee659e", "comment": "Malware payload (Formbook)", "value": "82c5493e260ceb7ed2ea793862fe1d67f2e7f79b8131928bfba875e8c11a20e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851659, "uuid": "2a18df1c-202e-4e84-844f-8cbcb6b8f73e", "comment": "Malware payload (Formbook)", "value": "edf19c5039be2ce558cac84c44de338f7c1b8af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851659, "uuid": "f4dbbe83-6b06-49bc-bf4a-b55853a65d63", "comment": "Malware payload (Formbook)", "value": "9f3c2e696094d8ecfc9e3d5fd62a2473124332379a1af3d5d02b49e25d2797f615701cff919de1cfe28b183f5004a1f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851659, "uuid": "170ad10b-719a-41d9-885c-bb82754b7230", "value": "T1A86455B47D04ABC4DC54FE701D6693B287702F086C94E9DE73933A0EAA38D50E54AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851659, "uuid": "1f2699d6-12f5-4570-bd69-3d108a5ae925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851659, "uuid": "4b031b5f-0b97-4f60-9a5f-bcc7c13cbf21", "value": "384:GM1caOoPUm/Gouao6JhRt1AYGxTj4HJfwRknjqZHdSgrRsHCUx5GCt8EcNoLKNNo:thGKRg+kCtNcNoLKNVLqKTWB/hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851659, "uuid": "eb1cd2f9-f834-4d13-ba16-5576dd0be8d3", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851659, "uuid": "738921c8-0574-47ac-9cda-142116def416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851659, "uuid": "03106029-690f-4caf-a418-b479d08d7fca", "value": "34c6b505c0407d11b91b369f9c4020a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09cc1d7-0ccf-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1658832167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832167, "uuid": "8d5c8b22-86b9-4cba-bea2-18f90a263687", "comment": "Malware payload (NetWire)", "value": "eb5f04326f4bbb8f69bfb26b0ea3c51b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832167, "uuid": "6d90aebb-8bc8-447d-ba68-5f8727de15a5", "comment": "Malware payload (NetWire)", "value": "8312d7ada28aaab347e6b7677cdcfd9a7bf4a5c47fed9a86cbff29a0d6615686", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832167, "uuid": "e7e6c113-c6cc-4b87-88fc-e2d2fe363ccd", "comment": "Malware payload (NetWire)", "value": "6aeebefa228bd8290b97db9aff296ddce93bbe94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832167, "uuid": "f5c1575b-387d-4969-8a70-11d33bdf0fff", "comment": "Malware payload (NetWire)", "value": "5c0342d3ce8b6f0930b03ac8728b2ea8c9733d7c2df751f22cf76a510d8fece74175a504f5fec6819c2f61f26004340f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832167, "uuid": "79e78769-4502-493d-9cd9-642fba664893", "value": "T1B7945B229B40BB5EE1D8691FE07D0A5E22F34744D4A2B3CD6363B90B66BDD0C6B2D51C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832167, "uuid": "1403d2fc-e506-40e8-88ad-9a0048147edd", "value": "6144:vGjVHooey7BYQGF4EdTWunQDxM6N6WjIy9xv:vsfFGF4cWu9eDXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658832167, "uuid": "35788487-75ff-4dfc-9b41-af1669e512ac", "value": 421177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658832167, "uuid": "b9e237ba-83c5-4b64-a78e-c60aa26454d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832167, "uuid": "8a3a2778-67a6-4023-84d6-70352acc8193", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7c819e-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658828730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828730, "uuid": "4eb07723-7d98-4916-b6d8-a1841f47f05f", "comment": "Malware payload (Formbook)", "value": "3ef8531e16fb08f496c9c1088523890b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828730, "uuid": "589e3212-40c3-45cc-9da6-9ee144cf1cb6", "comment": "Malware payload (Formbook)", "value": "8511a7d115e04255a72a2b87b35f3c4ebc1d53bcd8352734f4bfd833b4e544b9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828730, "uuid": "63ca6d37-adda-4b89-894c-b328589475c3", "comment": "Malware payload (Formbook)", "value": "aa5d6576b7a96bc48ed9aaf4778a61de788f4209", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828730, "uuid": "74583e12-ea4a-4e53-8825-60377786944a", "comment": "Malware payload (Formbook)", "value": "462201d289b1edf6d858312718219ff6e650547a377db80275180f9e3430f22decb476292c2e4431a53329cdde968d09", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828730, "uuid": "025f859b-578b-4c7d-8dfc-95c1b390008b", "value": "T1D9E5C531B13079C3D31B0566565FBD894308BD87B3C66F8C415DFAF92CA29ABA70690B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828730, "uuid": "e8adcfdf-aeee-4c29-bdc3-e39ff1ad7743", "value": "24576:J/E7csBIOCYS8acx9G8TMGW/CL+VthB0u7dxriheywDEPCF13gyu9nvErP9a2Riy:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828730, "uuid": "90bacb2c-5f01-438c-8a7c-7fa5a1497cc7", "value": 3309439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828730, "uuid": "d4a72767-7cb9-4b3f-9121-dc1538a3fd61", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828730, "uuid": "d5625d7b-bcda-4c6b-8527-61292543a643", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.15849.14445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b3cc6f-0cfd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658851631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851631, "uuid": "8cf1887e-f1b6-44d6-b5f5-74a1a3f5b940", "comment": "Malware payload (Formbook)", "value": "05eec6d3375baf68be3431faddfd44c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851631, "uuid": "8370cbfa-0d1d-4fb2-8921-b1ba08847d50", "comment": "Malware payload (Formbook)", "value": "857ba872cec7026dda75065dfbcb2c865fb68138ef1b337db8f464c429adc744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851631, "uuid": "c4560596-d2bc-4144-8acc-fe7fb9552e68", "comment": "Malware payload (Formbook)", "value": "8791ecb4e90238d9a3f4793b9b4c2b423863eaa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851631, "uuid": "dfa37ff3-6625-4b50-8c0c-d319bdbf0aa7", "comment": "Malware payload (Formbook)", "value": "2718c8c513a23c66e1a0da7fa3ce444a11c73e4405004b2cdf3d587d6b473a028376e5dff1a1181a84e9f917676aa394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851631, "uuid": "a206528d-ec6a-47f2-9808-12f8c1627ab7", "value": "T124A4702C3A416672ED0ED4308D438A18BB230F5B6B4BB99657DB67CAE72F06D5D44CC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851631, "uuid": "a1503b27-94ac-4444-a783-ba1c38ec8fb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851631, "uuid": "661e0594-7804-4bf0-a490-b4c1956363b4", "value": "6144:zKPMf1Tfho6NL72TNHE52exVTLhVo/j0aDwbgk0O+6B00hV4W2aqb9HA0PFn0wcf:11TZheTNYbTLLo70+wvT0oV4Naf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851631, "uuid": "58f7296b-aa4f-4490-962a-74b4b3bd724d", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851631, "uuid": "f2bb8cde-41dc-48c9-8a87-8e643f670906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851631, "uuid": "3143edc0-2766-44fe-83ce-6b3efefbde61", "value": "05eec6d3375baf68be3431faddfd44c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bba5a05-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824375, "uuid": "dc964650-46d3-4cf2-ab22-86b2140d313e", "comment": "Malware payload (Formbook)", "value": "17870a0a407e20c0d81164cfc48090c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824375, "uuid": "bf4be260-599c-44d7-b445-db7ff48f29a5", "comment": "Malware payload (Formbook)", "value": "857edc6f03517e0bf132a98b1ed00a3900c30bf677ee60ff6fd7b79ff05515f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824375, "uuid": "5f6b5d60-5008-45fb-a575-d96e7b4d3c8e", "comment": "Malware payload (Formbook)", "value": "351d4a92aef41119396147d8af5633cc7cd68366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824375, "uuid": "feb2cbe0-2dad-415f-9584-299a0036d738", "comment": "Malware payload (Formbook)", "value": "8bca0714c88bae16dbff7bd7da5b22c6525a18795f803c2533b32ad295f4991f9519c299e84faabaec26f2d18d4db242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824375, "uuid": "faa715d1-1e87-4bbd-b8d0-0492d8ecc519", "value": "T19505F180BBF55FB1DE7887F6482010546BFB629B286AD72C9EC024CF5774F844A24E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824375, "uuid": "c9772e60-1c11-4036-abdc-f800b38e33d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824375, "uuid": "f5c778d3-ad4a-4cb7-98aa-49bae7be0049", "value": "12288:QYL+BePSVM+qCKOdsthVAFu/P/rZex193kop40LMCSTQRplg4NHFrzgCDlt:3L+BZZOOitzAQ/P/oPCcMC8QvHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824375, "uuid": "a307a604-7674-49b9-b657-4da71df72500", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824375, "uuid": "40a08659-df31-462c-8aec-7a0891d6bd11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824375, "uuid": "abba0f66-42b9-49e7-81b2-e30893d0e485", "value": "MV SKYSHINE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6972e8d-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658846861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846861, "uuid": "01cef4a1-ecae-4402-b2fb-ed67444bec86", "comment": "Malware payload (Formbook)", "value": "fb5e664dcbf24446947d4ec213658eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846861, "uuid": "176f86d8-7120-472f-a158-4528b907154e", "comment": "Malware payload (Formbook)", "value": "85bb47acf3e9e3bd5d677eda5e9383a80bf7d9e424113f1b4d6f2cef7c7476af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846861, "uuid": "651572ee-cc4b-499d-aaeb-ee3c37f254ed", "comment": "Malware payload (Formbook)", "value": "79f3fd3122c5f5def244512d55e7f08b5edbacea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846861, "uuid": "a24c0147-4168-4bcc-a875-1d336152f38d", "comment": "Malware payload (Formbook)", "value": "a1b243e7feebf226df2d15ee5b196401a59aad314cbfdc8972af358f17ef7710c217ce72811b90fb0f2facea039de633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846861, "uuid": "2954daa3-163c-4eb3-9236-a8ba2d0d6ea8", "value": "T1B283F241F244D896D91729F39C6FC630206B7E9E9179CA1E3287BA1949F3343206BE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846861, "uuid": "60d11416-5bdf-4c17-b901-60b8fc6af18e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846861, "uuid": "fb04a18c-dd58-419d-af1c-d3e8d63ebe0f", "value": "1536:gxDq9x5h3VB7E4sf65NiJtmghrOy7BCRIRPCNfDHO4GACFLhSizXTMQAA+6JH2zt:gxD+3r7E4sf65NiJtmghrOy7BCRIVCNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846861, "uuid": "a6fefcc8-844e-45bf-906c-be15fe413163", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846861, "uuid": "8988a2e7-3857-4bdd-9cc9-e130700f1b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846861, "uuid": "9fbf251e-150a-4f7d-ba7f-62601f4ec9ac", "value": "SecuriteInfo.com.Trojan.Siggen18.27836.32637.14141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6b3888-0ccf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658831922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831922, "uuid": "80dc7346-01e2-4ba9-b799-0c59843f2c5f", "comment": "Malware payload (Mirai)", "value": "c9689231cebbb0b97aa1d40c3fb07c00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831922, "uuid": "6cde1867-8898-4cdc-a5e5-a4af94229600", "comment": "Malware payload (Mirai)", "value": "870dadcc711e33b6031f893637a2a666502a32204acc291c587ff8434caa7edd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831922, "uuid": "1742bcc0-dca2-479e-ac34-4cd99c94f844", "comment": "Malware payload (Mirai)", "value": "d1e65b1cfbf70e99c0a9e3bd93b652c54becd245", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831922, "uuid": "162fccbb-502a-4a02-aedf-2c8ca9fd51f8", "comment": "Malware payload (Mirai)", "value": "cce22e76771c61eba0f1467a8c7f6909f0fa35159ce65aebd41ac804dfedc43c5f0fc8aec5b85ee81ff6d2d06bfd7dcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831922, "uuid": "e1c72913-debb-4b45-b185-d7c46dcd4212", "value": "T1F2830ACAB881B425C7C61737FE6F024E33168364E2DA73068A152FD5BBCA95F0D67609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831922, "uuid": "a4a98944-444f-49f2-84c3-ae5f7a85f2d4", "value": "1536:ZYTaJrtQRmEkpDF40mvDeDSkjE+FkUVD2GyaJdO1ajbwHBRVd3tx2ujCyxJracdC:ZYGJrtwmECB47eHjTdMGyabO1SbwHBRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658831922, "uuid": "3a02fcbe-53bd-4e19-86a9-57e12eb2dc00", "value": 84524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658831922, "uuid": "baa4f9a9-b32c-42c1-add6-eb8506ad0e32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831922, "uuid": "bffdfb97-7377-47c8-af27-bcd22be6022e", "value": "c9689231cebbb0b97aa1d40c3fb07c00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335ca5b8-0cd2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658833246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833246, "uuid": "ed38712a-ba54-4ec0-be20-ff6e05c2883d", "comment": "Malware payload (Loki)", "value": "27affaea80b4179f5dba03e4bd790543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833246, "uuid": "e0d320be-d1e0-435e-bee4-05e3bb5544e8", "comment": "Malware payload (Loki)", "value": "8790b4c48e605a5940bd15aa1278f7c155e967830711f391968671382549d1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833246, "uuid": "6b7de23c-0bb6-4af7-980b-91ec6f17c5fd", "comment": "Malware payload (Loki)", "value": "3ac53171f75c29cc89571faeb019e23b58a9bf87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833246, "uuid": "df0e76f4-3dc4-48dc-a045-0bb92eddca1c", "comment": "Malware payload (Loki)", "value": "3c63d0cf812f32399d422b469e38d3ebbdfbe8d989b088cc7d62dc4b6ceee8670c5fdaa8cf3fc5d52554045fe0688b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833246, "uuid": "0795bb4e-51b3-43c5-ab6f-e39e03d8c56a", "value": "T1A4D3D471769A8711C09B0D70C0DE351C13A19F867A73E749FD8D33B94AF33DA894AA89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833246, "uuid": "e3a14673-d414-4da4-a344-50555ae58070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833246, "uuid": "3367ceaf-9295-4fe3-81da-e98d83a4070e", "value": "1536:wqWrYA4MQDTqXmyZ/s1MmsAga87IomyHUXLzZaQ:vWrgd4s1MxaToJHUXLta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658833246, "uuid": "78ff3eaf-4af5-46dd-af18-4b46c8350546", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658833246, "uuid": "adba7353-d02a-4dd8-883f-e5f7d63d0b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833246, "uuid": "e592ccb9-e2e2-4820-bf53-619ec7a28c4a", "value": "Narudz\u030cbenica_(P.O_60463402)_ATINEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b1de5c-0cc4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658827346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827346, "uuid": "3f6cbe8c-9cb0-419f-9bd9-82cae1df2777", "comment": "Malware payload (RedLineStealer)", "value": "25bcd499dc8a68643afc1021ba908c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827346, "uuid": "d3d122fa-b790-4d45-8c53-57516f2daaf4", "comment": "Malware payload (RedLineStealer)", "value": "8845ccdb61f4b2e69a672c904bf0a4269d16864c4b6fa7d8d3c481a32f1b632c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827346, "uuid": "2b7c73ac-8f1a-49ae-99be-5954e33acbd7", "comment": "Malware payload (RedLineStealer)", "value": "4bd1e17670dfff0a2a1b14fc48488de2fdd3f5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827346, "uuid": "c1544528-890b-4c0d-b502-c69298494f74", "comment": "Malware payload (RedLineStealer)", "value": "820d47bd4c98a229ce3aa41f681c290d9b109b71c815397c77a542502c50463a844223565d85db10525286f5d31e726c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827346, "uuid": "b19aebcd-abd1-4f5a-a2b8-9bd2445a157e", "value": "T10994BE00B7A0D03DF5B721F47D75C2A8792ABDA0AB2051C722D67AEE56342E1DCB8707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827346, "uuid": "ef3655fb-9988-4d9c-b9c4-be363fadb44b", "value": "504d97a665c5990d2e90f1479886157c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827346, "uuid": "3004b0da-acd4-4057-a021-f74ec8ac8496", "value": "6144:XDoHDsyMq/zWv5x1jtU/2YRZXoKAWbNWHM77MBSwyOVFDoF:X2Mq/yx1jtUVRpoKD6S18Fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827346, "uuid": "32309b3a-8d26-4fc6-8909-5cb1fee1c795", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827346, "uuid": "97177d06-d96c-4ed7-9488-8eb8366cbdb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827346, "uuid": "eb3e6d98-c16f-4e9d-998b-be377c437377", "value": "25bcd499dc8a68643afc1021ba908c4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95811c7-0cb2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658819834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819834, "uuid": "70af1f5a-df2f-417e-b220-51f69b72f159", "comment": "Malware payload (RedLineStealer)", "value": "b73b53e10d9b6b68c808b25a38b8465f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819834, "uuid": "70d613b6-f5ea-4fbd-b9dc-ad718bd74fd9", "comment": "Malware payload (RedLineStealer)", "value": "8ac201a33dd63f08721cbb3f23820e13c9e1b28cfc9f32fa6e4452ebfa00ab3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819834, "uuid": "a164f83f-49c8-430d-973e-e80515de98bd", "comment": "Malware payload (RedLineStealer)", "value": "5255d194a17c70d758050b820d824a6d5fb2da31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819834, "uuid": "2d789ac9-9700-4dda-9c67-90e7e96e1cb4", "comment": "Malware payload (RedLineStealer)", "value": "dac366b90973109ad9888fa2f4151c5e494f49f4597cfacaceaf637fd0d9805de7e564533c771bc918b61cca3734f258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819834, "uuid": "60ff5a80-b507-445e-8c16-9e4b445f2c01", "value": "T15654E110F3F1D432E4EB5A3008B4D6265F3A7C422674648F7BAC372E5F256C12AB536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819834, "uuid": "ce8cd8a4-323f-429b-98cb-ae129b4038fc", "value": "5b1496fe4917fe7c0dee09867ced7d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819834, "uuid": "6e4be9a6-94ef-4958-89b4-ef69d3e46522", "value": "6144:osMob4LeOJVpXdNWPtOWJ5f31ALBJAggYhEx43FdvR/:osMobvOJurJ5fWrAggYhEx43FdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658819834, "uuid": "2635726e-2aea-429d-a1f9-26251f47a370", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658819834, "uuid": "cb563774-bfe5-44e2-b95c-a4365ad97eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819834, "uuid": "38a54efc-2f51-4ea3-8725-8a18287e7b62", "value": "b73b53e10d9b6b68c808b25a38b8465f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e855915d-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658846864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846864, "uuid": "7c38e6aa-0d6d-48c1-9d75-d943e63695fe", "comment": "Malware payload", "value": "2077961f16cdaa5110232f4b3082e32d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846864, "uuid": "a1e9b5d2-052f-4017-a498-0ba6d0dedd29", "comment": "Malware payload", "value": "8ade8f5e99a0d7d216427bb2e7af273dca7a86fdfee7814b01382f8794493bd5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846864, "uuid": "a830644d-c468-4645-94b8-b110bbf3e08a", "comment": "Malware payload", "value": "7c34fd9bca7f9ec33aa9e996b0f32c007a71257c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846864, "uuid": "d6b9c653-0741-4a63-988b-72608d99d57b", "comment": "Malware payload", "value": "d25904d595d12a0acd241e026c44e8f524c6e8301c164e5b7e74295830da3ed7e9483075d642e0e2bad8fef010ada694", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846864, "uuid": "d5533a62-bc76-441a-a7af-1e161ff49172", "value": "T1F0160405D17DE6D9C33BA7302C6D5FFB9E789804472603BB6185A124FEA6A108E71DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846864, "uuid": "c42535f0-4e05-4b3d-adac-386958e06ede", "value": "24576:ky1NuPMRNKLVY4m5jFkmyfYS3WS0aTXaln4fa0PGTBjd3Y+w658BV:ktomhmMs4rPKjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846864, "uuid": "9322a474-8005-4465-a37e-ec4f23b9b70f", "value": 4020224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846864, "uuid": "2048c4e9-b4e8-46d8-a58c-ba9df40b6346", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846864, "uuid": "693b9b63-64b4-4bdb-b2fc-419964a5490d", "value": "SecuriteInfo.com.W97M.DownLoader.2730.26376.3103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05872c93-0ca0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658811694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658811694, "uuid": "6f0b1227-ae8a-48a4-bb99-246accf65250", "comment": "Malware payload", "value": "f178fb38ada4a53d45618d7c79b0d449", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658811694, "uuid": "6c3bb9a4-8ea9-44d1-82dd-c5eb8aebb013", "comment": "Malware payload", "value": "8afaa0c565368bcb0873dc9e037ffaa7e50514b9d4c646f27daac25332e75182", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658811694, "uuid": "c716a58a-3809-4100-8cb4-a0afb51b2f9b", "comment": "Malware payload", "value": "4bb42a180a49f7887b71f7f51f432e565d41424a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658811694, "uuid": "3e2fe6de-d03a-45f9-b05e-408bb8588b9e", "comment": "Malware payload", "value": "1b68e3cf5cca8beeb76acd43e237176732cf304bd1df3a2f3bba319e8014dd19b6a387bb187d1438710813557d6e3c14", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658811694, "uuid": "f8363a15-b43f-4bf1-9179-afdc8d298421", "value": "T1A675331B88295BD8B34312E396FDD0465921FB206C4909113AB7F9958EBFCCF534AAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658811694, "uuid": "a708e047-b13e-4e0b-b460-070a8eddf2d7", "value": "24576:tr60/03nIRZQx0R8ZSmWBnpBvykPaNdlP9o++WntZhzVV/DiBjmcGAg9F3k7jG8j:UPnIRn8Z/W7BvjaNn9o8zIgMB5tPZF3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658811694, "uuid": "cf94ff8f-267b-4afe-a336-1e599b5c5d25", "value": 1693453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658811694, "uuid": "b732def3-a6d6-4eb4-baa5-13f204e0167c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658811694, "uuid": "08c480dd-5eec-4ed6-8ecd-7253e5b8108a", "value": "SKM Ref 26072022 .ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417d512f-0ce2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658840141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840141, "uuid": "1ab4f598-d419-4f77-94f3-fc340b45f855", "comment": "Malware payload (RedLineStealer)", "value": "2e6def36eccb87621f10be5feb8ad484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840141, "uuid": "79140400-dd8f-4080-a720-491a82818333", "comment": "Malware payload (RedLineStealer)", "value": "8cba07c497e4ac561ba88716fd8a5ac02d847f4086b5b5f52581dab17c0ea0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840141, "uuid": "ef219d38-3804-49be-9f87-f32af138bb50", "comment": "Malware payload (RedLineStealer)", "value": "b1694e344fc9afd38bd467a78f4de4a29f2fa459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840141, "uuid": "045d1299-2073-413c-8787-42373f900255", "comment": "Malware payload (RedLineStealer)", "value": "be4d8cb1c3653089fa97b80111bb5db4dae6b17926264283951635b7c6f486fd2ce742b06f5900d37926e634fb830f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658840141, "uuid": "dc69b685-be9b-46e4-b9d3-c8192baba30c", "value": "T15A94C040B6A0C03DE0B716F47975C359B539BDE0AB2444CB22D67AEE56386E1ECB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658840141, "uuid": "8a8da00a-8836-4cb8-9711-1cac3570e7e4", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658840141, "uuid": "1bd67f3d-2b5f-4480-9983-b548c534e8ce", "value": "6144:boYKmxzes2JObUB66JFa7zvCkIGi1mJSIUmt+Wd+LQpqxXEnLmQo:boPgQB66JczvfxiMJfUiTEQ4xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658840141, "uuid": "72aefce8-16c2-4f9e-b95f-e3d549a71d09", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658840141, "uuid": "89b4ab69-71d5-4e6f-b6e5-856fd4df3d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658840141, "uuid": "d0356e41-3067-4a7d-86de-1946a9437853", "value": "2e6def36eccb87621f10be5feb8ad484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b408921e-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848924, "uuid": "9d6d6d21-2175-47b9-8f19-036f7c6fcaea", "comment": "Malware payload (Mirai)", "value": "9551f4779a01b82ca3cff898f2e725c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848924, "uuid": "35460780-450b-4c09-9b64-b9c808fc16ea", "comment": "Malware payload (Mirai)", "value": "8cfb07a892c717dfd49fcc4c3ad74b5a2178a3204091ae8c019dfeb83afe3490", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848924, "uuid": "212ded41-67af-47bd-9773-b637618760f7", "comment": "Malware payload (Mirai)", "value": "8b555bfe464c15acb95f8d0194653be9d89c85cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848924, "uuid": "bd4b0733-1cde-4c97-ad4b-0d97fdb8f0d0", "comment": "Malware payload (Mirai)", "value": "7c5887eb51f7877a2c647562b7e511ffc54b5d459002cd76bf104684729cb1c7fc52d244d204f9b469fb81d0ba0a34c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848924, "uuid": "c8e98228-0b35-4942-893b-1ea8dd495fbe", "value": "T104230271880E9EF124703C76EBC5E39375E02AB1C6672023D6280B386E75A131D5BE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848924, "uuid": "3419af4d-0269-4e43-b754-9811ff82eab7", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3tLa9q3UELbUXfi6nVMQHI4vcGpvb:gECFd+A6YHAxtTLRQZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848924, "uuid": "8ec77c0e-c7f3-42ad-9b37-ad343986781b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848924, "uuid": "8d4ccdfe-8603-458f-8942-47655c833e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848924, "uuid": "6ffab8ad-99e6-49f4-a3ec-3fa3b00b0dc0", "value": "9551f4779a01b82ca3cff898f2e725c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3c6a41-0c8a-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658802657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658802657, "uuid": "ea0587d1-4287-49a3-95f1-36812700b157", "comment": "Malware payload (GuLoader)", "value": "665b5d584301a9445f7762b609fa62d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658802657, "uuid": "00bcb675-99f7-45ae-82c2-31582db30253", "comment": "Malware payload (GuLoader)", "value": "8e0dc7ce70035294d8833ce0c254d006c00df8fe5925f4002d5cac74b4d97784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658802657, "uuid": "10fc6e24-c565-45b6-aae4-e9f771af2705", "comment": "Malware payload (GuLoader)", "value": "4a862e8a1e3ab1d62a477377c302d27e6099518d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658802657, "uuid": "631cb90e-ed9f-4b72-9783-bbb8bcb1d8a7", "comment": "Malware payload (GuLoader)", "value": "ae0c71a6c9840f6a66acc6a1f94a54fe69e4df1976ce2ecb2129c192ae0864bb6677bb71f0ba5936d54c6c6aa8d1cc6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658802657, "uuid": "378c2f3a-d7d7-4c17-8775-e0d979d2d9e7", "value": "T11854E12DABE5C817C8C11CB49EB1E98E58F0AD015558DA97B6103F3EE67D281DE1E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658802657, "uuid": "5d17d4a4-3ed8-41c0-a19f-124574b42080", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658802657, "uuid": "06ba4fd6-ebd6-447a-8794-cb23eb71e44f", "value": "6144:qDYa6lZYbjBwAbZODk+0g3HKPrwq3mwE2Ux8mauGr+:SYzZYbjaA9OZ3KP8WvE1xBa9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658802657, "uuid": "d6b69d43-5c1a-43ae-9a5a-94104739ca49", "value": 297456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658802657, "uuid": "6cb91a15-37f0-4878-95e2-e1b934286568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658802657, "uuid": "b61330dc-d3df-49d4-8e64-debac9c00762", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9343.13903.25062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bc3c8d-0caf-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658818268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818268, "uuid": "0acc64eb-0907-44d4-9b50-0d3323ffad13", "comment": "Malware payload (NanoCore)", "value": "c02f8b6dca006868bb1586ae16677695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818268, "uuid": "04db8965-9fef-4c6f-bf1e-a01c312beb2f", "comment": "Malware payload (NanoCore)", "value": "8e4b447ce039f31de8964545b7ccfb839622a7ab6822268ddd8d7646c5166a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818268, "uuid": "b2061fbb-cbdc-4408-ab67-d772b53e2f89", "comment": "Malware payload (NanoCore)", "value": "7af3266b07123e13ff02d937508d99b6bf36f9f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818268, "uuid": "9298d27b-8d1c-4873-bc82-f342bfac7f5b", "comment": "Malware payload (NanoCore)", "value": "931b0e3aab446a4802d190c9dcbb6bd9c5d6b93e2d82675c185e135ff5058972bd5071b20ab08d3155f8d828ba2d2bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818268, "uuid": "f98ca05a-1507-4ae5-966f-319fd6e69f60", "value": "T1122512292BB58F07DDBC43F94414051497F269263552FB6C4EC2F0DE3B63BA16A4BA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818268, "uuid": "01055efc-fd80-41ad-a24a-5b5702d878e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818268, "uuid": "7a554690-836e-4927-8e3d-6e8d07c11e8d", "value": "24576:7/kcDw4UZvybcv8vOqWUWJzBki7gg4RHar4BPstTxDP:YcD6d82/UWJz37Chy4atB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818268, "uuid": "99a87a2f-2993-4ba3-a72a-fac2db001d91", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818268, "uuid": "1fa61af7-a0be-4408-9934-03f75900baa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818268, "uuid": "98f21e79-8079-4ec4-8bb8-bfe0fc8f1602", "value": "817260722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066c1d94-0cf8-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658849491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849491, "uuid": "69307524-4f77-404e-908e-5b282b42a32f", "comment": "Malware payload (GuLoader)", "value": "8b0836dd0838e4ca4eec1c6292ef8e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849491, "uuid": "578142e9-1d1a-4405-9e9b-83ee0bb41a90", "comment": "Malware payload (GuLoader)", "value": "90c79fdb16c23aefe4feb68a25266f60775f4e9c5ea0d583c9d21d027e058ead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849491, "uuid": "d8d6fa9e-6815-4a3e-9642-e87d5256b327", "comment": "Malware payload (GuLoader)", "value": "2d9d6f1bef12b99d86dd133956f9e78616f07616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849491, "uuid": "babccbba-1aad-4184-9390-895f2bce8c47", "comment": "Malware payload (GuLoader)", "value": "e2b05aaf406dcc7d0e360d9b7cd360aa1a6c77aadf202a01e0e8ab89a3e0a5fe4871f6b4610e80cdd7b065c33e535bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849491, "uuid": "af925824-05f0-4d64-92f1-55b7d68ac32c", "value": "T18A94E152D241C497ECA65F729C3BC93169B77E1E6874A90E365A76252BB3383002FD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849491, "uuid": "3bd7c54f-1e94-44ec-a94f-ae433c41ef62", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849491, "uuid": "1067e43f-82c3-4b88-85a2-60a485c049e1", "value": "6144:F3yztrnO7hdQ5eGs93aCP3Rhoo+f1QRxeU4etcnVeY0ZUSeGl4ZLCfqmGNtq:F3FP3Rmd1Q2UjeMVUgyZLCCmGDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849491, "uuid": "a1155ed3-c8ea-4448-8009-6185171f1550", "value": 434128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849491, "uuid": "18aa29a1-bf76-483e-8c31-0305ba2a62c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849491, "uuid": "220235e8-8423-4577-b61a-4aeaa27fcb79", "value": "TNT_AWB_AND_INVOICE_098768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649f2b0c-0d0b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658857810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857810, "uuid": "ba3f0009-fe3b-461e-820b-4c6ed1d150b1", "comment": "Malware payload", "value": "8359c8810d225dda7f6de36f2a7bed5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857810, "uuid": "91acf2b4-f3b8-44fa-9a87-77a58301469f", "comment": "Malware payload", "value": "9115b821f251889ec675158dc52d6b8c17278107b1ed4c2c1b1adbbe9809cb60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857810, "uuid": "ebce6015-eec7-485e-bbf9-4d123bddd040", "comment": "Malware payload", "value": "ea5c0b5d5aa0df473348559b309b5d936c9f5ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857810, "uuid": "7a2bd586-8ac0-4067-ba86-500c768263e9", "comment": "Malware payload", "value": "3273d7f5711ab112904ba71a0dd84019c6224f9a4bb7aa7c7bde731863a02db2b03d5d49f477d8cbe743f75451a675df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857810, "uuid": "0d454acd-4561-4b10-ae4a-5ac0c2e5d175", "value": "T1A1D22D2712DEBEE6C8B81670377343D1D76DDE049403CA2E59D4B52A8A7E2437A923C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857810, "uuid": "6e28373e-2bc9-40c8-9b40-6ec1c7ab0b6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857810, "uuid": "eb6e4945-1435-4534-b3f3-3c7810901fd9", "value": "384:5f3Cz1fCTlNqwZeY7AT4aFckxrLRwc7YHIqiY3w3O:Ez1+qGxApckpIPiY3w+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658857810, "uuid": "a5b035e3-1a44-420e-acb9-022884916094", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658857810, "uuid": "db7f24b1-9cc9-4445-bb08-768f73b2a994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857810, "uuid": "f011e2a8-4250-464e-a8d4-551f99e942d4", "value": "SecuriteInfo.com.BackDoor.Bladabindi.13678.4541.22457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dba5348-0d38-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658877233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877233, "uuid": "b2c05017-a03b-43d3-b7a0-d4243312766a", "comment": "Malware payload", "value": "390ad3ab3aee3bb83ee7734353a6c116", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877233, "uuid": "6d44b8f0-5240-4ff3-b843-4ecb30634d11", "comment": "Malware payload", "value": "91225c065320256ef7ccf54bcd7f3222ffcda008728dccf46d3ff6926ceb3b86", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877233, "uuid": "8a0c07a2-fc2a-4ed1-917d-d1331c3e3592", "comment": "Malware payload", "value": "130667e84696e6724cf5fd5f666579e6a4ce308f", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877233, "uuid": "d225e420-6eb2-471b-b32a-3a20a0deb82b", "comment": "Malware payload", "value": "a69832c12c135c73633cbf9239cf6b3f96708d98d6a99fdb3d3d10e209630e84400c1073a88c7356c4a18e69a3770381", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877233, "uuid": "740486f7-3606-4f54-bae7-a2edaf97f10e", "value": "T140421B03FA404DA3CB6406B42537D969C27FFA710E90E393BBDDA9180FB5185F82A40E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877233, "uuid": "bf22e2ca-a4a3-4258-9eb5-4b06d4e10e90", "value": "ac1fcc9be05f7f2365b67808e65d7a82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877233, "uuid": "17d5c7bf-52f2-4b1e-bd96-a8119f90c9f7", "value": "192:TPVAFupIoCXDjDJ6RA0ofXVSjO38WwMir6Ci0J7E5hzH/66HdNu7K:TPKFuOjDYRA0EXVSjcwN70HdNu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877233, "uuid": "3f814955-51a5-4e4d-9d7e-2fb46928355d", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877233, "uuid": "b1e3e984-6d0b-49e9-b6d2-bc013d81499e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877233, "uuid": "7511e731-9cee-4bc3-aaab-d8f83393d987", "value": "Overwrite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3c1862-0cf9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658849988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849988, "uuid": "de573832-90d4-4162-bac1-9110824ff727", "comment": "Malware payload (Mirai)", "value": "7609076ac9d3187f42e89e4114999dad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849988, "uuid": "b0eef58e-cbee-48ad-be1d-5aa96d979b79", "comment": "Malware payload (Mirai)", "value": "92a7701f2286c3cdb9429117a14c32c49a9a3c6047aa24f90b772ed6b8585525", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849988, "uuid": "6782bdae-dc07-4fa3-9e38-79cdadc6f68c", "comment": "Malware payload (Mirai)", "value": "e64efabc2e4d10cbdca86c41a9c0fcc587e58807", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849988, "uuid": "388d8c1a-4fda-4438-8cfb-8d1b990640da", "comment": "Malware payload (Mirai)", "value": "4da5941ad7b8d28d187bd3642fc7eb41ef83992272b6607a2a3bb3b94da03e24d2676407fb0292a4421aa353548a3a6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849988, "uuid": "e0a60f90-ac51-4fff-8099-c4ada9671c59", "value": "T15EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849988, "uuid": "9d33f271-5985-40b5-a4db-5341d6e15a23", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1G/LWy:c9sSyzz36YaWWgg1Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849988, "uuid": "a4e63b48-1a7f-4e47-a777-1415a58bb6b4", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849988, "uuid": "0e53350a-570f-436d-863c-a9a84d187c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849988, "uuid": "7ad20528-c336-45ef-8fea-ac078d893241", "value": "7609076ac9d3187f42e89e4114999dad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ce3f07-0d11-11ed-93bb-42010a9c0043", "comment": "Malware payload (OskiStealer)", "timestamp": 1658860545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658860545, "uuid": "5201ebda-4fee-4a8d-8950-61428ccc8c41", "comment": "Malware payload (OskiStealer)", "value": "b0d0a4af8f13d80eafe1238bd3f684c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658860545, "uuid": "09c609ae-d989-400f-b0dd-89038da62e4a", "comment": "Malware payload (OskiStealer)", "value": "938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5af557b4f09d698b8145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658860545, "uuid": "28b51e17-a91d-40cd-a7a1-9bdee5613c5e", "comment": "Malware payload (OskiStealer)", "value": "23f10ff96e9933590fb9c384c543d20ab695733f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658860545, "uuid": "6049dd51-344c-4de5-ba7a-fb6f9fa37869", "comment": "Malware payload (OskiStealer)", "value": "e41734021be397f9ef8b30e53a9e519a58436a0249328e0fb61bea2279ef7977d475744cf7ae9052c00c5738897a55ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658860545, "uuid": "c89cd3c3-fd02-4d84-861b-ed092468264a", "value": "T1B2A4129755899841DD18F6BA508B69BF0220EFCF981812444BDCFC7AE4797E02A5FC2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658860545, "uuid": "19242d30-927f-450d-987b-71e23da79723", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658860545, "uuid": "632ef453-a0c8-4394-bb8e-138df31ce602", "value": "12288:SWY1lFk9iO0cvksx2+WNFZ5SG+MjZ4tdh5EoN:KfCH0b+TQvS5KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658860545, "uuid": "80575b61-7f09-42b6-a5fa-ebc5220bb881", "value": 481344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658860545, "uuid": "f6a0fb07-fbaa-4e8a-ac9e-91e4fdc95460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658860545, "uuid": "9b04eb01-dbd8-475e-8650-20edf69b3bad", "value": "938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc975e23-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658849394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849394, "uuid": "dfb7fdc8-6d7d-4c13-a462-12e2686e74cf", "comment": "Malware payload (GuLoader)", "value": "a5f0f49d8da2b36e6e0b03a20c0f89a0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849394, "uuid": "b15e17fa-a84a-465c-9717-d750697c7743", "comment": "Malware payload (GuLoader)", "value": "9422e9da5897f4c62da5816157c934000341082d0c7bd94a9abc8263ca0e1cf7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849394, "uuid": "92321f44-9ff5-4f5c-ba47-4acece657928", "comment": "Malware payload (GuLoader)", "value": "57e2d7eda3899c8fce2fc2dbd9659c82f5838607", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849394, "uuid": "e59cb59a-6860-433c-aec3-c55a75d071a1", "comment": "Malware payload (GuLoader)", "value": "601a2fa679dcc21192240201d7e0ee7d2ff750afef738aeab4f2c93d27d33c317e2b78756e79e66539d1e2dbc047cca7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849394, "uuid": "80670475-0c45-40fb-b8e0-42c77fa0e061", "value": "T128441FA0A73E31F6F78D5983AC8CF87505B1F1331FCE03A16F962985D7B1A464226DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849394, "uuid": "710e0401-3025-4b9c-a2a4-6dcf5564acd3", "value": "3072:O8LlZOKBz4R1WxqOwKwZ6h8C5amwhX8Vbk6uo06hh4K3NSk52PoevIOqXwUo8:OeZOk+1GQFBhAvXhh4K3XARI5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849394, "uuid": "e3b4670b-7aa8-47af-93bf-3b07a14cccec", "value": 255537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849394, "uuid": "1a371320-520b-43d1-a57b-290ac00cd456", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849394, "uuid": "3c51bdba-12b2-42ce-b017-3a33f66ae46a", "value": "AWB 5331810761.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab0f03d-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848237, "uuid": "a4d27e08-9021-415f-8b32-6af33c8f7ad7", "comment": "Malware payload (SnakeKeylogger)", "value": "aa64488d257350084fae9884d6cad246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848237, "uuid": "023d3dff-b0a8-4777-a0b8-ed6edaa20d2a", "comment": "Malware payload (SnakeKeylogger)", "value": "94a55a43adc9379109a6abb91d4cab99939a0b66253a37facaefd5f9835dfe6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848237, "uuid": "d17b2700-2bba-47d5-a582-870a6ec533aa", "comment": "Malware payload (SnakeKeylogger)", "value": "9e689a5bad45741955ec605c8aa1b3e31bb6c852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848237, "uuid": "7be3e808-8cff-4dbd-874f-f21d7fab14e4", "comment": "Malware payload (SnakeKeylogger)", "value": "fd3c0a7c08b5b2bd60d5c8f21b073e5464e04d47e7994d80383cf8ff6250340473bc3a87a3f78aaff3080b720b68fb0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848237, "uuid": "b20db579-fa7c-4c4e-9e89-0a889b2fd814", "value": "T1521502292BA05F47DDBC83F98520420857B53A163582E76C8EC1A0DE6F67F909A47F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848237, "uuid": "8727bfe6-ef00-4e83-ac70-cdfa91d778cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848237, "uuid": "442a2465-0d95-4e36-85b6-6f031d43400b", "value": "24576:fclw4UZvybcv8vRrpedyCE992YbTRyn+Fm8XWqo6W7Yk1xwP:fcl6d83eZWHTAn+zXHoJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848237, "uuid": "712ee9f8-789e-4540-8532-df55d4d9cd8a", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848237, "uuid": "f9053ddb-4474-4da7-aa40-f68c7706a753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848237, "uuid": "1e20c696-199d-4111-94ac-0da41ab48cb2", "value": "aa64488d257350084fae9884d6cad246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6350e19-0cbc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824124, "uuid": "759867e1-254a-4d8d-aa44-10f29064a21b", "comment": "Malware payload (Formbook)", "value": "8e5cf08364e21d52829ae7570f9753f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824124, "uuid": "bed9602d-26f9-4613-91d8-0005f6421ece", "comment": "Malware payload (Formbook)", "value": "94fe214d7ddeed7f772ffe2d583db58c420033abcb3199b4aa93c1d9eaa8eee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824124, "uuid": "569ed677-ab51-4de8-9965-7e830dbf820e", "comment": "Malware payload (Formbook)", "value": "b1f433e38e2f43f5e45ec91a328bff273b18eb23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824124, "uuid": "d5999ab5-60b7-4757-8094-a2985eb10ad5", "comment": "Malware payload (Formbook)", "value": "c13c272ffc7c21012db72be3e992473c0cf62fdd95206f0360aad4ad89960a0c33cf3b5ccbe93fd1f452b2b60a83b2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824124, "uuid": "4dd0bd34-2897-4525-8daa-2b1a5266f872", "value": "T1FDE41218FFD4E829D59AAB713872C05821B23E1A3E1DEB096DF7716E49307112C6678F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824124, "uuid": "cf3024d9-b6e4-4c5b-9e69-f7a142990407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824124, "uuid": "3a78403d-e109-4ee6-91a2-fe9489fab25d", "value": "12288:7iPrY4shcR0ww8nhlWQl5AKemU/kVyAYVGTTNowGsAyZcBWNo9jsC5NDlt:7iPk4s2DmKemU/kg3ST3AyOW2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824124, "uuid": "c797fe4a-ed9c-47bf-987b-9c53f0a66747", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824124, "uuid": "eabd5cc8-fa65-4656-aca2-d7fdaf2aa47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824124, "uuid": "0973738b-79a5-4896-a47e-bd6f60113ed2", "value": "MV HARMONY STAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e05ae8b-0c9a-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658809212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809212, "uuid": "7e0a8b89-9d14-45bc-9aff-337e464bc738", "comment": "Malware payload (SnakeKeylogger)", "value": "9969d8b33872c8232e773367517f3b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809212, "uuid": "50c6a1c1-a1e2-4dc5-9759-505f33649e7b", "comment": "Malware payload (SnakeKeylogger)", "value": "956a85babb7e1732de50085202a99cec3c7a8f267bd290f325066dc207b30665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809212, "uuid": "ea55f9ad-0452-4be2-942b-dee5bd4a8fea", "comment": "Malware payload (SnakeKeylogger)", "value": "6bbfa3bf9d30cde89820b559cee119551a2e903d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809212, "uuid": "77efa7d8-195d-43a2-bc62-2c701e300943", "comment": "Malware payload (SnakeKeylogger)", "value": "4846b062baeec4c8b5f3005e10999002ed85be5fcddc428cdf58feb208eabc6eab923e6b1d41770fa255f51a6122a840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809212, "uuid": "54da4979-c9ed-4251-b1a4-a76d6bcb3530", "value": "T139D46B9C359272DED917C4718EE89C64EA60B877970F9213902323ADDB2DDA7CF150B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809212, "uuid": "77cf6d5f-ffb8-494d-858a-e338714b1c1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809212, "uuid": "6081871d-6daa-4b35-96ba-7eb859615c3f", "value": "12288:hWUsZ2iNDXR0ja9PWK8aW6cRorCeBXqpHmNKo2+/JRB1gWMcU2QB1oxgJVu:MVZ1rtpW6cRQTBwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658809212, "uuid": "94e902cc-a889-4057-9645-ccf722847d89", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658809212, "uuid": "329e54a6-f0c8-4e2c-9e68-333dbc8ec4ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809212, "uuid": "a2d5acc8-c0b3-403b-b8d8-6dd1e3d93b44", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ef050f-0cfd-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658852017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852017, "uuid": "342ec565-ee62-4aae-86cb-d9fe44c19ef2", "comment": "Malware payload", "value": "f880c540e727cc53310961cd23aca196", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852017, "uuid": "9c52d2da-8951-44ee-a5f1-0fd41336397c", "comment": "Malware payload", "value": "95a0398e01cb92e17f1621dbcd9cbfbd280f7ff8f2004d15917ff80ef33338dc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852017, "uuid": "90eb8be4-19db-4b64-98b5-4542445fcfa2", "comment": "Malware payload", "value": "5bce96ce82e8a30f99e90e456fd3d73c3e41596b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658852017, "uuid": "48e162dd-8528-439d-94f3-81e297980a35", "comment": "Malware payload", "value": "560103d5345085faabd3be6ecf0663cdac87cba2e5949655ee96f4c1c51f3c31b660970a4adf43683da539794f168372", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852017, "uuid": "32df2c60-5b8b-4fa9-af14-66a29bc573f5", "value": "T1020423D3D7EF2D3572ED9925D80C874A2AA3681C52C843BF4EE61F46D54E70BE1A2704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852017, "uuid": "fd4a54d2-110b-4904-819e-d1001efed5ec", "value": "3072:yuzjJnOXTfp6aaCMQxixFEdeU6E+y6SUh1xK548HDndv/rKcPlrLUa24kE+F4JCL:BPNITElNAeHy6SUhsPDPlrLUmkEweCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658852017, "uuid": "c9fef6fa-1c4f-4bf0-a0ac-0d0fd8096085", "value": 184986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658852017, "uuid": "93cacabe-6290-45e5-ab6a-f43f41623bec", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658852017, "uuid": "2ea86686-7491-4a0d-81ab-a29480b07c0b", "value": "825B7A64DB82A61656C8004BEF49823D5B9FE4F52FAE744F5DC927B3E75A994B.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0aa220-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1658851484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851484, "uuid": "17c8e23f-4820-4e95-8d3d-385b637e3fc8", "comment": "Malware payload (Stop)", "value": "86750df57a60e25425562fbfca99bca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851484, "uuid": "6351aa6d-018f-4dac-b946-b8705e11ca5a", "comment": "Malware payload (Stop)", "value": "95f3f8ab05168a6e07bb75ca9320e85f4159419c418aa7b375640a1e13f00fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851484, "uuid": "969204f3-ab19-4f02-bb83-a607c1c47cc4", "comment": "Malware payload (Stop)", "value": "b006fb8c8dbcdaea9c5d8c728f30465c1f105ca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851484, "uuid": "2fab31a3-aebe-40ba-94b1-f434b29f961b", "comment": "Malware payload (Stop)", "value": "93c226e6aa0517f3bc48f1816dfc21ca37bd0501c58375f97e3d5429222b7f7202bea49812e56ded0d3a11bfe9d64246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851484, "uuid": "71000424-d6cf-4cb5-b91a-41bcf9c3239d", "value": "T130050240B660C03DF57701F87D76C268A52E7DA09B6451CB62C57BEE26386E4ECB834B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851484, "uuid": "d00681fd-2743-4955-b97a-150de2385452", "value": "341ace376080222d26a7767debb6055b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851484, "uuid": "bdfaffc7-a708-4339-8521-de5e0bf7478f", "value": "12288:YQgHHwTYHSs3maBVHXu+0Tcf0vsM4CBYMSsxS770xfNJP+z6pVc4ET87xGT/Y8X5:IBL3nBV3u+LGsYdS77AfNJ9BOU8X/L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851484, "uuid": "d90183e4-d782-4e49-822f-c0b26691b11b", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851484, "uuid": "9215e55b-9832-407f-a0aa-8fe36386866f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851484, "uuid": "704d1f25-0969-4fb0-b535-783a6e8aa682", "value": "SecuriteInfo.com.W32.AIDetect.malware1.25364.10316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ef768d-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848252, "uuid": "33dc7354-b297-4161-8a5e-55b4b156370b", "comment": "Malware payload (SnakeKeylogger)", "value": "08aa7baa7d1db282c290d7dd439b7d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848252, "uuid": "97e2b527-b6cb-49c6-b8b2-850b3c54fd60", "comment": "Malware payload (SnakeKeylogger)", "value": "9602b8784645ffa8a297a6505dc981ca7a7aa81b9bf07c7dc8dfc4adf7c23b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848252, "uuid": "5eee2fd0-8ce5-4d50-8146-b451dd816959", "comment": "Malware payload (SnakeKeylogger)", "value": "f312122aadeeba13eeb71423269197f99c74aae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848252, "uuid": "24de2625-910c-48bb-93b0-46f755c56195", "comment": "Malware payload (SnakeKeylogger)", "value": "8ae0ca7db785f0b6d2672e82886e9aecae1662c7858307a3d2d08db94b55cb4bd91e045412933db32c6af5016c8670a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848252, "uuid": "0a1b04de-ae42-43e5-91ac-a94bd2c37391", "value": "T1DB84FBDC3AC15A72ED9FC1324A011A28BB6F0F836A407B8D179B19C6974F47D5C6EC89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848252, "uuid": "154c8ec4-e186-4481-9454-0f69de8693bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848252, "uuid": "c66a5ed0-22d7-4edd-8af9-2d9b0d0328b6", "value": "6144:yrxCuJL/+MVpWwFUg3cCas0QdgrcPAfhtBKpJ0yvf:sdJbVVp56gsCWXEoWpGyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848252, "uuid": "76da9c46-e384-4d60-8281-1a8a15b88845", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848252, "uuid": "70bbc4d3-55bc-4564-85db-a275fc96615d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848252, "uuid": "8a5d00bf-56d6-4bff-84f1-9082c973bd8a", "value": "PO 2022-25-07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c8149a-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658851173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851173, "uuid": "e5c855d7-6467-46be-b3d2-2ffb87c94b83", "comment": "Malware payload (Loki)", "value": "e9f16d0d9f114f83a58ecbada84f9daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851173, "uuid": "00716c02-09ef-4b72-924f-ae2795b8bc67", "comment": "Malware payload (Loki)", "value": "9657634e776807bea270fc249315502e4e8eea293acc1150e60adf700c4cec91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851173, "uuid": "708f642c-d844-4773-be53-2ada6152dcb0", "comment": "Malware payload (Loki)", "value": "32d6e674c84a5213cb5736029cf2a549e022d4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851173, "uuid": "7a2041f2-cbe7-42b2-8a9f-d5393408af1a", "comment": "Malware payload (Loki)", "value": "5a2269527f4827a0f7a99608ed30b49323fdab388255a5622a6f4d8978665dc0d813ea9bb7a5762291e813b4a6174061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851173, "uuid": "ca5f5900-2608-4e83-a4d9-43297acd6835", "value": "T1D705122D67A45F07EDFE83F584141604A7B429263853E7A84EC2F0EE2E26F714947E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851173, "uuid": "3564da33-62e8-40b3-b1fc-4ac3ce1dd02c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851173, "uuid": "707b2da6-2414-4fe5-a5dc-1911664f8b6a", "value": "24576:mcVw4UZvybcv8vsRwiunOKuTbCChhtYsJxkP:mcV6d8PiunOKFGtYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851173, "uuid": "ba1827a5-165c-4f6a-ae98-e2c92304bca7", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851173, "uuid": "4fcab9c6-db29-45e4-a122-172f1fa5251e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851173, "uuid": "b425d87d-0e77-4ed1-8bd2-3010e80ba523", "value": "e9f16d0d9f114f83a58ecbada84f9daf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4af2aa7-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658851609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851609, "uuid": "ab447560-08a7-455c-9462-5a7325274103", "comment": "Malware payload (RemcosRAT)", "value": "4b1d98dda6ca33ae6ba72044c3ab675a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851609, "uuid": "6817adf8-1055-4543-a9c7-e6316f6a7b89", "comment": "Malware payload (RemcosRAT)", "value": "96ba5e5a0126dd3eeac998cb59266e26d999ea23825eb82357da58e3a0016653", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851609, "uuid": "46fff334-5f3a-4b26-afb2-e0535ac15a32", "comment": "Malware payload (RemcosRAT)", "value": "c22dd8838a05431335a84cd59056d16349241244", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851609, "uuid": "890e27a6-6cfc-4bb5-adfc-d414de2fdb2b", "comment": "Malware payload (RemcosRAT)", "value": "c518b28637cfcc480b043534d84775cbea0b3b69dbc35e46096f8959c908652b4764f63d1970dd4c9b90fa350463990c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851609, "uuid": "d6b42c31-629c-446a-b2b4-5df4ff5056a1", "value": "T173326DEACD60242EC747C13980D02256F934E7C75A565A872ABCF95E8DF318E772036A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851609, "uuid": "443b9070-0fc9-4b3e-8c4b-a48b8a82be18", "value": "192:zT+EbXCgB1sw+ZNf9WVHJYzUL7+NBPpM//FYywPDZtQlVCfpUU:3+EL09WJJYzwGppEYyyZSPCBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851609, "uuid": "0ad6e19f-1ee6-410d-a6ef-fbcc3ddce106", "value": 11203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851609, "uuid": "8995b92f-6356-404d-97d2-6c8f89d7c51e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851609, "uuid": "11d7b449-8bc6-4c17-b9cc-4ff5ae064f26", "value": "4b1d98dda6ca33ae6ba72044c3ab675a.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bfac9c-0cda-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658836869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836869, "uuid": "9bcfefff-7b92-4f5f-91a9-c0bddc141fc5", "comment": "Malware payload (Formbook)", "value": "409fdb5a567a59e4fa521458e650558a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836869, "uuid": "45f8af75-5924-45f9-a623-34a1ae101782", "comment": "Malware payload (Formbook)", "value": "9795f13db5f68b285bfe8304b235f6ca1a45448539c381b6a2b70f6338773f05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836869, "uuid": "14852a6d-4821-45a4-af5b-c8644fcac3d2", "comment": "Malware payload (Formbook)", "value": "d041f78b784c0026724fbe0ffc8252583c669a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836869, "uuid": "093ee6b8-6ce1-4937-b52e-435675cc560f", "comment": "Malware payload (Formbook)", "value": "850fb77a492d92eed47884390345aec7b21a15e102f0116456724f3ada2b5df9069e6b1801f88d1d8174d6cdbe41ac46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836869, "uuid": "cfe61430-bfda-4af5-a0dd-0cdd00573ab8", "value": "T1BF457BD87E11759FC46BE2B5B4545CBCE7633C22028F93935193E9DA9B0FA928E401E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836869, "uuid": "8be4775b-33fb-4b0d-aff9-d89de8ad9050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836869, "uuid": "9535e85d-eb63-49c1-afb4-3eaad34b6349", "value": "24576:Pw4UZvybcv8vq+50SI/A4bvSnumpxZ30+HFNeLc:P6d8P50SQbSnumW+HOLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836869, "uuid": "afd0dc8d-c0ba-4ff6-9bda-eeaa3c159d2a", "value": 1280000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836869, "uuid": "431e7758-b440-47d1-9c53-0dea85a3c4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836869, "uuid": "d439259e-ffda-47f8-aa9c-a8a104ee697d", "value": "SecuriteInfo.com.Variant.Strictor.271078.17613.8683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8554d414-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658848845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848845, "uuid": "77bf539b-d3aa-4508-971b-6dac7c24c7cf", "comment": "Malware payload (RedLineStealer)", "value": "ebdb1ac576509460b4c71701857acd97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848845, "uuid": "8f242b9e-e4e6-460c-a799-1c71f2442599", "comment": "Malware payload (RedLineStealer)", "value": "9831349785d5a987e30e7ef0ecedfcfcff9583d5c2acd1d3362c18c068ce6221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848845, "uuid": "c3cc2330-3692-45b7-b9a4-b60ec74f79ec", "comment": "Malware payload (RedLineStealer)", "value": "a847b9500bf10166fbb90429d72005ed34e13274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848845, "uuid": "6c37d633-7e75-4a6e-9229-7a2fe2840cf5", "comment": "Malware payload (RedLineStealer)", "value": "e0dfe8d6bcb98eb042e72e0665dbecdde6e57430753376505e895f733702d23eaac96de5aca303f4e75b939adbc49d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848845, "uuid": "eea78f88-17b6-4e71-bda9-e174baed0b11", "value": "T1DFC52A135A8B0E75DDD27BB4A1CB633BA734ED30CA2A9B7BF608C43559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848845, "uuid": "d26ee0af-105a-4d0a-8005-0f8190404b94", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848845, "uuid": "6aac2573-4c40-4391-89f7-a7e8dac5edc2", "value": "24576:P6KHQUlhGDW6oYkYtxLHNL6OMCcduqMDhfibifYWa/FfvWLHxFeZDl3RuQ55313N:CGhGCmJkb+a/FfvWjxUDl3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848845, "uuid": "c9caf43a-26db-44c8-bfe3-935fd82e3fed", "value": 2582465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848845, "uuid": "52a5415c-0b3f-4126-ac24-30e9ddd3b301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848845, "uuid": "3bb77f27-271c-4239-86d3-01d028b81315", "value": "ebdb1ac576509460b4c71701857acd97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359029be-0ce6-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658841839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841839, "uuid": "16366acb-a452-4f30-a793-0f9f14e43b92", "comment": "Malware payload (NanoCore)", "value": "6e7c6ba66b3cf1657af7ab376f2c4d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841839, "uuid": "9043f52c-5110-4129-880b-6c5781106aa1", "comment": "Malware payload (NanoCore)", "value": "9a1142a3ac9fd836fd21c7f71026cb5714c8fe5d4c12e702b733f2b0350ed6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841839, "uuid": "a73020cb-bae4-47d0-8c85-cf4c750cb4fa", "comment": "Malware payload (NanoCore)", "value": "f5725d4b02044ecff7ce2214c8e98d9b73b4bad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841839, "uuid": "1e987510-515d-4878-aa08-926d97bd0b3c", "comment": "Malware payload (NanoCore)", "value": "f34864726175d443e865e39e9e30e041b8a3ce66f614eaf1a53c885d81309bba507213c187b7c3e392b4ffc389abd61c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841839, "uuid": "68b5a5fa-321b-49b5-b439-3f03a448a66f", "value": "T19045AEAC352075DFCA67C6B989946D24AB203C76570BC603902331EDAE3DBA7DE154E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841839, "uuid": "9aafb8f0-1345-4848-ba15-5a71dee630d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841839, "uuid": "a82bc1e8-d7d5-40dd-bd64-f5843e0bc9a3", "value": "24576:Bw4UZvybcv8v/kkv2fKZsw5ut3Ck2d/Nkt39FjxemHJvLe:B6d83cfcne4Ut39emHJvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658841839, "uuid": "606f859b-1e2b-4442-9c09-56215f47ba84", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658841839, "uuid": "27b1801d-5d6f-4557-bac2-efdf0d39e314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841839, "uuid": "67975b53-d141-4b87-9398-4406bf70a7d3", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc3c5cf-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658849453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849453, "uuid": "346c9bbc-5d34-4b8e-b01f-d834084d5e36", "comment": "Malware payload (AgentTesla)", "value": "e856b6c583edc6380f5e963c9b890b78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849453, "uuid": "29891cac-e5b1-4c74-8a62-495923ece224", "comment": "Malware payload (AgentTesla)", "value": "9a49a10a5e57b0dab8b0e1b2181a6851cc5bcdc4c6c060fd3721c10b5f68a32a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849453, "uuid": "43560a4e-4ec2-4c74-93c1-82e5fb8cfae9", "comment": "Malware payload (AgentTesla)", "value": "2eba0bf311654f353159f891429ec4926cc5acdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849453, "uuid": "7c85a313-5213-4e23-a775-8b76f6449f5e", "comment": "Malware payload (AgentTesla)", "value": "76706483274bc6b506cae866d7ed015f8d546e7bb700df1bba712fee1da5119bea535683a1bf1987375d2f3e0f9c284c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849453, "uuid": "a49f9c90-ff85-4f1c-af9f-3a2c65d768c4", "value": "T13CD4BE2121DB7714EB39F77816D8A060AFF5EC13D205E52D2DA633968777E608E72223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849453, "uuid": "b1e01650-f4b3-4f60-b8a8-2916fdc6b9c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849453, "uuid": "89ac7777-9a4c-437d-bd69-9bf57a0a6ff4", "value": "12288:0XE7upjixgV2iNDyjUT0PJj6fcjgFtCzE0Tueu6zOXfCWbhe:03ixgV1MUejzUFMQCJSXfNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849453, "uuid": "29b8828c-dafa-4db5-b2ab-65477a62d5ff", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849453, "uuid": "135a78dd-7ead-4a14-bf67-cd071e2cf5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849453, "uuid": "ad81de97-e653-4cd3-aa98-a398f6027e65", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ed0a17-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848954, "uuid": "85b5b53b-1130-42e6-93e4-0fe1809c6295", "comment": "Malware payload (Mirai)", "value": "98cf05a6be9e9c30b26ed01a0794f422", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848954, "uuid": "eda938d3-e926-4373-bb63-9d618e6f852b", "comment": "Malware payload (Mirai)", "value": "9c12186fd540075822b166350ab99c5372d25ab9fc98c4bf2094e1a246378ea9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848954, "uuid": "8eddffd1-e386-48b1-8309-65b78b771994", "comment": "Malware payload (Mirai)", "value": "50e50aff10ac5b8ae009438988323f71b3ab5d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848954, "uuid": "85071d7c-96d7-49b6-b651-74dc4c83ec34", "comment": "Malware payload (Mirai)", "value": "6860cb14367b81f5edb4d069e1d42d53532e6bb2336882db724cf2094ed25af5b1f466362ee353fff010abf1ddb2a6ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848954, "uuid": "10527aff-6955-4d04-b764-ae29fd34afcd", "value": "T111C2D0A07726FE31C4206C3DE52A4D8A3A51067C81FE393764258D399FC169A66A88A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848954, "uuid": "dd6ffe23-f7b3-43fe-889d-6b4c97483c80", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrE9q3UELuN:NKy4qfqoeJdXWgtLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848954, "uuid": "04d56d39-2997-4d30-9d94-6904c7a40743", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848954, "uuid": "856c878a-af84-4e03-a400-2fa00caaebd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848954, "uuid": "b44a4272-745e-42bd-a72d-71eabc16cd3d", "value": "98cf05a6be9e9c30b26ed01a0794f422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3277061-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658848895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848895, "uuid": "8a6b4ef7-dfbb-4cca-a8bb-43d91d372082", "comment": "Malware payload", "value": "cf7a8114b0783bed77838f9d113a7efc", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848895, "uuid": "172df921-c077-47c2-83de-0d13af8e5374", "comment": "Malware payload", "value": "9d300d9ddd8b35a36dafc4f2d2b33a2a65b840e7e433f2c42d79b18c73ceb7b3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848895, "uuid": "beb49d84-7ea0-4079-8852-0954c0ba1697", "comment": "Malware payload", "value": "75bc8d93d218726c7d8c926f4c5100e4ae625758", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848895, "uuid": "995550b1-688f-4dfb-b5b1-9bbe06382541", "comment": "Malware payload", "value": "fdf1d8216b519edf4bde6238b157f28f2e17de5abba5ab993d91bd2b7933ec60cb42cc2fd0ad093610f04c106ac1acbe", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848895, "uuid": "92b745c5-0cd9-4a2c-978e-479bc97c28bf", "value": "T10704E10733925E63C6975E31EEA640CA5A3ABC288D17F25731AD73CD6734BD49A88073", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848895, "uuid": "1a1f16d2-0e43-4685-9a6a-69f3d845629b", "value": "3072:5/TNjimLJQKQ8o0WZ6vGk6ILqeZeU4fwMsLLb5YiJeHLKlH:5pj3ZIrZbOqKb75z5XEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848895, "uuid": "9b3f36ce-512d-40d2-a453-b6689824277a", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848895, "uuid": "0e9d214c-f1d6-40dc-925c-48ec684e2a0a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848895, "uuid": "ddc9aeb8-0065-4edc-ba8a-ff874ca567c3", "value": "12102018.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0222865e-0cf8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658849484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849484, "uuid": "2383f9e9-56e7-4b24-8e2a-5038764fdfd8", "comment": "Malware payload (AgentTesla)", "value": "9d0f9f070571958916ba71e6b93c5335", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849484, "uuid": "3b6796aa-18ae-4e46-9646-850941221226", "comment": "Malware payload (AgentTesla)", "value": "9d57f996bd138d3e9713983c4688b94b40417aa1ba13d328ade519e7b27314f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849484, "uuid": "a5907ee4-0a15-4d1a-acd8-3bbae3e0a27f", "comment": "Malware payload (AgentTesla)", "value": "2601ffb759771cbcc5dd855ff7f9367c04ac7ae5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849484, "uuid": "2e6744c4-6eb2-4be9-9b68-f3e2faa1900e", "comment": "Malware payload (AgentTesla)", "value": "77c30bb02e3b41f113828a3b837e2b13ce1def715d023d11257684f1c75dcaf2374492d9a7b07610b95e531e7e1aab3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849484, "uuid": "90737269-ce81-4728-b784-8a2e9d375e45", "value": "T1A7653AA9B201E0CDF96E94B1CD90BEF056167C6BCB0B590301573EC5757FAA78A3A093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849484, "uuid": "791c1130-81ba-43ff-9ca1-778fea8f79cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849484, "uuid": "380f739c-455d-4ed6-8e44-0f49da8b20d1", "value": "24576:7+w4UZvybcv8von6wOlwRFfzaYB1u3iXx4SHL:i6d8wn6PKuxSHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849484, "uuid": "8972a3ab-562e-4bc2-877e-eb29f07a7685", "value": 1432576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849484, "uuid": "f27d17f0-41da-4c82-9d5f-a0b144abb23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849484, "uuid": "25a40f8a-2367-4092-8f5f-a80f426de811", "value": "Ordem de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f97ef8-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658818027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818027, "uuid": "aff9c92e-2bdb-4b26-8f14-8a920c6b4944", "comment": "Malware payload (Mirai)", "value": "ca78437328bbfe0a08a52a46df1bd376", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818027, "uuid": "f46ab88b-af7f-4985-9795-e4a6d2aeadbe", "comment": "Malware payload (Mirai)", "value": "9d717b9851efa36120770432f0c40e076e1b4210e5c0db754e55844da4d355b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818027, "uuid": "57ceae73-3e8d-4275-bd7e-bb0459329571", "comment": "Malware payload (Mirai)", "value": "692ad60d9425a66de492036e1b1081abaa669e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818027, "uuid": "03a66e51-5b88-47a1-bc64-0c9f0f0d1345", "comment": "Malware payload (Mirai)", "value": "e8b63c80923324e231f6473b6eec5ef5ee7a2b23125758c56a73cb63a47285b29e39280cf616c414cb41a15345694ec5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818027, "uuid": "5a68de52-e275-4d47-bc50-95ead9c9ea6f", "value": "T121431A9AF4029D3DF90FE67E54170D09B93177C252830B275BABFDA3AC721A91D12D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818027, "uuid": "d6cd78b2-36d8-4d34-8968-bc41ce36f3a0", "value": "768:tPBnIQNelDaoukn9CMO6E5XRTG8X4fjAyKuqiDXN0fSfJEwfGToQLDPYU:tpEpnfOv5XZG8X4fnKuqiTN0muNLT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818027, "uuid": "bd898a61-485f-435c-baea-7620c542fa10", "value": 57936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818027, "uuid": "da7ae1c9-0222-4008-a74e-4fabd3c03927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818027, "uuid": "4083e373-8655-4f11-b4ef-279ea89ccdb1", "value": "ca78437328bbfe0a08a52a46df1bd376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0530a0-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658848747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848747, "uuid": "aeec9344-f03a-4e86-83af-1e7f1f965215", "comment": "Malware payload (AgentTesla)", "value": "e7e720f01d367785e8cff006992434ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848747, "uuid": "349afd7a-9be1-4317-b54b-4edd854aefbd", "comment": "Malware payload (AgentTesla)", "value": "9e236f36e158daa8c5b5cfff70d440e7d74151dd67b81b07d50360d4306ebb35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848747, "uuid": "d2ae3c21-54d5-4fea-80ad-ba9657d24f25", "comment": "Malware payload (AgentTesla)", "value": "5fe3ad60531583b6b55eef7d1f5abcce225efe1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848747, "uuid": "9ab34873-fb3e-4b59-a1b3-093a1340f770", "comment": "Malware payload (AgentTesla)", "value": "49f99a6678aa9a5010e3c2eb1b4e3e6df13ba80702f733bad148d9bef4295818e52ecf629443d785ef2d92f5445696a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848747, "uuid": "3fa35503-7999-4063-a2c3-6ed504aa48d1", "value": "T16324097E17856D41C6EE41BD90B2915811F1D703C326B38F6EE248EE1B172CEFA2A9D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848747, "uuid": "65080ee2-7ad1-4842-847c-0c72d18c5a7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848747, "uuid": "afe5f43b-a822-48d4-8d9f-ebb561699228", "value": "3072:+cfIsBGX61fIA+xbrP8zhLXdrUlHfxYw656xVbySpZsJKWldgIOwpN:VfbqD78d9UdfxYw/VbzVWluIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848747, "uuid": "7cce4caf-abac-4c7e-9a96-774a441a7d9d", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848747, "uuid": "59d3ddec-488b-4d5d-b654-864a6b88c4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848747, "uuid": "eb06e8fd-2ee9-49cb-af0e-36cfdbaf3960", "value": "e7e720f01d367785e8cff006992434ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590d8c3a-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658848771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848771, "uuid": "bcdf948d-017d-472a-84c5-b1fef9cfe333", "comment": "Malware payload", "value": "cd46049aff4ba21bc55c1c4b34096f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848771, "uuid": "434e8e0d-0b88-438b-aefb-5ffd30453f5f", "comment": "Malware payload", "value": "9e63d934bbe529d58f78f8c8ad9509ed7e461c1ea7f80a29b70f277816e7908c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848771, "uuid": "2e377429-7040-43ae-b48d-52db2b01cc4a", "comment": "Malware payload", "value": "031a3dd302a9dde3fda9b69bc055a333635f019d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848771, "uuid": "6ca216ae-c0d1-428c-91de-795da36683de", "comment": "Malware payload", "value": "e2fd9246bd7502e9bc2ab86954f50566de86c27bb3fd714ed2f9195b8e766d8d0d6c092cb1fc9d8e0194ca0128ef066a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848771, "uuid": "0eab1c23-0068-4922-8f42-bcfe51553e7c", "value": "T18D0612BDA184339CC41AC4784533ED85E3B9161E07EDE5A6F6EB3780B373461E642E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848771, "uuid": "aa7de97b-546f-4eb3-abb9-be30b0ef34e9", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848771, "uuid": "f2bd74fd-3ade-45eb-925e-342edf3aec61", "value": "49152:sMohOJFI9olLGvdNu/8AHWnmjTnOpETDX21UGDJhy6evktnNA0PqBmIRkT1ydsWL:mKadw0AHwm/nbW1RD66evkbARmM5+Wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848771, "uuid": "474d99af-d000-4908-a982-6dbb3fbff3bc", "value": 3893760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848771, "uuid": "9a6ac71b-9dab-470a-947f-961bbc70cb47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848771, "uuid": "47bb8b3e-087c-4feb-a761-e9adfd59cbad", "value": "cd46049aff4ba21bc55c1c4b34096f04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68dbdd1-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843317, "uuid": "8ae9c272-a0dc-4a0e-93c8-9074c35e56f5", "comment": "Malware payload (Mirai)", "value": "2dbfc017120e42bc34e4ad224138dff6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843317, "uuid": "2385b404-649a-4916-bbd5-267a6551e0d3", "comment": "Malware payload (Mirai)", "value": "9e9af77ec6e3c332de76fbe9b0517f9e9cf385cd883e85004d5b7241febaa441", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843317, "uuid": "59107cc8-be52-4507-b774-10596703d775", "comment": "Malware payload (Mirai)", "value": "c9d7ef4d6e4192e0066675d4cc4c2ac1fc2bc6ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843317, "uuid": "d50dd453-0bff-46ab-8d9e-70c9df2825d8", "comment": "Malware payload (Mirai)", "value": "e0f84e78ce94bd3139670a0a986be5ee20d0ac3724f51c205ec4294fb12fce4a690391a1b88e3628dc16cfbdbf9e259b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843317, "uuid": "f06d6180-de2d-4b68-806a-477d3c1ac073", "value": "T1C6330985BC919A02C9C42377F61E11CD372663A8E2DF32179E226F1177CAD2F0E67646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843317, "uuid": "866c5710-9391-4fd9-8499-b80fd6559530", "value": "768:z446whj9ed5KmmASQA3QfTMrSdej3QoOrOHLNSBNOYCUlg4fm2ss:x6whxukmmASQkJrScj3JyT201s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843317, "uuid": "8b7b968f-9ee4-47f6-b49d-1dcd55fde95f", "value": 54836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843317, "uuid": "abd7911b-4295-4f03-8a9f-b790a79a2372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843317, "uuid": "2a2d0607-0bc8-4bf9-a707-afdbf5c97ce2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8e7056-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658827084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827084, "uuid": "d7352891-57ec-45fa-b90e-17790de423b6", "comment": "Malware payload (AgentTesla)", "value": "4da39c7e448b0d524e21b9a9e38ad5bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827084, "uuid": "ce469e5d-e9c7-4478-aad7-cfbad19a5cf6", "comment": "Malware payload (AgentTesla)", "value": "9ecbb05f36780c0e8337cee2972c423d0b5738022ce1ed6a8d0fc7290e1d3c4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827084, "uuid": "320dc2cf-81a4-41b8-8014-24e77f4aca90", "comment": "Malware payload (AgentTesla)", "value": "6b11db8fc14b95089ab421a1a1b0280c51d94157", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827084, "uuid": "6b92890a-ed44-4c1e-b3c5-469b627d8fac", "comment": "Malware payload (AgentTesla)", "value": "7bd18a84f4abaacd2eddd2453b5fbb890a88c89ba18ad6c031d1d7571546f548aaafd66d018e15cc3888c5b59fe42e69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827084, "uuid": "dd48fc0b-c248-40fe-861d-c26fa6e943e8", "value": "T148359DAC3510759FC86BC6B9D958AC74EB203C66530BD603909309EBBE1DBA7DE144E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827084, "uuid": "2c77757e-3205-4449-a3e5-5c010f66c9bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827084, "uuid": "14c69f7c-0fe9-4a2d-83fb-c0a5eea4ce5a", "value": "12288:+BCpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrSuEfLuJeFcLCyfAT2pclT/Cm5lBmGO975y:Rw4UZvybcv8vFTiicHfMgWryxxn/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827084, "uuid": "83170456-5293-4a0d-8e5f-b1a163769e7b", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827084, "uuid": "e4701cf2-b2e4-488c-99e7-e60e93a94e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827084, "uuid": "43ab75c8-da41-4f25-9ef2-e5a052eb8cba", "value": "Proforma Invoice_21-1541 And Packing List.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e475322-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848243, "uuid": "fb39e244-7469-4b26-b5df-4749ab7ef282", "comment": "Malware payload (SnakeKeylogger)", "value": "4370a3457a82402ffb2bf3c4e30aa034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848243, "uuid": "c39cdc48-ad7c-44af-9f59-abfccb7000e8", "comment": "Malware payload (SnakeKeylogger)", "value": "9fee9146918f6f92d93182ea151aa534be36cce9e5cdb913728822b22ca4a864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848243, "uuid": "0e208a9d-74f4-4465-a078-506b64c87358", "comment": "Malware payload (SnakeKeylogger)", "value": "272b4545e080206f8bb204a1f7e7b8594e8ef25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848243, "uuid": "12cdf468-9e1b-4424-9b8c-ff9af32f5ff7", "comment": "Malware payload (SnakeKeylogger)", "value": "fcb026776e9b41e29670b569aa7986d1fc2cba53a9be1a205e70dc34bbcc960bc529550ef69a3ef6e907d48df94c6ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848243, "uuid": "dfb1fd43-7708-470a-abc7-f0aaf5aace19", "value": "T19315122E26B4AF07EDBD87F94020410057B576263543E7E88DC2B0EE3F65B61594AE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848243, "uuid": "e1a001b7-829f-48da-8be6-108e3f9ceab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848243, "uuid": "e395219f-d0e3-4802-ba7e-b06b00d8afba", "value": "24576:9c4w4UZvybcv8vhG8e9Foa2c8hKxPxaP:9c46d8oHgP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848243, "uuid": "c2fe2fe6-3ae7-4bee-a515-93b0d7a785a5", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848243, "uuid": "c9d4dc16-21eb-4cec-b74e-ff3fdead7070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848243, "uuid": "ec619d6f-b850-46d8-abc0-962d84797b1e", "value": "JulyList.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d65647-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848234, "uuid": "2dec4d10-3d1f-422e-9e03-669daf1ddf70", "comment": "Malware payload (SnakeKeylogger)", "value": "1b524a17a6138650546ad2786501095e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848234, "uuid": "67abda0e-c677-4834-8759-5fee2d008365", "comment": "Malware payload (SnakeKeylogger)", "value": "a021d82bdcee8618bf1899318e7034ef9e9cf649b1f2fe15029583ffb7e75385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848234, "uuid": "cd3910bc-a187-446a-8a8c-8ca0bacf4602", "comment": "Malware payload (SnakeKeylogger)", "value": "7e18a1b9b4a153aa55b670d12262e80915d70b54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848234, "uuid": "dccd2f1e-38ff-4694-bf74-5a06b3b661af", "comment": "Malware payload (SnakeKeylogger)", "value": "1b3105341bfe4e3e7fff45005f19ea675a08b5c9d71d995b96f11de452fef28d67c9b896a95b8c316db369b403fe7e28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848234, "uuid": "8fe99385-b095-473f-bfb6-73187bf64751", "value": "T1F544012C8ACCAE72DEBD1A756D30B94083579D7B1303E3A0074CB1A25486719CDB5AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848234, "uuid": "85a2394b-3a48-4495-a623-d45e1cc0bdfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848234, "uuid": "d1582b7f-3daf-43b5-83bb-08044192d039", "value": "6144:bgY9lSSxmJp4s8gegNrLbMwCAoAtFXdNbRMOrY1:bgqSSS+sRecm7OtTbRMOrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848234, "uuid": "94e9a366-b415-4acd-99f8-2c2e93e996b1", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848234, "uuid": "f0b6a0dc-5b8d-4310-b21e-75ac185fc0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848234, "uuid": "4728f336-9a3c-43ad-8968-cc73005278b8", "value": "496545678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a683050e-0ccc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658830862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830862, "uuid": "1be1285b-5234-4ea8-ac6a-34724e76d47a", "comment": "Malware payload (Loki)", "value": "7054a3f3c56e9b62ba1583ae4cc67f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830862, "uuid": "fe54f4ff-eeb2-4772-a5d9-e41505c9f596", "comment": "Malware payload (Loki)", "value": "a0d74d6d2bda3ad10c36a48bdbd96d9567e12074148220a4c04df674584cf6e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830862, "uuid": "914d245f-3766-4a8d-b991-0d3543a95f3c", "comment": "Malware payload (Loki)", "value": "f36655b60255f68d151dd00f57d0b2f401ceb480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830862, "uuid": "d000e0ff-9063-4e9c-a359-d27884661415", "comment": "Malware payload (Loki)", "value": "d8466c4cdc99a45c577f3558e88d91e4ab4b651c7f9e6d75ff6f1c5e6d28442edc894985af63b14d7cec08e02d2ac16f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830862, "uuid": "491cac15-543f-4490-96b1-1be446ee88e7", "value": "T135A4026EF9583C53CABE45FCA4A1A20413F5A45376E2FBDACDC251E212C77B58202693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830862, "uuid": "e3485a92-cf80-4fee-960c-63cbb5904cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830862, "uuid": "32960e1e-3b69-48a4-86e4-aef559d62227", "value": "12288:oo30/A9M0OWzXnK9tuANu3Qw2dpMHFK9A6No5g0x8H:FEb0OCX2tuAzpMQ9JSC0xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658830862, "uuid": "211c1d0a-57cc-4d1e-8c47-33427961c195", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658830862, "uuid": "c95ac6ee-a809-47b3-9dc3-c31af5932950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830862, "uuid": "9c7377d9-9429-474f-aa06-6f256cb5395f", "value": "LJah82xRicHcquG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396da3dc-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658849147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849147, "uuid": "b65f50bd-6618-489b-9724-befdffded92e", "comment": "Malware payload (Loki)", "value": "907f2cba1c769ef30f081ea59c3a08c4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849147, "uuid": "0eca6cf8-2786-4c97-a8b7-611b210647b9", "comment": "Malware payload (Loki)", "value": "a19b722942c5112eeeb095b84597b467588e28e8d0f2aa2da75ab80d8c1f0ae1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849147, "uuid": "548dc62f-7151-4b6a-a5f2-b4cf0c7ded34", "comment": "Malware payload (Loki)", "value": "d2919bee58d65fa1b9606a64e545750b77d5afe5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849147, "uuid": "6c9b1c1d-782b-47ed-8b37-0953efb41b1a", "comment": "Malware payload (Loki)", "value": "07edc560550e67e007753e381c0bd204c616154b69045c13def1e3250fbcae40683b99bddda18a1711f4c45cfe073adb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849147, "uuid": "f5378a57-c76f-4840-a1f2-3afae438a749", "value": "T1E5B3015F17FC9AC5EAEEAEF722A14B11827DED38FB78818632467F44003060A4B1D931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849147, "uuid": "68891e43-d218-4397-8964-eba5bdad8ba8", "value": "3072:L0rR/IcjdYXdJGP9BPG7xD8Qh9wR6FqPdz:4/7pqfGP9BPG7xgQh9wR6gFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849147, "uuid": "c04efddb-2f5a-4e64-a552-351eb703c24d", "value": 113032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849147, "uuid": "953e3021-738d-40ae-9ef9-affd839c6e9c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849147, "uuid": "0b3e9224-8c95-49a2-9eb8-b7d8365bd21e", "value": "Prepayment_Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f19b46-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658848932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848932, "uuid": "7c497dd5-88de-4d84-ba58-3a1492bbd866", "comment": "Malware payload (Mirai)", "value": "a6082793f69149ead270b19d72521244", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848932, "uuid": "ad5d15bf-2f90-4017-8fa7-31db2bdabc57", "comment": "Malware payload (Mirai)", "value": "a33a96ba4c7804f94b434d69d9358a38b7110bff7ca79b10fbd938168785747c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848932, "uuid": "70378869-e2d7-4472-b505-300ea96f47ae", "comment": "Malware payload (Mirai)", "value": "3f7afffb42502a8a64d1acf18064b38f32332db3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848932, "uuid": "c271e0fb-9973-4ffe-b026-6f26f7064b99", "comment": "Malware payload (Mirai)", "value": "2458525f8181b710c4d19176ffe5be2274a90e5f3716b7f63aeee246323763849f98212e046b910ed6563fc2bea2b740", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848932, "uuid": "7d6f94d9-2745-4a19-81b6-2aa261021054", "value": "T195A2E06FFF60818CE44A843E0DA7646396BBDC978349494D8C23C5C605D3ADC559EEB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848932, "uuid": "96bfff05-5dc7-4cba-af64-84a9da662b66", "value": "384:qDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chwCZM4/adXWHGg+FEsPl6JjK5+Z6ct:qDZ5Dw7RjFjcU+O24sDeZMSaNWmlFEsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848932, "uuid": "6c50b314-c131-4189-ab9a-5945d3b28b39", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848932, "uuid": "a8fb705d-df4f-4432-b722-09f0deb3db71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848932, "uuid": "9877c17e-c830-4e66-9edc-b80a961fd01c", "value": "a6082793f69149ead270b19d72521244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41045e4-0ce7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658842562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842562, "uuid": "23e89ae8-1f83-4c4e-89c1-d510f108b0e3", "comment": "Malware payload", "value": "1986da03077a630ccea5813a77099f89", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842562, "uuid": "840c6ff2-864e-4fc4-b4cd-94b3f377a3d5", "comment": "Malware payload", "value": "a3b7a25d38b4486d070dfc2ac23393b042ccc0e0345775fc947ade9394497c22", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842562, "uuid": "d30bbc30-eb62-416f-bb75-282f31e0df58", "comment": "Malware payload", "value": "7b93ebbf99006bc8d3144489e42345ae6bc33f27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658842562, "uuid": "c249fcb6-b1fc-4aa1-928e-9c9847a3dc74", "comment": "Malware payload", "value": "076de4fd17374ed75d92eaf93e47033e97659039d5123129b5bc9ef6de26f259a7c6e37301dad1fe698243f45065b46c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658842562, "uuid": "1a2e379d-f6a8-4bca-a102-0f36877fb83f", "value": "T1D495E515CB115AFBD5FD03B249E70B24777290A37AF312B3CF4946255CAE388A6319B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658842562, "uuid": "6739b4a2-20fc-4c93-9be5-f1a1b54562c1", "value": "24576:m50f/vi+tf1/SnKsLjRY6RAAux1fj4dEQMtqVC43u:ma/iuf1/SnhL+4dpMATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658842562, "uuid": "bded0ae1-87b3-4fa9-92b0-033225af6b95", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658842562, "uuid": "5531e149-47d5-4a64-8ed8-6a5e52a43f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658842562, "uuid": "d169b8bc-0da4-4f73-b4c5-9e90e5587ea9", "value": "SecuriteInfo.com.PUA.RiskWare.PEMalform.23262.734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36982b83-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877919, "uuid": "6295423e-6c7d-4532-b342-f2738ce417f0", "comment": "Malware payload (Mirai)", "value": "7148c010e1762eabc0b4f1a0fbb5ec9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877919, "uuid": "ebf3ca56-8ced-4ca7-9c84-9f40ba04cf7a", "comment": "Malware payload (Mirai)", "value": "a3d48d8a355a76d78b798ce99505782de712fe382d944e511a32cbf8c28ba24d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877919, "uuid": "ef2f1f32-d361-44bc-85fd-677c41db586d", "comment": "Malware payload (Mirai)", "value": "95103b02f3be3315c926c527126610237ceb1154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877919, "uuid": "72d98959-b26c-4a74-b600-b5dbfafcffd1", "comment": "Malware payload (Mirai)", "value": "f9790cc5e54c4f57ef7eb3f6e1c02987ab3a7886ee8e4e7360d6fedd18c58322b2a27234f2ba3adeb8649685d8c4734f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877919, "uuid": "ffa41325-9cc3-46c8-b44b-5ca6d8f43775", "value": "T152331951B8C2A667C2D013BAF2AE968E373073E8D2CF3217DD611B113A8552F1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877919, "uuid": "206493f1-fc98-4087-8a1f-ba69c82a2d97", "value": "768:8tn+fi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstYaSp4X/t2FVNJwJZY10Uo:832R3ZNiwaAFz20eOaYaSpQJa101", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877919, "uuid": "60b1b5ef-6d25-4664-abc1-ad2ea14354d8", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877919, "uuid": "eb94bae4-8371-4378-9ade-26e6a11a9884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877919, "uuid": "f687c134-3a07-46ac-a99b-dcbbc987f920", "value": "7148c010e1762eabc0b4f1a0fbb5ec9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67125c50-0d0b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658857814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857814, "uuid": "e6ecf27d-ab4d-4ecf-8394-57f0e8f08814", "comment": "Malware payload", "value": "b327c6a7144df821a86b9ae3d7264f86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857814, "uuid": "24844dee-9b0f-4c3e-b618-b054337be0ea", "comment": "Malware payload", "value": "a5625b1826239f3e0deece61393a81cb0eac22c6edd6a32514d8f11fda8a3417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857814, "uuid": "aa0dcc7f-3edc-4734-b3bf-815c860275b6", "comment": "Malware payload", "value": "c8c9e15fb36366239525bb6072ee870cfbd60d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857814, "uuid": "988b9192-af3a-447e-94fc-85f4ac56acac", "comment": "Malware payload", "value": "9d4223a9de18973971bc8df8aa79fcee49f430d97aee5bf9b452e5425535e267f395a706e8ce53f3c583ad6d51c56eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857814, "uuid": "f8da47ad-a36a-4c14-8ffc-48d26ecef369", "value": "T13755DF427AD24471F58686B406BFA33E7E36B1026725CECBC3D0A8241D526E1E63F75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857814, "uuid": "223a3e05-e089-4595-a76e-26817f8eba67", "value": "20ccd7b11e6ba2e0cee857b7b719339b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857814, "uuid": "d9141f25-e95c-48c0-bf72-825ddccf42e6", "value": "24576:G64Pw3ksxCx94RCHPlgCYRAo0u2qEr87gcXl2cKjTeqbGDGOr0VM2qAT:GdI019Rlg/0u2qEr87HtkjbGDGe0VM2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658857814, "uuid": "8b9f6d0e-507c-494e-bb8c-62af0639b7de", "value": 1347880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658857814, "uuid": "8e41709b-f3ad-4f7f-a28f-666b88981ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857814, "uuid": "33090c33-b7bd-47cb-b78d-87ec6d614b35", "value": "SecuriteInfo.com.Trojan.Rozena.Win32.146291.31085.19766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4a9a8d-0d1c-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658865069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865069, "uuid": "97eb16dc-079e-4e18-95db-fc54699fcc63", "comment": "Malware payload (XFilesStealer)", "value": "0b78c14629663929649709d1869ce64c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865069, "uuid": "78e3506a-2e74-425e-9b28-2e3a6e55d5d6", "comment": "Malware payload (XFilesStealer)", "value": "a5e82c8219d978ab225bef99e344a66187296a39f3d4baa539f93e7d2cfa1cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865069, "uuid": "5b004774-48e4-4e3b-9472-92e30981f649", "comment": "Malware payload (XFilesStealer)", "value": "6efb9d240f147b73b49c72495959b06732611882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865069, "uuid": "ff2b5027-543a-4ada-b63e-4b4d95abf5d7", "comment": "Malware payload (XFilesStealer)", "value": "74b37539f6f37c45920a3608a42b46aabde493913921491c1fcd98f7b0fd4b94d95720034335db0ee75e7a03219433c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865069, "uuid": "0f8dea92-71ad-464c-8bb9-ca47fb480808", "value": "T19DE42351D61F05A2EA9D2EF4008B3555AF994E339D509D1A3C8FC01A982E31B7DEBFB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865069, "uuid": "2ef0cd42-269a-4c05-81a3-92fbebd2f90b", "value": "12288:4/T/v0OfYlYAj30Uc5ZjIbjYJp8u+Pow0wzBsNCHd8fV:GT/z6Tj30h5ObkTQ5VsMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658865069, "uuid": "4d2df7f2-1aec-4f27-a306-a13cc892852f", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658865069, "uuid": "f9cfa366-508d-4715-b959-81e0ef47fe3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865069, "uuid": "7d15a48f-897d-47e1-83e6-9e8e76b84597", "value": "Order For Teonth Imports And Exports #728DH18D6V10B1710HAU720181 40ft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42a17cf-0d0a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658857514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857514, "uuid": "a81fc82f-5014-469f-89c6-fbb89b8bbe6f", "comment": "Malware payload", "value": "96d65af8738de30dfa2283585f11e1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857514, "uuid": "8ff98a3e-5b99-4742-8480-7d7fe2fa819f", "comment": "Malware payload", "value": "a69ee77f4eb102a3528594435748d3a1e2925022a6d986eac8d32feb068c1f36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857514, "uuid": "fb234dcd-5a09-4cb9-9b19-6cfbc4f8546f", "comment": "Malware payload", "value": "fce536c32341baad02ba836a06688ab9f60193b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857514, "uuid": "0425ec48-7848-46e9-aad2-a35a616ef274", "comment": "Malware payload", "value": "7924532ef0f83e0d5e33dbd201c410d99d76d5bef3b33e589ed477de81ed2718796c0bde52ac7db30bdadfb4ee492ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857514, "uuid": "9ab6ea83-0b6f-4086-9ed9-4e54c94fec24", "value": "T1A4F4F12263ECEB5AE4BF1BBDF4200545437AE207A45ADB4D5A80B5CE2F673A0D5012B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857514, "uuid": "ffcd57b7-0826-45cc-bdb3-521d53246547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857514, "uuid": "d143a783-9203-4e0d-8ec1-a1900759c65e", "value": "12288:7TjtF802b2UVFdPBGj7IT0/PuA8U4fW4T2PXWmn9yUjEyvd+j:yGjMTSPuZfW4T2vHn9yUQikj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658857514, "uuid": "c30ab5f2-b47b-42c3-8870-512625f75027", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658857514, "uuid": "cd637221-c83b-4696-a63d-860fcfae2046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857514, "uuid": "10636b9a-e376-49f0-a09b-8cbf85e4efd5", "value": "Orden de Compra Urgente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7833981-0d03-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658854540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854540, "uuid": "b5f95a7e-f720-4402-9a3c-b0d7cf32f32e", "comment": "Malware payload (njrat)", "value": "0b35a26ec79030f76fd0f2d9711e1ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854540, "uuid": "ee9c0109-c63b-4b42-9d29-b63b357ee168", "comment": "Malware payload (njrat)", "value": "a77e1a86ee430f1cb33167f4ac5c60d825882e5b0f2b09f85308a2750c37555c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854540, "uuid": "8902b9ec-4967-4015-9d7c-8287d791ead3", "comment": "Malware payload (njrat)", "value": "59532a3d1d8428e91dc553366bea12ad5fc951a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854540, "uuid": "6875003c-1046-4e8d-aa64-9a35a0ae9909", "comment": "Malware payload (njrat)", "value": "c7be4555d7f90efdccb24f06da9d493691bf1650db6db31d305a8b998c26eb01a7c023fe75e049e326df2c0e0e237cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854540, "uuid": "04bc8773-5e28-4b68-88e1-86cd03855b07", "value": "T1D9E4DF1833905F70D35D87BAC1955A40BF7BDCAC069AE74EEC4432FB2AE2B25B984507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854540, "uuid": "3e5b2a3c-b271-4341-ba62-1ad059e2a2a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854540, "uuid": "74c591eb-14b7-49b0-ad3a-8db67dc391dd", "value": "12288:ReTZKQEyLShLIetpWjYrliqMtHXlQlaBm8GtXu7oKZzyUmXL6Bn7K:MdFDLktoXFXJA8GRVxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658854540, "uuid": "b07e63e1-2c8c-43b1-a41d-59b829acd6a1", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658854540, "uuid": "5f0ffa5c-38e1-4751-b4fc-4ac754554115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854540, "uuid": "e0910a08-0bad-4218-8bdc-cf69ce1ac68f", "value": "A77E1A86EE430F1CB33167F4AC5C60D825882E5B0F2B0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ad6ef8-0cdf-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658838887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838887, "uuid": "bdaf7955-ba7f-4148-97ad-3ce57f0dfb46", "comment": "Malware payload", "value": "6dfddca9b60b39dabba9f3fa16c1acb7", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838887, "uuid": "9ec1441b-b1fa-49aa-956a-2d6d3202b697", "comment": "Malware payload", "value": "a7d56ae9f2d3e4cc80541979d53ac6f68ebfc688f45651e9f485b9353df1dd47", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838887, "uuid": "68b86689-d179-4e95-9e03-f0021aa141cd", "comment": "Malware payload", "value": "ae8da1ba4a1768f59a97bbcfa4a5b5ccdf96e85d", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838887, "uuid": "36814d50-3c97-43eb-99d9-38eb2cbf38a8", "comment": "Malware payload", "value": "d24cb90fed65d564f15e87f45f699f43961e412fe02bdf670f829250ff309d270b91b16305ad431b6fa2ed8e2b7d518d", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838887, "uuid": "771b9a6b-c183-46d2-9664-bd1bbb7f2040", "value": "T15E76331CCA079ECACC4541354EE30F606B7D816AD84DA7034739742FECEBBC9A5A5E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838887, "uuid": "fc92cfb3-e014-4732-b7aa-dbf3128321a3", "value": "196608:Cks5NWpWnRNrwiqJxYE+PY0QIuGHakGJG/wVhAAiLZHdpV7g:CksrWonPwiqJNgY0iGHakW0Oh3i9Hz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658838887, "uuid": "809a2386-4070-4204-97be-b0326705f0f8", "value": 7332575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658838887, "uuid": "1e52b6f3-455c-46aa-b98c-998a80e19033", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838887, "uuid": "71b454b7-7db8-4291-b758-102c3ecbae56", "value": "nogale2esp_out.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a1fb59-0cfd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658851656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851656, "uuid": "176b2463-cbfe-4743-806a-8abe460289dd", "comment": "Malware payload (Formbook)", "value": "676703938dcc35c7ff494355bc00d067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851656, "uuid": "544485a3-5084-4990-9009-50c9eac98d75", "comment": "Malware payload (Formbook)", "value": "a8ee338d80b7be8f4e1bc7b6fa10890a9f5575ea4ea8fa3db547f9f0abc22c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851656, "uuid": "80516bd0-34b6-4b05-8227-700b423dbc59", "comment": "Malware payload (Formbook)", "value": "70156cc2b5d2b93045c0efe6511557cd00ae373a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851656, "uuid": "7e8258e1-5455-4b7e-a727-15380349ec8f", "comment": "Malware payload (Formbook)", "value": "1967ca44469db5040083d7e193aa60da92c1724997a44444be5e60b2d833acfc65022428ec61ce8d897d8f4619b1f18b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851656, "uuid": "5948d4aa-e730-48cd-8013-615e180a3a1d", "value": "T188A526BA57BAEA89E4401A39B97D93EF9B3D4C81363C90738344354C9DBB32B36C4459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851656, "uuid": "f3bed75b-d30a-46fe-b3b2-2e87f8ad90e6", "value": "3c28622a06e2435b829e7b3d3e133da6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851656, "uuid": "9f9856bc-cd0f-43c1-9a82-b7db7a9339a9", "value": "24576:7ABseC7Q+9z3uCeOn6RKjBc0Osczw4bR8nqS/+7U1dnShMSL7wvu+nZFNd:7A6Nn3peE+vzn8n9G6dnSiS7wvhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851656, "uuid": "ee8b8e06-1134-48c3-afc0-15b87072e4ef", "value": 2234320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851656, "uuid": "6c8f8f20-21f8-400c-bd29-554497ccea7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851656, "uuid": "2054f1d1-a3f5-402b-ae35-dec4661a9c6b", "value": "676703938dcc35c7ff494355bc00d067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5942bac3-0cb6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658821283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821283, "uuid": "18599a4d-14d4-49d7-8d12-afe35b33957a", "comment": "Malware payload (Formbook)", "value": "75a5f67a93188e3e6650c64fade60cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821283, "uuid": "6a3d08a7-71a4-4245-a215-1a0129079f4b", "comment": "Malware payload (Formbook)", "value": "aae769c2b3b5b48de27bcb540924e2fa02b761e8af8db3d76e8ccc1c311d9596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821283, "uuid": "6bf2d73e-4d23-4747-929b-32838cf1180b", "comment": "Malware payload (Formbook)", "value": "74bd46b60a683cf476489626b33375811d3372b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821283, "uuid": "ef0d9543-4cb8-4e73-8786-fa290a6d3442", "comment": "Malware payload (Formbook)", "value": "2d66a71a458467ea695f6250cba5fbbd3e7d782bfcc3b08482786bdbe857197ce144ba869dd1a89b35637acfbee2ec7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821283, "uuid": "c396af1c-2e8d-44ee-9300-4ad36845b3a6", "value": "T19E94B1F872E1F27EC81582316A247C7093F14CA1CD71AA12ECDEF9E49534EF66B21256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821283, "uuid": "92ddf84d-c35d-408b-9104-3aeb0fe4fd16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821283, "uuid": "57d2636d-a2dd-4705-845b-f8bca9fff6e0", "value": "6144:Nkk+AuO8FhzTNT0nzDc+gW83jgY7bRduHNZl3qLDhogLXax:NpkrFNTNMDc+gW8zgQlUZl3qLDhTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821283, "uuid": "9f639777-16c3-4487-b240-6dc28d47f70a", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821283, "uuid": "edb7f514-95cc-4efc-baa6-5310d72ad764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821283, "uuid": "57a5af8d-bebe-44ca-9f6a-86aa41b7ad19", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3031.5976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeb5f24-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658824910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824910, "uuid": "8bd721e8-5f0f-48d2-8c85-98d1ba0aeac0", "comment": "Malware payload (AgentTesla)", "value": "d733321c2ce1799853876bce65256b47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824910, "uuid": "1a8b908d-0617-4fd8-a1f2-f5a5a50f0262", "comment": "Malware payload (AgentTesla)", "value": "ab2bcb61ea3c3b5fe9dd5ee58339b6675e40f7adcafa134dbeaae86e4a616906", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824910, "uuid": "0f1fe879-8e0b-4ea1-97f8-f05d5517e3f6", "comment": "Malware payload (AgentTesla)", "value": "4d9d5a75503610962e59b7306137601190cb431d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824910, "uuid": "a2a89e56-61ca-4ee2-9ed4-0466f36d0293", "comment": "Malware payload (AgentTesla)", "value": "369d4ab6f7b68de1548d12f322e6aa4b90f666d581a022e03719a22af8acafb43254f261bbb42ccfcf5ecfcf8b4c0976", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824910, "uuid": "ccf7fe25-b9c9-41ec-8c2f-7547175b9cf5", "value": "T1878490F872E0F27EC81582316A247C7097F15CA1DD71A916ECDEF8E48634EF62B21216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824910, "uuid": "d060e175-b04e-490e-af93-e821447af381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824910, "uuid": "64f4ea14-14bc-4133-94ad-b2224c195725", "value": "6144:spwTaPL38ONZMuP2GgHty0wqIKh2PTNoMO0sogLXax:/Utqun0c0ibPTNrO0sTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824910, "uuid": "ae38b55d-bec1-45a9-82d3-2696052684ac", "value": 403488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824910, "uuid": "ccc7aaaa-fde2-4b7e-91d0-972bea979bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824910, "uuid": "500a46fa-cb8e-4d8c-bd40-685f00b6791b", "value": "SecuriteInfo.com.Variant.Barys.317164.23232.29326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb728c2-0ced-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658844937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844937, "uuid": "6f2a84e8-3fdd-4bdf-a2cf-7edfbe322d97", "comment": "Malware payload (RemcosRAT)", "value": "2a51fbd9d473ce4f80d83353fd3a6e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844937, "uuid": "aecc0a9e-29dc-407a-b615-02e85f74c5e1", "comment": "Malware payload (RemcosRAT)", "value": "abd503157381c6062796decd691d01eb97cf413a86509087e602179707e913ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844937, "uuid": "d5040087-8f86-46fa-a63a-d9042c3061d5", "comment": "Malware payload (RemcosRAT)", "value": "8c72ff527405e7f89ff5a1c532a4c402a004720a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844937, "uuid": "62dfbb35-2d49-4229-b4d1-3dd2bc575387", "comment": "Malware payload (RemcosRAT)", "value": "897ce3040670a81b26958dd6fceb0ab54597efc9dc47b489147acf9444854874de1723d2d0659a0601b52aa2c5066c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844937, "uuid": "77666c3e-8ae5-4d20-91f8-fe46dba63941", "value": "T117259E31E2D25433D1B3277D9D5B8665A93A7E013A38D8893BE95D8C5FFA68078343C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844937, "uuid": "8e262483-a386-4832-9558-eb6c276a985a", "value": "205f6434858f3f8cc9e8b96d094507a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844937, "uuid": "c4b1caad-a866-440e-9860-7da6ad19ffb4", "value": "24576:5DA1mchKTwkH17WtMBhiUDxvHiMYStUtVSn52pAf2rDNtl2aCHX:5Dhc8ZPbVI5Sn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658844937, "uuid": "02e1f3e2-5244-4a0c-aa35-d50984ed2a63", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658844937, "uuid": "f8f8e604-5b10-4a7c-b601-71782a124f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844937, "uuid": "4a362301-eb8d-4283-bc2d-796fe1268849", "value": "Delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65cb1ae-0cd1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1658833063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833063, "uuid": "18b65265-7ac6-436b-99fb-51561570f26a", "comment": "Malware payload (Stop)", "value": "585c17cafcc08de2a7499d1fb66aead1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833063, "uuid": "3fa04368-37ce-4d65-9154-640c9a02f52a", "comment": "Malware payload (Stop)", "value": "abf8041d39b8dce7020ab090107223a7a5d3d13bc9f933dc93fc4ecc5c4af709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833063, "uuid": "0e01cf3d-2785-4521-8666-feee611862c4", "comment": "Malware payload (Stop)", "value": "a49a216593f57691dcf7dab4b1a98b4cf444d0f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658833063, "uuid": "034a9bbe-9332-4c19-85ed-33c334b3d551", "comment": "Malware payload (Stop)", "value": "8105f545f95d925cc08fe3695d6f7db452af38c517caeafd5e7bb7ea750be64022ff75a3f38bad74df00fc7dbf34538a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833063, "uuid": "6a813e82-cfa4-4027-ac60-2f653cc52fcd", "value": "T1D1050280A760D03DF17B02F579B5C2ACB52EBEA09B2424CF22D52BEE56386D4DC75247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833063, "uuid": "79c364a7-d1d8-4577-819d-898f3d9c9451", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833063, "uuid": "e5b5490c-e519-4d0b-99fe-8061fe430901", "value": "12288:IUb2Tr0CnMkJUfyoDWUK/Amb4QuATbbVeT4FDSXVuNjjd4aTTlApU6oeac4SM1x:+H1VrobsUrmV1WoX4FUDeL4t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658833063, "uuid": "ddeba524-ad60-40fe-b645-dc89cdc74d4d", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658833063, "uuid": "34908d88-33d2-457c-8837-a2670cbe80b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658833063, "uuid": "3724fbc5-92cc-4d82-ad0a-9ba41cf7a38b", "value": "585c17cafcc08de2a7499d1fb66aead1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094a6a6b-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (AZORult)", "timestamp": 1658851214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851214, "uuid": "1d8e1693-1e40-44a7-8c6c-0ae6467c9afe", "comment": "Malware payload (AZORult)", "value": "4173b390a7062ccea8070cd0334fe9f2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851214, "uuid": "7d83c135-cd8c-4719-a26b-8660b7b3cc98", "comment": "Malware payload (AZORult)", "value": "ac05aaf10b6b112f0279ef5b5671079ab2343637fa903d587bb04dc76c829fa0", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851214, "uuid": "567663d7-b156-4e2a-a192-3cae5d548615", "comment": "Malware payload (AZORult)", "value": "24afaa47a3a73dc6384c08f2934758b229eb0604", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851214, "uuid": "a03a1400-d5ca-4561-8a5a-fcdc9c98afc3", "comment": "Malware payload (AZORult)", "value": "498588798bad7730b4d7c49214fa2727ba62b022886eb505b234a1f77191795256f7b5ef8804e12b2075d8ead88d8c5b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851214, "uuid": "d1f90c9e-9861-44bf-a2b0-b29a74b32c25", "value": "T1AD15012D67B55F07DDBD87F98464051047B43A263643E7AC8EC2A0ED3F22B616A06F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851214, "uuid": "acdb6836-d125-4798-8c2b-0861cb9caff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851214, "uuid": "9ea6ee52-227c-4a7a-a332-6f5fb1336b32", "value": "24576:qcEw4UZvybcv8v1e9kDr1lBKF0cpzqG1x8P:qcE6d8UyDPIF0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851214, "uuid": "00a081f5-d933-40c7-b8f2-dd5fd2de0603", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851214, "uuid": "cd5fccee-fb5e-489a-a282-e66ab7901a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851214, "uuid": "773a3bcc-b5c8-470b-8116-4e3f699777de", "value": "4173b390a7062ccea8070cd0334fe9f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8434f1b1-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848843, "uuid": "4492dc8d-a039-4ab9-97df-f899a9f4bb14", "comment": "Malware payload (SnakeKeylogger)", "value": "d72bfbefd22636cf52677f6b2985d96a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848843, "uuid": "508b5e13-a5be-482b-8e22-168f91292f1b", "comment": "Malware payload (SnakeKeylogger)", "value": "acb835d57595004cc49ddc61bc9745c60507a9457f210363f0e15279fe3b687b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848843, "uuid": "d2ed060a-dbec-47e6-ba93-af443b8bb734", "comment": "Malware payload (SnakeKeylogger)", "value": "90c88be80aee5881b3bd4c5a46ed0de83d0b14a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848843, "uuid": "096042fe-6abb-4adf-a8e8-651308fad15f", "comment": "Malware payload (SnakeKeylogger)", "value": "184c7c9be543529dae8f64cb009b3d9e157f59e678ba839ab61239bc672cf1d574f3f801ec7c3f9eb02cdf7204ead643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848843, "uuid": "10497b3d-8af5-4a81-ac25-f5f075dab1e3", "value": "T10BB49D1134CB7714EB39F77812E4A060AFF5AC23D209E66D2EA533968777E604E72523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848843, "uuid": "5589b2ba-4c44-4a30-8d12-266184a93db2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848843, "uuid": "c002a23d-0b6d-4212-8793-b92d6ceaf4be", "value": "12288:aUMKujjixgV2iNDwnx2nl1ywEWmBSv6a8Yuub3orSJ:ajixgV1/l0RkFUW3yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848843, "uuid": "3ff48a8a-0f03-4148-98fd-9634c5522d08", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848843, "uuid": "5763d7ff-285f-45de-93d5-2fd43e720958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848843, "uuid": "f37fedba-4884-4b33-88a5-b2699c91c803", "value": "1502192-1 RVOOIN-16-0077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad04776f-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843328, "uuid": "47c7c3a8-d57a-4d1e-8d9f-85a5356104e1", "comment": "Malware payload (Mirai)", "value": "eb6600f11e06c3a885725e4d3f2e25c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843328, "uuid": "c3f6cf6c-07f0-4da1-82da-f68aa4b5b046", "comment": "Malware payload (Mirai)", "value": "ae0278addecbbe9652e02e112c86434d8d3f14f79f82018d2106b4551ae020cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843328, "uuid": "cf93e4aa-974f-47d6-9105-2c6a9db8df75", "comment": "Malware payload (Mirai)", "value": "a6bbda77c30e81f74e43e36296bf610859d2999e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843328, "uuid": "d0284110-058d-4bfe-961e-379b9bb6e59e", "comment": "Malware payload (Mirai)", "value": "a5981e4345760367e9edca2cc35943675df9db6e9e987e6551509ab05b44aea0674e8b6a50a54a9317166cb2156e7bfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843328, "uuid": "ee632dc4-c1c7-4d0e-bfbf-37b9a5eed48a", "value": "T1AF331986BC919A12C9D42377F61E01CD372663E9E1DF32039E226F1177CA92F0E6B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843328, "uuid": "8da56ecb-54cf-4003-8b2d-7c1c75ce9590", "value": "768:pQgyxbL/yQAuL8U0o6pHvguc6et7SD+UMonkrt7BBNOdrSPvmmxsL:fyxbLaQAu8U0o6pYn6et7S6UMuSGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843328, "uuid": "a8b97fbc-07b4-4d66-9901-5b4d9a280299", "value": 54868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843328, "uuid": "65db8e33-b46f-4276-99ab-07a05880937a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843328, "uuid": "9280a985-0a41-463e-9bf3-15963f56282f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2270567-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658818104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818104, "uuid": "30320b00-99c5-41e4-af1f-8212c3d6a6f8", "comment": "Malware payload (Mirai)", "value": "affd5eed8194b3c72a3f366de993403c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818104, "uuid": "104bcb42-6c93-47c3-b84d-d9fb45ef04d9", "comment": "Malware payload (Mirai)", "value": "ae048d18df0ff004e4110dd8d62e8b523c94647c1df072f195cbe30728d8f460", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818104, "uuid": "e219c63a-8246-40d6-bdcc-b390221eeed9", "comment": "Malware payload (Mirai)", "value": "3a501799d49d4c47e4d2aea19fc27bb61f036995", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818104, "uuid": "0691c021-bb41-4aed-90c0-b9fd5c91434b", "comment": "Malware payload (Mirai)", "value": "50e9dd40ae39659a4e8a5db49c525e4a0539060806ebdbba12a84bdf53e2d2a55b909426948639d31183468ccb7e0345", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818104, "uuid": "c22ae4c0-2e74-4bca-a4af-86ad229072c0", "value": "T1AFB2D18DE561DE24EFA6CDB81C69DED363F00B8D37924CE356C67B92C22281B1108DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818104, "uuid": "29a5ef61-d791-4656-8eae-52d61a501540", "value": "384:J5apFfCF9dR4Y1/FLmh5lhIQ5KcSJVyC1gJFkhZsilsBKDM4uVcqgw05VxJw:fapFfCdLFGBDigJF6KPj4uVcqgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818104, "uuid": "8e6a8497-eaa3-47f4-850f-e14fbc2b5ed0", "value": 24520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818104, "uuid": "414bc05c-4cd9-4e05-b1a0-13f7afdfcb86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818104, "uuid": "b6683b06-425c-4d84-9138-8bc469ede2a6", "value": "affd5eed8194b3c72a3f366de993403c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30558c2d-0cc5-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1658827657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827657, "uuid": "ad38d1a1-4b02-4d73-a770-ebb51fb6d008", "comment": "Malware payload (DCRat)", "value": "a6ede46f5a6c3e2c8e163b741f29c12b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827657, "uuid": "c3a49cd3-1bbb-4fb0-8f29-4916407593aa", "comment": "Malware payload (DCRat)", "value": "ae051d13e67b83eec1da1ea53079eabb0e17c565d430ea7c1bd6c88a9648005f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827657, "uuid": "08ee4188-f2d3-438d-8a1f-421a97b6c89e", "comment": "Malware payload (DCRat)", "value": "a5d9355bb3353372c6805709a69efdf2e61d1eb1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827657, "uuid": "69966fc7-cc39-42c0-9bb8-561176bc150b", "comment": "Malware payload (DCRat)", "value": "0206f996c0982ea3d6aaa5bdf90a832d18c9ee7b580b0142cbfaae95ecfff21cfa1fadf70902d12a68d3e08e90c9e239", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827657, "uuid": "4197b00d-04c2-4363-b9d6-f8646b14f553", "value": "T1E975331CF15B7CBDCF89727288005B22AFBC03FC727A9A5A3146CD215EA7904E65993C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827657, "uuid": "3fba4e1e-5e64-4102-b2da-4334c4bac8d2", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827657, "uuid": "6bac4184-5f20-4a35-b30e-0d89a907389d", "value": "49152:VRtv+fl596vbbaBikwVbXeLgSdNRCEEutL:VRtv+NEoifbXLSdqWtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827657, "uuid": "a827dca9-ef0a-4212-ad2e-d68d94d6613a", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827657, "uuid": "dafdfb1e-febd-4a94-b774-bd12bfb402fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827657, "uuid": "190c5b1e-ca31-4def-8d85-db22b33c718b", "value": "AE051D13E67B83EEC1DA1EA53079EABB0E17C565D430E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b462b575-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Renamer)", "timestamp": 1658828738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828738, "uuid": "d46a5002-0e2f-4dc3-931a-b713e3e5b3ad", "comment": "Malware payload (Renamer)", "value": "72b5de5cabd2579cae14a9d63fd98237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828738, "uuid": "ff39473c-6b02-4d3b-a30f-b6cf2282c703", "comment": "Malware payload (Renamer)", "value": "ae619db6b3fd266a7f87badbf72ef0329357ef5aeb621a755170457546bac7a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828738, "uuid": "b2aafc67-a5a6-4167-a210-552f9df83866", "comment": "Malware payload (Renamer)", "value": "1b4c6077eaaa82cbcfb97400da86e2870d6784e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828738, "uuid": "b24996e8-8731-40d1-a829-eb989cf7d845", "comment": "Malware payload (Renamer)", "value": "8ff90451469b99bf5318e87a1f9293f4ebb4b3017c1e028a61d29ab859fe67698abe82a7c050d40fa6a5d21b332ea8b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828738, "uuid": "6b52f302-be78-4416-bc20-192eb1b59385", "value": "T1FD95DFAC721075DFC82BC6B5CA645C60A6603C7A871BC20F901775E99EBEB93CE054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828738, "uuid": "495deb7b-eeb4-48c3-af7a-af0dc64a0724", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828738, "uuid": "aadd3a7f-e6c7-442b-a3d4-7965ebfc3d62", "value": "49152:s6d8kf/LAcwgSqg/zoBf1X6ySVkBsMJ5mHW:s6d8kfzvl/QefJmVSsMJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828738, "uuid": "cccb8b67-d964-4866-adaa-bb0d5f9944ff", "value": 1929216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828738, "uuid": "de67ddb9-78b8-4456-a16b-46d88bb42afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828738, "uuid": "11c5bf64-a5c8-45ce-a4d7-5b87df75bf32", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22996.6116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40429fe9-0cec-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658844434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844434, "uuid": "1a9687b2-1008-42b1-a3d8-f14655f28286", "comment": "Malware payload (RedLineStealer)", "value": "6a56a2a6c2901b874e28c4dbd32d8be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844434, "uuid": "d2f3d47e-95ab-486d-98cd-f4fa3256fc8e", "comment": "Malware payload (RedLineStealer)", "value": "ae79b0881e1f217e27befb5871cf545ca1d91447868d4b6b17dac41191f420a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844434, "uuid": "80618cad-513c-407e-921e-5e96680e1c46", "comment": "Malware payload (RedLineStealer)", "value": "6fd78870a63c1a2125cb8cfc609ff6d4d335a708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844434, "uuid": "88f52862-daef-4d66-9790-8ccdcf51ca80", "comment": "Malware payload (RedLineStealer)", "value": "9080911072c6a37cc47c2b62aa17440e004359430b20fe95e133234794d8c972e9bfd08b358bd8ca52a4cff4271bf6bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844434, "uuid": "ee4956d7-a2f9-47c2-a9ba-a6f01670383c", "value": "T119C51A135A8B0E75DDD27BB4A1CB633BA734ED30CA2A9B7BF608C43559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844434, "uuid": "87ca8be8-9618-4114-aec9-b03d725d08bd", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844434, "uuid": "7469eb10-2822-4618-87dc-81a4ce76b15e", "value": "24576:F6dlzUlhGCGxemYkYTX3yKL6oMEPdurMlCos5PHWa/FfuHLazdri3l3RuQ553131:4GhGVxiP2+a/FfuH+zs3l3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658844434, "uuid": "265a86a1-828e-4fda-b029-9de77827482d", "value": 2581441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658844434, "uuid": "ccfff5d3-2220-4304-a710-86ace301e6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844434, "uuid": "fee6e5b2-20a9-44e3-8324-a1cb34ffe6d7", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f50aa66-0cf9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658849963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849963, "uuid": "bb741e44-a94f-490f-a44b-1664b3f0a9ff", "comment": "Malware payload (Mirai)", "value": "3d5646579cced19abd9efd6d59d9fc15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849963, "uuid": "6b20fd97-9e2e-4fed-a384-3d26fc21738f", "comment": "Malware payload (Mirai)", "value": "b02e005aa2b3718fdf3e8cfd89887106bf85150cf20d80dfa5566c4f0ae5a2ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849963, "uuid": "15394477-c110-40e7-a1dd-a3a10523a59d", "comment": "Malware payload (Mirai)", "value": "87e247eec2dde3850fb142c1d15c54d52e775578", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849963, "uuid": "fd6a8f9c-7d7c-400d-9140-cb1e14fa0dce", "comment": "Malware payload (Mirai)", "value": "9c7b0827aca84a96292416df2b1007efdd3b0074683beac4d3de66f278525ada0df671456b37f264a22ffe953e8552d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849963, "uuid": "67c7ed0c-d5cb-421a-9f83-c034894550f6", "value": "T199330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849963, "uuid": "d63d5118-6dc5-4483-adc8-05fa4d7faa6f", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oGX:r/hqaJM53eqK806MHdMfQXoHuCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849963, "uuid": "be91acae-4b28-486b-917b-7aa4c97bde31", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849963, "uuid": "9a148834-c328-4ba1-8af5-edf3ebcb05d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849963, "uuid": "e1ab91d0-365a-49c3-b660-f485689b5480", "value": "3d5646579cced19abd9efd6d59d9fc15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af376af-0cd5-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658834466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834466, "uuid": "315a326a-2975-47cf-b93d-3437894b22f0", "comment": "Malware payload (AsyncRAT)", "value": "d44103bc31766029c20cac9568922910", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834466, "uuid": "254074f6-724c-4a2d-b165-ebe8b1d8f2e6", "comment": "Malware payload (AsyncRAT)", "value": "b0cb9861f7fcefd94e85df0d51a169104aeaeb160a172559a28d701da9a50eb6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834466, "uuid": "88278115-f2e2-45eb-88c5-e73039a210db", "comment": "Malware payload (AsyncRAT)", "value": "bdc97a50e1503a293d24a14a8ab927955e4f1dcd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834466, "uuid": "8d1b7dfe-e589-4cc8-96f7-4a7bb05b50f1", "comment": "Malware payload (AsyncRAT)", "value": "9734b142113af41b3e9c43ceae939787c2f56a947fae24b203a1590b6a1efb9d7b23e7030f8036aa592685bb3204290c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834466, "uuid": "7dd133eb-fa45-436c-ae23-6fddd9c0ef87", "value": "T100251633650E5642C0382537D8811D2962A2BF896E2EDE1FCDF63F5F877A3592B6C424", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834466, "uuid": "67a1d657-616b-40a3-933f-2e8c95808546", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834466, "uuid": "4bcd298f-1e1f-4d1d-9c37-1937481c5b19", "value": "12288:eCpvUaUrkI/htzeUaZ8yaNC9IL1Bd44coYjM1ZxUTY2FT45kdcd:pvU0I3zSZ8ySoaaoOM1bUTY64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834466, "uuid": "90e3e505-5b98-41a2-a01d-78943053b293", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834466, "uuid": "3c590030-702f-43b2-a1bf-a74ff45d22ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834466, "uuid": "503edfcd-ec5d-4530-b08a-d39038ee286f", "value": "B0CB9861F7FCEFD94E85DF0D51A169104AEAEB160A172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcdacb1-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827012, "uuid": "4f4f6e84-b792-461d-8356-562c1be6ac1a", "comment": "Malware payload (Mirai)", "value": "7f3c02827b7eb3530336b200c07afcf8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827012, "uuid": "b9a15c81-95fb-4fa6-b8d1-a23bc38379a3", "comment": "Malware payload (Mirai)", "value": "b17d1dc044dda31bfa2cf7cd8e1d7547e0535ad41ee29226c09a5c2cbf0d5585", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827012, "uuid": "7ed964c6-7a6b-4536-8ede-fef4a668948c", "comment": "Malware payload (Mirai)", "value": "2a06acda5f68ac3132f35d98f56727b95efa56f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827012, "uuid": "5a51572c-f640-4095-9afc-3e7236b81820", "comment": "Malware payload (Mirai)", "value": "61f0eb916dd88f57714ba3fde07a05788fd17b9483bb03605ab38210616c6d3085d1e27b77f4841e6f230772c02389a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827012, "uuid": "43979f35-1528-470b-8fe0-7bf6a2c29420", "value": "T126C2E1F451CC55780A180D39F89D48871AAB89B971FBB1312654630DFB6282B62FCACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827012, "uuid": "3a49a189-e6f8-4f6f-980c-dae51834675b", "value": "768:/2XiteGccFn8FMeZm4qHlrdtw2CfQjiEs3Uozhq:/BeG9F8iAmNlrdO2CNhzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827012, "uuid": "fbf06502-1fbf-466a-84bf-ddd6e55d1556", "value": 28004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827012, "uuid": "cac16c04-9368-460f-a83e-2f935c7f7c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827012, "uuid": "09feeba9-a2fb-48b0-bb2e-f8d612e72a5c", "value": "home.arm5-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a3ce42-0d02-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658853884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853884, "uuid": "399981d4-6171-4332-b5a1-b23354e3c3b8", "comment": "Malware payload", "value": "9750ebcd0d10b9a0d96990cbdc297500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853884, "uuid": "6897f95e-017e-49a7-9fdb-23919e99d170", "comment": "Malware payload", "value": "b287f43cd32d92a3910870b3c1d5993cca81546bb3e3a86d390219bf9db9afe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853884, "uuid": "0564057c-9b79-4e0a-8667-884f5dd23be3", "comment": "Malware payload", "value": "4fc2d90267f5d6619a91061dbbadb71a92f9d2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853884, "uuid": "f552968f-f083-4a91-a96e-9f50749c7cd1", "comment": "Malware payload", "value": "dc199e31ca852dbef7e18dc879d80fc4935d50994510244897f601c4278ea38741f48aa2d3d58c22b1ce2d76a24cde9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853884, "uuid": "73314bf2-d8f4-4536-84c0-2e1fd4cf8702", "value": "T130F24106E6F94160D1FABA70597A07344A35BC6A7D79C76F2640FF0E1932B109E6332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853884, "uuid": "7ea3bf00-6e27-4ade-8c61-01402f887fef", "value": "5e2b037fa3be27abde165796899c636b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853884, "uuid": "2d31a95f-3627-4687-8851-8ba4e2b2fb3f", "value": "384:kEf1jtIN2eIA4ctWjw1kPhIVt+t+UjvWd:kEf1hIN25bctWmyGSSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853884, "uuid": "7d0e0694-a3f9-4dc3-8cd8-a966139f6399", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853884, "uuid": "b923c0e1-0e7a-4b6b-b3fb-16e4a4b57ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853884, "uuid": "f40df409-bb1d-4bc7-9fa9-3db1aea61dbd", "value": "wzd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e5651a-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849227, "uuid": "92701464-1cfb-4a6b-80cc-b82c1269fe20", "comment": "Malware payload", "value": "6da91b62025790d7e65dbe3b061697a6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849227, "uuid": "21eba080-991e-4a87-a887-49b39ef4429b", "comment": "Malware payload", "value": "b34b9fa2da261d4c15efa66548dee6f597a3c2f9f57add9842044813dd9efd53", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849227, "uuid": "9036156d-896b-41ce-9f05-83ba464f9d90", "comment": "Malware payload", "value": "34570dd5dccb2ea21eb318bf4564c6e4619cf210", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849227, "uuid": "a1d7a0f7-742f-42f2-bc2c-471e8d1785ac", "comment": "Malware payload", "value": "28e5a396e280608421c67cae2fbdfa2abae24e97942932ddd30b4565f9fdaffdfd406dba5587e58aa9af9c9419795198", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849227, "uuid": "025a07c2-313a-45d9-b98f-6fd29f5b7659", "value": "T10C43D0E2CFEE5F00DE61C6BCDE0D09B6A0565D332946E7463D91B71C153ACF982D0A28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849227, "uuid": "6e1797da-48a9-4fcb-acad-58272e29717c", "value": "1536:0hQoMiFVyZP+K5ZNnEOxgMop5w+4KEdXSzZkZIqY:0h7pFMP5RgMonwEFkZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849227, "uuid": "a8b841c5-e3db-42fb-bd94-04c5c3b62d83", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849227, "uuid": "1d83f637-f967-42c1-921b-89745ea2b7df", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849227, "uuid": "ce50eccc-ecba-4309-bfe3-79ef5d096471", "value": "NEW SUPPLIER REGISTRATION FORM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d386871b-0cad-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658817623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817623, "uuid": "73fd5fb0-dbc9-4c8a-a003-122c93714eb9", "comment": "Malware payload (Loki)", "value": "41741db84df8679e87aa8a3a6bed7d25", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817623, "uuid": "ab1abd23-a565-488e-b96e-1b22fe355c25", "comment": "Malware payload (Loki)", "value": "b389212c86fabef331958f3572bbd404a715b71817fed0c70c14c4300373c75f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817623, "uuid": "a44acfce-9898-46a6-956d-7fbdf1f58f39", "comment": "Malware payload (Loki)", "value": "3392f1e1180ee616f3fd4f6ec088a6477b1214c9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817623, "uuid": "fc5df02e-14cb-4978-9899-c78e4c5d5956", "comment": "Malware payload (Loki)", "value": "1daf0ec83f75ac6a1b8cd3638eedc08cf92379cdc4862235069eab4f8e52ab1b7fa2dfa3af0df796402832f6d02df75d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817623, "uuid": "40820388-0689-419c-9f38-954a2c169725", "value": "T113328DABC773282EC38741394480023AEA24EBDB5A1E17976E78F59949E19CFE70031D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817623, "uuid": "4a030f94-3045-4d68-b0f4-c8dde8465e34", "value": "192:J2TdsiXavB1sw+aNf9WVWJY8ULTEBPMM//FYywPuyPWbB0pf:JydscHwWEJY8wIpMEYyryPGkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817623, "uuid": "c0dfb10d-23ee-4b3e-8bbd-1217ef18d295", "value": 11203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817623, "uuid": "0a350945-04b3-4b2d-ac9a-9b6513039729", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817623, "uuid": "780483aa-0472-4a69-a9b6-2f2caece98b1", "value": "Transaction Swift 0001.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfe1b09-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824778, "uuid": "0216c7d8-ba1d-40c3-b77c-462243460b67", "comment": "Malware payload (Formbook)", "value": "ae0adfc593e1593c056b2caf83a8eb56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824778, "uuid": "3e9755e0-4815-4352-ac64-9a07065525ec", "comment": "Malware payload (Formbook)", "value": "b4c92fea2acb348367787f04588a082a0071187db0ebf990c0fc01cb127db391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824778, "uuid": "4a078be0-18de-4c9e-a68f-1833075b59a5", "comment": "Malware payload (Formbook)", "value": "9f080d317562cb9de2117ae8e1c4a7dd84d34b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824778, "uuid": "f573a892-0147-47b0-8c9d-e02f976e4108", "comment": "Malware payload (Formbook)", "value": "0fcf38ad88940afc7dd8711d2f861488601fc0d061abfd122d54ff0d569ec938d3bd1e65b27955fad1c5923984c5ffb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824778, "uuid": "6b9b3055-7f87-4c8a-8bc1-283b7d164e77", "value": "T1D4B47E2CFA0E4672FE9E90304D010A54BBE70B076A50AA9297DF35CAB74F4F5BD44D89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824778, "uuid": "c852987c-030d-40a7-b45e-e1505fcbb775", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824778, "uuid": "1581dcd3-4cc0-4b39-b6ab-12206b91ad70", "value": "12288:EwXaXztXJQXbY7PEn1PYkVXmu/INLFs9E:wRXWLnPYKmrFs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824778, "uuid": "a6cb63e9-0366-4ed5-86fe-347ff001e889", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824778, "uuid": "c30c58c7-c67d-4c34-b84b-ceec4ce53d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824778, "uuid": "06240f7a-acbf-428f-814a-60bda2c88530", "value": "MV GOLDEN STAR - VSL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3f2b59-0cb5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658820810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820810, "uuid": "ae24e091-e769-44e2-b80b-769af8741371", "comment": "Malware payload", "value": "43bcd8f7587a8a649abebc7d75cfef9a", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820810, "uuid": "487ec0ae-6cca-4951-abe3-2331cc301272", "comment": "Malware payload", "value": "b74be8f3f26d71fb5739f1b54f7c7d24db27585acdf33d2f79d94ea898514563", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820810, "uuid": "59e382ad-3bbf-464c-8527-bf389318f049", "comment": "Malware payload", "value": "c74e7b5c25e2ca5dc1a38fe3b65cc7c5068f63f8", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820810, "uuid": "7766d00d-5086-40ef-b3db-67da773f999f", "comment": "Malware payload", "value": "a7ff3aed7b0e2fa86f3582edc82f91424129af72bdeca2bd1b516dcbe05342c09902318f11cb3bd025c3cedafe1ef433", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820810, "uuid": "3378c47d-09b5-4145-95fb-000290923772", "value": "T12B34F103DE189686D42A87E03F1B2E5C6F9BB72D59C162EF14190DCB3C64A251DCE23E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820810, "uuid": "9366161f-a1dd-4721-ac58-81db93bf4550", "value": "6144:/YBFTeM8offuCa8VdKvZizoGF0qeRlOVcUwADAij3Jv:/KFTH8anOvZ0ox/gVcUH0Uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820810, "uuid": "a4a51c32-2f14-40f5-8e6f-5ac75a5d3f88", "value": 234367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820810, "uuid": "5ca7dcc4-faca-4889-b295-bd7270bd0164", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820810, "uuid": "15ad6a55-5411-4828-9705-4d11b8aa4bfc", "value": "b74be8f3f26d71fb5739f1b54f7c7d24db27585acdf33d2f79d94ea898514563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6915d573-0cb1-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658819163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819163, "uuid": "48605f87-3999-4af8-a92e-3e20478d1a7c", "comment": "Malware payload (RedLineStealer)", "value": "02d32cc41b97e44c145cf1f99dcb10c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819163, "uuid": "5a181088-1bbd-417c-989e-269aaa66322a", "comment": "Malware payload (RedLineStealer)", "value": "b8461bb781c18b61c2d79f310762e51b359d8cd438d001bc70d355801083c28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819163, "uuid": "87f9b233-e7a0-442a-ad8b-3bed40508aa0", "comment": "Malware payload (RedLineStealer)", "value": "045f5bd52e5f0b88b4fbb5c3169df423e0697800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658819163, "uuid": "61e6776b-f0f9-4f4a-8936-6b27bebf93e3", "comment": "Malware payload (RedLineStealer)", "value": "45c7b33f1647695c4d622219c7e807adc55d62ad8eebfc311a34fda3f144aacb46134a27eba15170069999c62c41e5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819163, "uuid": "c2f50caf-2861-497c-acfb-10b5e8f3983c", "value": "T17394C040BA60C03DF1B712F57976C3A87639BDE0AB2055CB22D63ADE16396D4ECB5207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819163, "uuid": "713da4b5-6f6d-43d0-9723-097e2b6833b5", "value": "e6c3aa777d2861625d0bcdf9e9a3689d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819163, "uuid": "b295d739-24de-46e6-b574-fd967987cf3e", "value": "12288:yBqBW3zZO0IKtRoKk/NdDzJTBdWJv3QF0FWgN+Ey:PBW3zZOm4r/N1vdPF8N+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658819163, "uuid": "6e626e65-3190-4e1c-9a02-7de9149746ae", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658819163, "uuid": "e4ad3e4a-a6a9-42c5-9d7d-effcd78c9a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658819163, "uuid": "c7b7e565-b8f9-41f4-a093-87029cda289f", "value": "02d32cc41b97e44c145cf1f99dcb10c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24315b67-0cf9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658849971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849971, "uuid": "8b347c0c-c55d-4165-94ca-d138f3abaf82", "comment": "Malware payload (Mirai)", "value": "d8e00c04f65a8389a3644c11af97d239", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849971, "uuid": "6c8f5357-7cee-4633-a554-17d390a4bba1", "comment": "Malware payload (Mirai)", "value": "b84c1ce9ae5f44c366252f0157d4d877375e45b7750e2e27a57295873dc2bd2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849971, "uuid": "e3b0c86e-ed94-491e-91cb-71b77d542887", "comment": "Malware payload (Mirai)", "value": "ca8e5c86aca9e2e70652d4bf656191688578fb6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849971, "uuid": "e048f8e3-fd50-4e86-96c1-731e6e22869f", "comment": "Malware payload (Mirai)", "value": "f4894ba822be7c7b726dc9a1fb48dca85a3b0805d712e9886c7c833f0e3aba897472b283f5c2951b6eec1037c60f2e71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849971, "uuid": "9c297300-c2fe-4419-b389-16cdb6f39eed", "value": "T157A2D11576932D65E3ED1C3CC9AA831BF9A71BFC80F5327679411620CD4D20A2E3DA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849971, "uuid": "db7e952f-b47f-4e47-9268-65bc210d2438", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjzeIhymdGUop5ha:UvQn4j+ZO5fKAlxHbs3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849971, "uuid": "0230eaa7-1b35-4118-a023-4c5e9c351087", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849971, "uuid": "710036a9-3ab3-486f-94db-d7fbbf05bac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849971, "uuid": "b49408ac-6153-4dcf-bc58-3d265e267855", "value": "d8e00c04f65a8389a3644c11af97d239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c48f1b8-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658849098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849098, "uuid": "37a9765f-8a1b-439a-a5f7-c74e23d9b3d0", "comment": "Malware payload (Formbook)", "value": "cc978d65785cf5b8ca5cbd5a64ecacb6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849098, "uuid": "da2c462e-3ff4-4061-8ccc-ae16b7b5d3bd", "comment": "Malware payload (Formbook)", "value": "b907c9c426d45a8b29d281197456ecc16b7a65dfebfcb0a1eb2d371166a846f2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849098, "uuid": "c105af48-3f71-410d-bf08-d6822e8729fc", "comment": "Malware payload (Formbook)", "value": "19d2ea8cd587e0335714918d3577f8a2ac6ef829", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849098, "uuid": "e61efc6a-4b4e-4c9f-9ab0-2d9524c0bd7f", "comment": "Malware payload (Formbook)", "value": "006982e51d30451d1ea2423469f814e77d93888a81f1411a4eead11404dfd5404beaa6bfcf5f0e2ef052877fa22e6a5a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849098, "uuid": "2a2ed215-2a79-4f7f-a1a4-41520feb2f0e", "value": "T1A433ADF4F65AC28CEA4217B65CCE0EFD39A53D00921E40B57669F30ED5BA9410A6FB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849098, "uuid": "459490d6-c3c6-4e24-93d6-caca7f78966f", "value": "768:voA+qbkFlha++96viodOg1RvJcK9qErPweP8zyCHVCLL+ORKaSK//bT:vqlQ+O611B7qEr4eP8zZ1mLzd3bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849098, "uuid": "c5a9a457-054f-4590-b91e-d72940f2111a", "value": 50792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849098, "uuid": "fc004df9-b128-44b7-930d-74640f1f800b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849098, "uuid": "ca0c74b1-285b-47f3-9158-0f7515d7185d", "value": "\u041e\u0444\u0435\u0440\u0442\u0430 _SKCMGG.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f0ade2-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824610, "uuid": "82d0cdd5-3cb2-49fc-8bfb-a7610bfbd2c5", "comment": "Malware payload (Formbook)", "value": "4feef265526988a6327425f799af6eec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824610, "uuid": "88bc5a02-9015-47bd-8253-85d821169bf9", "comment": "Malware payload (Formbook)", "value": "b9d1af8276cf63d97d87599d39d3a0f714d184354a095578ba71e7ab1761b2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824610, "uuid": "23637f46-ac65-4b01-8c97-e36be80994a7", "comment": "Malware payload (Formbook)", "value": "3b4c4cf5bee747ba15f1d99994e7b8f070284917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824610, "uuid": "cb449b47-25c4-43bb-b9b9-5678a4b6bda7", "comment": "Malware payload (Formbook)", "value": "968ba98b2ff5cb77e6e4ec9cdc70d6c4765e00334e6531d33b9b3c24571466bfdd0a4093ddd485df3e16c22c80315186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824610, "uuid": "c30af204-4018-44f7-8799-da60cf7d0635", "value": "T1E9940D2D3A011A6EFD2F9230D901290FBBD6CB136360A99E57CB29C6874F4ED5D5BC84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824610, "uuid": "073513e2-8242-4d86-9acf-12333ce50c3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824610, "uuid": "0f7be841-862d-4b8c-a2ce-33e6ed7caf2a", "value": "6144:t6a8C4PDW4NWvGbOcgRL520eJJrGL9ebuwgmC7MVNhs:tJ4p/2B5WJJCJ5wglMPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824610, "uuid": "7effc03f-7c06-4794-8e15-137b5dc55bc5", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824610, "uuid": "289fd225-1dd0-4f26-ab7d-99f4af182ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824610, "uuid": "89094f26-6315-44c6-860e-98771025f9f6", "value": "MV TBN - VSL DESC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20327efb-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848246, "uuid": "0e16c1e4-c881-4261-b0e0-2f5bccd5ed17", "comment": "Malware payload (SnakeKeylogger)", "value": "94124651e57d2650da76f314b86bcf44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848246, "uuid": "ee241df0-ecfd-40dc-83fb-2b85d654582b", "comment": "Malware payload (SnakeKeylogger)", "value": "ba5ddc67958d31e926aabdeb24a6b81ace0d584b05949fd9661d94276f0b5c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848246, "uuid": "f84885d3-cf41-4bca-973c-9565d3c47d89", "comment": "Malware payload (SnakeKeylogger)", "value": "5c06e08fffb449c343301fe18ee4a37c471f9f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848246, "uuid": "1d7e8d66-d7d3-494f-951a-7e7cfa541490", "comment": "Malware payload (SnakeKeylogger)", "value": "794f69685572c0d2dbd1d1f79cd02d50acaa3a2348f895a4ccf26f95cb8bd2dfa0e9412aeaea8856adea645ef5076205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848246, "uuid": "ce39937a-6711-485e-94b0-3887789f6c0d", "value": "T104C4DFA235036A26D6983B34CB11F1F21268AE5DBD75C12E58F2BEAF333D5461D26303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848246, "uuid": "342660ed-b77d-47e6-b953-61e462f57207", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848246, "uuid": "1912ea5b-a1b4-4379-8203-e02ade1ee7bf", "value": "6144:vi14A7jbWTHjHrxsrte3FlOMRtTQ9Zy6KUN/oPziOb+xOWgXjcbUgDg/rmn3:S7jbWTHjHNFhNQ9JKe/0b+xOWgTNgGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848246, "uuid": "aa8b35d4-8fd2-4550-868c-623a85018c9b", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848246, "uuid": "3125580d-f955-4189-83b4-157d2f77b233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848246, "uuid": "9b3deefe-3293-494b-84b7-09f68a87975c", "value": "Scan0018888881100001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0bbe5a-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849182, "uuid": "825fb2b1-9ebe-4f77-a488-fc01b8428810", "comment": "Malware payload", "value": "dda091363413e626417c6e6aa3e83cb8", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849182, "uuid": "a1eeef47-6555-4431-9de9-b136cb1ff432", "comment": "Malware payload", "value": "ba95d131f510efcd2d96e87813295aa624f0a94eeb82bccfa020b4c38c3569a7", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849182, "uuid": "cdd1b49a-9d69-4c99-910d-8f7680550751", "comment": "Malware payload", "value": "ee17070db1aaf49522ea0de552933c87985b54ee", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849182, "uuid": "4da16c9f-c333-42f9-a926-f9e6871dc068", "comment": "Malware payload", "value": "83099b76fd69db3ccba6640b2f618bb1a0e56ba244d8ccf8b0e26b279dcf61aee8930e766ccaaf8feb5ae9265777e3b6", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849182, "uuid": "16379ffe-6af8-4721-9223-7a14655eda28", "value": "T11543BE01115782CED2BB56F5DAADF121C5007D18EA7DADF3B993B200B832CA84D536EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849182, "uuid": "4a18dee0-2cd5-4a67-9a06-1d5781b58fea", "value": "1536:D1DcHEsxeEqii8iUbBK+dUcVq91iUmH5v:DVcHEsYBYbBAcMfiU+5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849182, "uuid": "3ce38f51-4150-4356-a824-2abf4111e96c", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849182, "uuid": "6378f065-bade-4911-be57-8c26cf49574a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849182, "uuid": "7b589e89-d8e2-48fe-981c-9f844a4d7022", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c808fc-0d32-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658874485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874485, "uuid": "121f7ce1-d895-4cb3-9012-3dfc5846bee0", "comment": "Malware payload", "value": "5e3385a20d41acedb5a3b93b5a8c76a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874485, "uuid": "6fb1584e-cb99-4b2d-b998-cd7651fe4452", "comment": "Malware payload", "value": "bb671dbc4bb59548908a3bb9b9bb67c07e059ae50b2d347d04e7786a2e4527e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874485, "uuid": "f9e15252-85f9-4ec8-881d-e9898add014b", "comment": "Malware payload", "value": "c63b1e59b8c08887d0de48ba5149b165091d00f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658874485, "uuid": "ae66a424-85ed-457b-a88e-1a6cf7352417", "comment": "Malware payload", "value": "704fc1ed1afc55df48d5dd86aac42e6144491f956a1523d4fe8535d504277c7c35984296335b094fa553602dcd204102", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874485, "uuid": "be7c5339-9ad8-4511-aec1-301e51da9ad7", "value": "T13BD4CF1125CBB714EB39F77816C4A060AFF5FC12D209E56D2EA6339A8777E604E72123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874485, "uuid": "9e164227-88a5-4659-b6fe-56411aec1b1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874485, "uuid": "11af79c0-d3d1-49ac-88ad-7881a49a6902", "value": "12288:baIDu/jixgV2iND63x0cy8hyZscxBS5qSyFYgT47e2i8xXxzep3GKY:bcixgV1gWycxByqSyFYmueeXZep2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658874485, "uuid": "0b8b5774-20a2-4eb6-b9c9-99cdff3b2262", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658874485, "uuid": "f3d97343-7e8e-41c3-895e-a8be3abc255c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658874485, "uuid": "4408a2f8-cbd0-4b2a-b4f8-d9caf86a4163", "value": "5e3385a20d41acedb5a3b93b5a8c76a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ea9f85-0ccc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658830673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830673, "uuid": "0ab8b69f-949e-49f8-9c84-6965944e082e", "comment": "Malware payload (Formbook)", "value": "806ba18b8ab6b2035d2538d0cd8d77b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830673, "uuid": "d559b6eb-040a-4ef6-b01b-f475d28e01c5", "comment": "Malware payload (Formbook)", "value": "bb9f34650be582da17ebfefa4aee482eea1658ba1bd4305977f9861032ac9020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830673, "uuid": "b1b39dc4-aeb3-4020-adea-19555d98d32b", "comment": "Malware payload (Formbook)", "value": "a17201ffb61fd97ebba8ffcaa706f2e3bff267f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658830673, "uuid": "3662cfa1-e0dc-422a-b6ad-10c22be592da", "comment": "Malware payload (Formbook)", "value": "75bf64d45594db4bdf88d22cec4aec7ce4e3fdc57fdb2bf39e316de153537367182abac808f988f2e571b7301942cde9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830673, "uuid": "f8856b80-4bab-4143-932e-579f128b26ad", "value": "T15F35ADAC356076DFC86BC6BAC9A86C64EB203477430BD643901315E9AE1DBA3DF054E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830673, "uuid": "47c3da2f-207a-4d4d-b532-7d4c826d0dda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830673, "uuid": "9b32cdd7-1322-4fc9-8465-dece9324871c", "value": "24576:Iw4UZvybcv8v8k2nG+bmo+/I0GsgqCexyoHeP:I6d80kQ7OIZ5oHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658830673, "uuid": "9c993c39-e00a-4dc9-917e-309a7f3fff05", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658830673, "uuid": "b91ee9a6-54af-4dfc-8381-a033ecb983ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658830673, "uuid": "4f75d5f0-6b96-47c9-81b8-3635d1a101fc", "value": "PAYMENT SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cc9492-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658849465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849465, "uuid": "81bbde94-befa-41a8-ac3f-9212ac8369f0", "comment": "Malware payload (Formbook)", "value": "9373b59f0177805e9fcfdd626fd82c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849465, "uuid": "87c567e9-20f1-44bb-9fe8-cbf05cbb76c4", "comment": "Malware payload (Formbook)", "value": "bc513220738494ab9bed93d95569b1c80debea2b59e4cae5e9566d2c9286985c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849465, "uuid": "bdb40184-bacf-46e2-a0c7-4d097ab49108", "comment": "Malware payload (Formbook)", "value": "375efe78a571ba5809c7d4a173588bfcc3693978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849465, "uuid": "cbf8d4f7-454b-40b7-b4f0-039e67cf9712", "comment": "Malware payload (Formbook)", "value": "ec3ad4924bab62397133c301c0f42a2d16e4ace7605f2a360fb64459d0d36031d59e986d009eff2c188889dd284ea905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849465, "uuid": "5a3ecdfa-cb98-4902-b716-6ede72a8d9b4", "value": "T134F4F12213BCCB79E4BF17B9F834455143BEA307A14ADB8D5A90B4CE7D923A0D1172A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849465, "uuid": "3a9d3994-e768-4eed-b4a5-010d067c0471", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849465, "uuid": "97686e84-30c4-4c64-b916-838ac05f9f0f", "value": "12288:RNJSRG02b2UVFdPBGjJNBG06wRhFg7KQqEOXoHIPEOmN/d+B:IuGj/BG06uQKQa7O/kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849465, "uuid": "e6caac38-9cc6-46d9-82d3-25d535c43416", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849465, "uuid": "8581c0b3-4336-4dab-8d70-c9a91154dd6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849465, "uuid": "cfd39a54-4216-4fd1-bc1d-3999740d0b56", "value": "Dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91baf538-0caa-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658816224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816224, "uuid": "adfbc2c5-08b7-49ab-a166-dd879f7055f3", "comment": "Malware payload (NanoCore)", "value": "386a2d3dcf32c12024fc11459c4d8092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816224, "uuid": "7e770011-7418-494d-bff3-3a02dad460ec", "comment": "Malware payload (NanoCore)", "value": "bc76c9c1e2dde9ae01813b543363c72242aabcbeea23ab3762eb9221ba7c2bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816224, "uuid": "692118ec-bc87-4ee7-ad3a-b8102c0c9491", "comment": "Malware payload (NanoCore)", "value": "590b1a1faae9468a654c32da6a4a481759888023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816224, "uuid": "c05f3fd0-218c-4b25-8e7a-ea0c405c34c6", "comment": "Malware payload (NanoCore)", "value": "48501bea11f5c29904c61c650d68a10db2461d048aa6f14b8060ab969d0f6aab90c4e505c2dbbb9df270f112577d7b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816224, "uuid": "b864a883-7ffa-416b-9a30-36207de2e271", "value": "T1742512282BB45F47D9BD43F680144104A7B93A253447E7AC8EC2F0ED3E62B62195BF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816224, "uuid": "73f84b5b-3bab-4d37-b596-05c37bfc4a11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816224, "uuid": "16fd10aa-c7fd-4ec5-ab62-d78f0af180d9", "value": "12288:WwMUN+TajOlcSpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrSfF0ZgW8Tm/S77vwUDKlE45S:ccSw4UZvybcv8vM/EAMO5HWRyKx/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658816224, "uuid": "a4f73922-263c-48de-a3f2-e15444ab09e3", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658816224, "uuid": "568c96ab-833c-4083-aca2-4a02ec46b3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816224, "uuid": "482a1c32-9c18-42d8-b620-6d7143d8b8be", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd49c0a-0cac-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658817023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817023, "uuid": "cb0b8575-a9da-49b4-9cf8-bc69b6cd629b", "comment": "Malware payload (Loki)", "value": "4912cf68c82f9a5b174233c23a0ced50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817023, "uuid": "854d486e-2880-4bd8-b1a2-6081467442d3", "comment": "Malware payload (Loki)", "value": "bd604e71251c7483847289aa48805e49752d13cf1972b1519c7662933eab9c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817023, "uuid": "0c70ca94-0441-47c4-a65c-6c7c2d6ed2cf", "comment": "Malware payload (Loki)", "value": "a662f9d0bed456da3e90499482304ad819de1d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817023, "uuid": "68d7479d-f6b1-4c68-8a1d-3e9a5ee896e4", "comment": "Malware payload (Loki)", "value": "7dd912c27bfc4115258269f6a0c4be2f4576d68a58080476209633419ed546526d752a5c7cb0dac2f339a8fe1a9e3194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817023, "uuid": "621bd2a5-cee7-43af-9347-24357e079166", "value": "T1AAA3C471B6A78721C59B6E32C49E750C0270DF412523D646F89C33386AF33EF5A86A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817023, "uuid": "da23f53b-baf4-491c-8c09-de3e8be75800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817023, "uuid": "983f830e-5bc2-49bd-a71c-96c4b238a085", "value": "768:Lc8jqBIgOIBIW6KPvcWLwNWQGzm6uNpkNkF6P2GLFa:fqB9BIW6KsRGz3uNfFGFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817023, "uuid": "ea8f8dec-84a9-44a3-82a4-a9836fb35dc5", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817023, "uuid": "8aed6bd6-7e07-4f35-8027-0a4ef5804168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817023, "uuid": "da10921b-6a70-4545-9934-190e57e88129", "value": "Banca Comerciala Romana S.A.(Transfer de plat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6c5108-0caf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658818470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818470, "uuid": "10fae26a-e6f3-4f81-96b6-6e7b4b52f00b", "comment": "Malware payload (AgentTesla)", "value": "4cc4c2789095c0fdbbf33f59eaede4bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818470, "uuid": "ba3e0480-c76e-4a1b-bad5-cb9e37973bef", "comment": "Malware payload (AgentTesla)", "value": "bdbbad2880f980eb911a7d9c6f5e8ed735d08cebe96defdad4e3cb273ece6e43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818470, "uuid": "17f2c692-0199-4506-a721-34684fe61f93", "comment": "Malware payload (AgentTesla)", "value": "fc305d23a6c00bd8de1a846a4385274bc4dbad59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818470, "uuid": "ea37b479-1da5-4441-8ac0-9006ba70f946", "comment": "Malware payload (AgentTesla)", "value": "2c8c42bf8bda55ac94fa3a97cfcbb9f07d34b0cc954280fcc431b0b15658717861bb1489bb355821cfe0a6291ab71fb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818470, "uuid": "e1941c57-0399-4190-9ba7-51e06014a3e5", "value": "T15DB423EDBA9EAD54D745C3212456E9029732F46426A5376A71E0B8940B23FB0D23CFCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818470, "uuid": "5424f07d-a8ab-46b6-b166-db0eb7c9fe02", "value": "12288:fuwXNEsjQx6/FI/vomZiq/ZwUanszsCEbmE:fuENnjy6q/d2UDHEbmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818470, "uuid": "55f38233-9af2-4125-b11b-1a24564b2a3b", "value": 512244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818470, "uuid": "b3988865-5ef1-467e-8c8c-25530ca4bfef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818470, "uuid": "ef51cfc4-692e-4d70-a9e4-478a48024224", "value": "quotation and agreement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d5fcc8-0d3d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658879394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879394, "uuid": "46107226-90c7-4c42-9dff-7acb606d7ae1", "comment": "Malware payload", "value": "c107c0e3456b52d8e790a6af458e02d7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879394, "uuid": "271d7f63-ba42-4b70-9d12-c66f477e64cb", "comment": "Malware payload", "value": "be4af7c4a97ffe80a9783d19ccb81ed0d0ec018d739b658c402136e055387a7a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879394, "uuid": "929cd806-e588-4e95-bb5a-4acfb62de9ba", "comment": "Malware payload", "value": "4300e6cd325f4d5d1a33833513a1bcd82836ff3f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879394, "uuid": "78310bef-304e-468b-9bea-d8fd61905b44", "comment": "Malware payload", "value": "4238e0a96cd0aa061cbd2eb37be26c735b0c3eced9be2318c8fe0c386bf3e248795a2a220ca63c1f428f037caa3d3a3f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658879394, "uuid": "e666e98f-2fb5-4200-ab42-6d21ed5b3788", "value": "T1DC6301AA139740BBD2321162188BDE55CACDE456AFD8DE7FB0F683A1158412223F48DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658879394, "uuid": "17695880-839a-48b2-9673-a1af9c1568e4", "value": "1536:ceG0hpCwBulkFOxy8k9qxDa+70psNaLLqY:jGWpCzkFgy8k9qk+SLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658879394, "uuid": "62acc2d3-8b2a-44d4-99ab-d20b370268ba", "value": 68752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658879394, "uuid": "2a75d247-a0f6-479e-a8d1-227b2371f670", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658879394, "uuid": "17da2439-0b46-4aff-83fd-ecca58972a78", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a8e6d7-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658849223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849223, "uuid": "bb64bca0-e0fb-4c02-a06c-e007825a2510", "comment": "Malware payload (AgentTesla)", "value": "2474f47dd5cb99a8913fbc95f164fd38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849223, "uuid": "d59d5225-12a0-4d20-8a0e-eae9d1e91858", "comment": "Malware payload (AgentTesla)", "value": "be9f68f2284f924ae4696b48aa4c1ff5b771af13b09c8672f07cd600e4169370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849223, "uuid": "02cc31dd-1900-479c-b40e-14806175ba0f", "comment": "Malware payload (AgentTesla)", "value": "42bb89241b10c90a4b52d07bd31b9735ca41f5d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849223, "uuid": "4d5c1432-7142-4515-9a54-63955ac5a5bf", "comment": "Malware payload (AgentTesla)", "value": "655afa540cc73fde173badbeb6fccdbf59cd977317955a2df86878d48b95ba15423ca90af0204fe489019f36338008d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849223, "uuid": "b7f8f84d-6768-4590-ae70-f1ccd8491654", "value": "T13FB30133215027FEDBB865309FB6EEB074215EF116B563118361BBCA93F3A84696BD04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849223, "uuid": "b3152c67-2b0e-4627-a9d5-527ed1318cf5", "value": "3072:NIGrEmru0128j0E5OK70W6dfmT2i14PtxbBLpyUsUJLJ:muB1Lj0EoeBPB4jB9yiJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849223, "uuid": "e120eb80-198e-494a-b835-bf6bf8fd7a7e", "value": 113016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849223, "uuid": "46d46758-a54d-4930-9986-a72e991bab78", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849223, "uuid": "f9104468-6e9f-4426-a4f7-0bbf5587fa99", "value": "Revised Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ffed17-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848231, "uuid": "b42acd53-53e1-492c-baae-db40fe1a8325", "comment": "Malware payload (SnakeKeylogger)", "value": "917d128b19b9f835d9ad4c4f7f94ddcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848231, "uuid": "602f9663-7f26-4a8c-9f19-4b2b31759d52", "comment": "Malware payload (SnakeKeylogger)", "value": "bee79db342f4cac796b82917a77b5dc999dafe5ad9b463b9e29da9be30689987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848231, "uuid": "ca5fb539-c690-4738-a9c1-f12c24e2f0ca", "comment": "Malware payload (SnakeKeylogger)", "value": "53270585a4fe78e3a87ea27890f705f5cf9760fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848231, "uuid": "cce0990c-6de9-40be-90c4-0948d2e02449", "comment": "Malware payload (SnakeKeylogger)", "value": "716c7d093e62f439d6caaa023c5c88c3e43f805d19d58425be6ec69f164594eb1155747dbebcb141dab431ef658e4ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848231, "uuid": "ad281f9b-1a57-4b2c-8c19-9a40512c5dfc", "value": "T1535529A9B201E0CDF96E94B1CD90BEF055167C6BCB0B5A0301573EC5B57FA978A3A093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848231, "uuid": "4527568e-f041-40e2-8047-730011525ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848231, "uuid": "a800c0e0-0ece-4cef-aef1-bd055781917a", "value": "12288:5lvpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrSStAqsL/+rTjaUyPoUVpuhFuWVG/Qyrpah:Nw4UZvybcv8vwmMTjaUQoRhBwxrqHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848231, "uuid": "4a3a09af-6afa-4303-89e2-a10ea27c6f39", "value": 1340416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848231, "uuid": "cca5fc8d-bdde-42d8-956f-cdf078b92bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848231, "uuid": "28fbad27-83b8-470e-84ea-ed7b03dd5d8b", "value": "917d128b19b9f835d9ad4c4f7f94ddcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5c40ea-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658846869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846869, "uuid": "1f2c567b-6036-4ae9-8011-6be189122942", "comment": "Malware payload (Formbook)", "value": "aa70ab73793c05dca8c8692961d1a4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846869, "uuid": "fbf62527-dc3a-4108-89c9-8d7b0a6ed58d", "comment": "Malware payload (Formbook)", "value": "bf081aa7c59a48147fd80e49d74f867749227e2dbc32da5fa080ee3ff8008fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846869, "uuid": "9d3f39b0-2d8a-4807-a45a-031de40d8b0f", "comment": "Malware payload (Formbook)", "value": "5643ac09264c3747eda05b47d50d5168b84e6282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846869, "uuid": "3d2d885b-a947-436c-8d08-6b4edaf8941b", "comment": "Malware payload (Formbook)", "value": "a48784e884a71a9a5327ab7d62e4d5deb02d2024edbe455c10adb5f9b93b557ca1d23c07c234f62b13a4c197531256cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846869, "uuid": "5230ac77-84cf-4135-bf8b-1cab4466800b", "value": "T14EA401C7744C832DCC3436B12539EF308A956AD391649AD979FBBC6C522271C9B089EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846869, "uuid": "b81170a4-6528-44cd-adef-28d540b526c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846869, "uuid": "af0a7e99-0dfa-4da6-9c44-f5bf002b947d", "value": "12288:QctXOi4Xu+XzHUDOi2aWCMG60w/fs1rFgQYyw2LuaWBX8+:jtXOl+g0qiuXG6V/fsZFgQRws3Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846869, "uuid": "51011905-4f54-447a-accd-614ed01d7004", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846869, "uuid": "24a40a53-d4ab-4c75-a342-c026a745855b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846869, "uuid": "1bb5444a-2769-47b0-966c-74593ad525df", "value": "SecuriteInfo.com.Trojan.MSIL.AgentTesla.CKH.MTB.21747.7601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dc0f0a-0d2c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658872205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872205, "uuid": "8952bb71-ed4b-4ab6-a275-6eed633afef5", "comment": "Malware payload", "value": "1706365b5058cbaa560b23dc297f9585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872205, "uuid": "0e0611a0-3dee-49bf-8ebd-0507fbdbf73f", "comment": "Malware payload", "value": "bf081d3cd1264716c4522f06c6e0294eaa9834c8a06f11d501780d065d7c0135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872205, "uuid": "da32b3a4-5173-4455-8491-ad8ce3664b5c", "comment": "Malware payload", "value": "9933c13c7db40fb5ddce9013c42496e66d7a1b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872205, "uuid": "71ac3a28-f48a-45de-8823-097e913bbe2f", "comment": "Malware payload", "value": "78fa6a2d4dc15b97c9e0cf00241acf6072362f08b7848cc0dabe7dacecbed70c97170a64989cd9c274d1346e2eb1baf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872205, "uuid": "1f2debd6-7516-4d61-af37-1bbc023e2129", "value": "T1A4B2BE01F3A855ABDF9A1AB27DBA13118279EB5608673F3F7941580E4E7378205B6B30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872205, "uuid": "6dfc3e44-690a-4b29-843a-e2a8633b8180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872205, "uuid": "4307b338-c43d-499d-9b51-1b54059f13e9", "value": "384:Yx+N+/LQO29SnpX1kf0X9xEFXRVrt/BeuDi1zmnFCZp9iVSwihWleoZ7w/MwTj:h8/5npXKc9MVrt/5i5mkPiPihWl9sL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658872205, "uuid": "5fa599fc-f611-4195-8dc4-4a99d4f93344", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658872205, "uuid": "9852fb93-bdb6-4f72-90be-61cd21bff83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872205, "uuid": "3f300d76-0ba1-42a8-8194-8b211aed2123", "value": "SecuriteInfo.com.W32.AIDetectNet.01.1922.11328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd51b29-0d35-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658875703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875703, "uuid": "c7fb7b5e-89ab-4456-a2d9-4114af1dfed6", "comment": "Malware payload (AgentTesla)", "value": "ddf972530092ec73ba3cb9ca6943ad68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875703, "uuid": "49dac673-601e-43f5-95ff-c6d1f9fee71e", "comment": "Malware payload (AgentTesla)", "value": "bfd31704952a9970fda83787c4b89dbbcee13732b460d07bd7645956bc2dd352", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875703, "uuid": "eb53ba7a-55b8-4d77-aa7c-40a0e6be23c2", "comment": "Malware payload (AgentTesla)", "value": "8f1a2ff8c4f92a4bab580a7f3a6c4ca858ec6680", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658875703, "uuid": "f9284519-c7ef-44d9-b0dd-1c59b403df8f", "comment": "Malware payload (AgentTesla)", "value": "5257c180a4df90844356a6c74d51c73157ce7842bef7281cb8bedc61ba8cda11675821a0a8c990bbdbccd7177dea9a85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875703, "uuid": "ef60ad27-2d64-43b1-9a95-0478f0c51ffd", "value": "T1BDF12E2CDE880237CAE7C734B8B30641F4F4696777328E6E96C5624D6E07646B68736C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875703, "uuid": "c53164ef-d882-42f5-aca5-5b84e77a8fa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875703, "uuid": "104c2684-aafc-4ace-b26e-e356068a2a81", "value": "96:+M6ihbecC6fAgjEgjUyQwYfvAkr9HMzNt:A8FtfAEEgjUyQdXRh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658875703, "uuid": "e00bc9a4-d84d-4b72-adf6-f3b9314a36a5", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658875703, "uuid": "de22175a-d553-47ad-a976-04b8d57f730c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658875703, "uuid": "2f92c0df-b08e-42d3-ae53-085e991c2aae", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.20314.24577.18855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1894fc-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658855036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855036, "uuid": "cf8d7c07-9ccd-40cb-969a-f4fd8adf4714", "comment": "Malware payload (AveMariaRAT)", "value": "9368bed5d269fd7bf83d85a75427fed4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855036, "uuid": "2f6efabd-162d-485a-85df-df4fe582116b", "comment": "Malware payload (AveMariaRAT)", "value": "c012d6850b13e52312b40cff42d444126d137a1ac88f5e77158b5089f6ed25ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855036, "uuid": "51ae31a2-8cd0-440d-8523-c91f443980dc", "comment": "Malware payload (AveMariaRAT)", "value": "4922f91d169e67d14b2f63072592b23cce0a7df5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855036, "uuid": "8ea39105-9898-466c-9e39-5008366071e1", "comment": "Malware payload (AveMariaRAT)", "value": "b6996e59d93a39fd1a6b4fdb34558e11198953818fb81c52236fa832df4ecab11310f5a55cd540f28d950eddb4777f0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855036, "uuid": "43dd46c1-83a9-4231-be87-fb3d05bad318", "value": "T1B9D39D23BBE64436E6F202B02DB97E7597BCF9341A25C58BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855036, "uuid": "87037888-7e71-450a-bf5f-3aff883b1328", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855036, "uuid": "96164bc7-f890-42d5-9561-e04d89f8b0de", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658855036, "uuid": "d2cb0ebc-430a-46ac-8eb7-28042353cd79", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658855036, "uuid": "a3f4e8a1-8e4a-455e-a49a-d4adaacdc94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855036, "uuid": "c5172b25-8981-4314-ad5e-ac522c8b55ed", "value": "9368bed5d269fd7bf83d85a75427fed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b168aae6-0cba-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658823149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823149, "uuid": "1a8361b6-b616-4962-abbb-024a03ce1515", "comment": "Malware payload (Loki)", "value": "b001d153b0c3e075c2670dc497112358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823149, "uuid": "b3558bad-367d-4ef3-88f3-99f945e61bcc", "comment": "Malware payload (Loki)", "value": "c1e23c7ba8224266734b9d0914e722627423cdfa81e8aa5efb4def7a0c4c4e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823149, "uuid": "888cb95a-b80d-43e9-90b6-006f253d5911", "comment": "Malware payload (Loki)", "value": "2dec7b9bca603440527e15cea4c73d59888da5e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823149, "uuid": "28dd0c7d-c86f-46ae-a7f1-56c114b0360a", "comment": "Malware payload (Loki)", "value": "3ebc3e297ab0982d863fb6444bebee8eb88181b4340a8eb838f3428319329e4803cd7fa77de09cc98e5436a37dd54601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823149, "uuid": "c96ada8d-7ae7-4795-8020-d1f40acc7d51", "value": "T13554E12C6765CC13C8D20D749D71EE9EA9F0ED015594AA6776203F3EEA38682DB0E317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823149, "uuid": "7e61bd40-30aa-480b-a706-f371411630b8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823149, "uuid": "4b5b9d40-9804-43ab-90b6-2355959f45e0", "value": "3072:ozfY/TU9fE9PEtuuOZIbXu7e15BLybcwPXPl84w/I2nGnEv2Q59wbdmOQEtnWbxX:oDYa6lZYbjBwc4lr2nFtQMOnnwz5Phtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658823149, "uuid": "5e400475-e098-4c79-9d56-56d007ed8a51", "value": 298512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658823149, "uuid": "cc48fc45-e708-4559-a593-83d3f67c5e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823149, "uuid": "9ececa29-1f72-49a5-9f7b-3f44a1e2ae34", "value": "TBK_555738_Payment-PDF.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd4fcd0-0cd4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658834282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834282, "uuid": "fd4914bf-b058-492c-bafd-aa65df3137e6", "comment": "Malware payload (Formbook)", "value": "85d6c29f08b0be2cce718e4583f9ef3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834282, "uuid": "27482aeb-22c4-44d2-a3e7-3fbf047a3cb2", "comment": "Malware payload (Formbook)", "value": "c250c174e24e7662303414d30c5989772662755d35e56f28f35f782d85407e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834282, "uuid": "d6e9679d-9d7c-4e4d-a24e-0ab9aeb96b94", "comment": "Malware payload (Formbook)", "value": "de30e51e39cd2c8709c8d516ddf6cf89a399be52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834282, "uuid": "edeb92b0-394e-473a-b733-b6eb8c8dd6a2", "comment": "Malware payload (Formbook)", "value": "3219396eb766a3d006be35b7d9bf4e44d8b7ce28f065590e0492f5e4e6f465181fa706ee9d4502d43f8a69c1a7ed744c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834282, "uuid": "dbc64984-280d-48ef-831a-260417fe3818", "value": "T14944D0C87B9479DECC6BCD729AA41C24AA60B877532BD643A05741DCDA0C78BDF481B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834282, "uuid": "03b579a9-78b7-42e3-b006-adeaf6727bb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834282, "uuid": "a6834c4e-f059-46a1-b699-739ebd853560", "value": "6144:soFuE9EhMFmqJYS2GVZzYEDuu2LUSnty/YhowmZfdDAU2:szE9EhMFlT22m8ncUukghUlAU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834282, "uuid": "a0f21e19-92cf-4a03-b926-4ef0c7179930", "value": 268832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834282, "uuid": "3cf4658b-d361-4c6a-9e1d-6c81710863e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834282, "uuid": "e09eeade-cea4-4fb1-b5d7-a0538f26d0ac", "value": "PI220062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b5c324-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824396, "uuid": "711ee3dc-1d94-4980-9cc1-3dbe8259f083", "comment": "Malware payload (Formbook)", "value": "311d92417b9093f29f297805272725c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824396, "uuid": "0fffb352-5f90-4ff9-b301-9e34e7a1e81a", "comment": "Malware payload (Formbook)", "value": "c29b9d1075e86788bab4a9e75334f36de07c1feb22500759db93d9379c875171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824396, "uuid": "ab553ff4-6ca1-43d6-b121-6b7ba84d157e", "comment": "Malware payload (Formbook)", "value": "4c909282baf28792274aef4195b8e5c11858c756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824396, "uuid": "1f1f5f20-08ec-4f00-89f0-2a12955314b4", "comment": "Malware payload (Formbook)", "value": "a3b14c9f049f86ba24927cfb5b0fbc769e30034ae668c937817eafd99f1da0eadb89be1a1d8b7e5087327c0627337e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824396, "uuid": "cc236011-d477-40cb-9e23-1126e5c792d0", "value": "T190E41258BFE4D869C25B9B753867C05451737F167E1DEB286C9BB2AC46303002CA7B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824396, "uuid": "0781050c-7aba-478f-b3f8-7021d567f56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824396, "uuid": "897d9388-c5c8-44d6-80b7-57b3f87ada3f", "value": "12288:irY4shcR0nKPnUgoRzJ5d7u+JyGbuF4Z6Hx//UNsaH5vtDlt:ik4s2KK/T6zJ5U+0kdAxcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824396, "uuid": "9083e70b-8d79-4b7f-a035-6e8273394145", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824396, "uuid": "15c150a6-7fb7-4da8-9f7f-5c1b7fcef0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824396, "uuid": "f7e7b465-cf6c-428e-a847-ab350df98493", "value": "Port Agency Appointment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0469c89-0cd5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658834851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834851, "uuid": "d2d05596-ef1f-463b-a983-d78d08837993", "comment": "Malware payload (Smoke Loader)", "value": "c57518264c2c40ee6247b79c4241b1ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834851, "uuid": "d707e0a1-4624-418a-a0a6-0dea398fcc0a", "comment": "Malware payload (Smoke Loader)", "value": "c29d80bcdf75e97c0e4bb86063cf136992ea187b75fc64c8e1e2278850d3efc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834851, "uuid": "f12dea01-2c35-4132-8f74-24146bda4417", "comment": "Malware payload (Smoke Loader)", "value": "900234019cccdad15ca741aa4cbaf9838aa49b42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658834851, "uuid": "3ad5f88c-a006-4f97-9314-cd476decff6b", "comment": "Malware payload (Smoke Loader)", "value": "cb9d5372ac9d93cc31ff86e1e2ac0f5b0fb15909eaa949f455a37e02281017fb9f86ac2b63025fd67c1a3462b69f923c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834851, "uuid": "9a4872e5-077e-4c10-b49b-1c6028d2151c", "value": "T1ED649E40B790D03DF0B711F8B976C2A8A53E7DA09B2041CB62D57AEE56386E4ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834851, "uuid": "af8e7d70-8818-4df2-9393-6dcb9db411f9", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834851, "uuid": "b197b597-56be-42d2-90a8-1393634e7d37", "value": "6144:a5umxzascUTpnB9KuBR9+gs3t2j56UUC:aKsB9KuBCiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658834851, "uuid": "3bba5ffb-bc7e-406c-b8b3-207813729e72", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658834851, "uuid": "c9696488-9add-41e4-b896-7773758b3920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658834851, "uuid": "fa79cab6-0fb2-4346-95d2-507f849990ba", "value": "c57518264c2c40ee6247b79c4241b1ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c14b22-0c9b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658809814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809814, "uuid": "0f3ec7a7-cfd5-495e-bd81-db3b10d35ec9", "comment": "Malware payload (Formbook)", "value": "934268a4ddda9b41329365ffb3202538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809814, "uuid": "3d4771eb-e1de-41f6-97e8-dbbcfea1f7df", "comment": "Malware payload (Formbook)", "value": "c2c5e66bd802b0a57557450b41ec71fcb2eabd2479f2a23b64f54b92f8a25963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809814, "uuid": "02abd883-2da6-4398-81f4-4b38e51b5775", "comment": "Malware payload (Formbook)", "value": "26743678cc6bd65b5fc8d180101432bd20dfc535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809814, "uuid": "037f931d-edab-479f-ac16-ed2f7d18cacf", "comment": "Malware payload (Formbook)", "value": "ca659530910295dbb50fb85133f5b4fe35392049a7764f57a64e9dad060fec6ad075d7f40adebe2bc760fe3d9406746a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809814, "uuid": "d2925a9f-8767-42e7-882e-1aaf7bc7b2a1", "value": "T17CA4402CBA015672FD0DDE30ADD10A44BB570F072248A99AA3FB15CACB4F5AF5E45CD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809814, "uuid": "2d39eaac-f95a-42d0-b473-fab75e2067b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809814, "uuid": "42dea23c-2f8f-4924-a6a7-59f78bfa8ce8", "value": "12288:i5kSTdXzfwxH4PHPfyZmG5cQud45v4+U:YvX7G57ud45Q+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658809814, "uuid": "f50332f3-79d1-4875-9e9c-48d5d07f6e0a", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658809814, "uuid": "2328b2aa-3152-4778-9ba0-5c461e42ab87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809814, "uuid": "aaca4563-471d-4cc7-bf99-22a7756d03d5", "value": "SecuriteInfo.com.Variant.Strictor.274283.27665.5601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa2b756-0cba-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658823138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823138, "uuid": "fe3d42db-900f-45dc-8596-1d39dd908893", "comment": "Malware payload (Loki)", "value": "a9e2d107f9a08e55da0fa639a8848887", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823138, "uuid": "5f2da44f-eb74-4f4e-9121-189d2d2a8cbb", "comment": "Malware payload (Loki)", "value": "c336e9e658ec43f5dda003380d28d3fd6b5913a20a629e6df56fdbf81130b51c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823138, "uuid": "8f0def5b-3077-40db-91f4-5c3775686b71", "comment": "Malware payload (Loki)", "value": "8c4b7c3ed3b797a8b55755abbd0a45d2209bc385", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823138, "uuid": "012032d5-3c1c-4cdf-947a-4e44379c00a1", "comment": "Malware payload (Loki)", "value": "41ed5111e71c09d5f9f956b37e411237a1d0d22988bb962ab3b780c663f63107d6e456b8c1435c1aec7d36aeed7a732c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823138, "uuid": "342722c8-ac6e-45c3-8206-f41640c7761e", "value": "T1C52423FC5217AD21D2EF2E386138955AD635B4C743E1F9398E393034DA30D360AA5B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823138, "uuid": "fa09e8c1-63cd-46be-855b-6a5e7e3a8d13", "value": "3072:hxbnfBErybQIBnXuTfzLnBiPXPl8S+/I2FGnEv2OL9wbrcOQEtDWbxlF6XxMkE40:HjK65JufXBClp2FFPQgONDwV5bhxJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658823138, "uuid": "6e699290-ca69-4d41-bbe8-349f9ee1e4cd", "value": 215685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658823138, "uuid": "64ea31d6-191d-4851-9c4d-d1a5875951ea", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823138, "uuid": "4a31d875-9b7b-4400-ade7-dd3d4d7a7110", "value": "TBK_555738_Payment-PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c57f7a-0cde-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658838541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838541, "uuid": "e0ea753f-32df-4044-81a8-9f3631958bc4", "comment": "Malware payload (SnakeKeylogger)", "value": "a0937f184be1277d6149b4dda2d6ccf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838541, "uuid": "82420715-a105-4d8b-94ea-ba77b86bb5e0", "comment": "Malware payload (SnakeKeylogger)", "value": "c36ac26d6e93e3713eb3630d4254d14a9945e04b5ee7aae0399a2fab0e12f94c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838541, "uuid": "fe4716d6-215d-4515-9970-1de7a208cbdc", "comment": "Malware payload (SnakeKeylogger)", "value": "426039937ca4c708e70561090eb75c0c58b9ef8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838541, "uuid": "a4f0c242-e2e6-4277-920e-5c8a80519117", "comment": "Malware payload (SnakeKeylogger)", "value": "21ba51699bf580d809bf92f89e232a3a11593ab37e5086999914a1a2889e9ba5f8a8aba3e47d8b2d9d877fe63777acc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838541, "uuid": "bc27e635-354a-4ea9-8eaf-3021ea8c0b2f", "value": "T1E9457BD87E15759FC42BE2B5B5542CBCD7633C63438E93934293E8D99B0FA929A001E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838541, "uuid": "7efb1edf-f291-404a-9ade-09e0fca67a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838541, "uuid": "f129ba40-b814-418e-a82b-c032bc12b319", "value": "24576:Xw4UZvybcv8vYdrQpoSrntlA7Xxz6HKNeLc:X6d8srQpoUlA7x6HlLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658838541, "uuid": "feec8e6e-11d1-4caa-8d7d-dd8ae3d631e9", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658838541, "uuid": "23337d81-a6f5-40ac-b11c-cbc297f6d198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838541, "uuid": "5a9564da-e195-4080-8956-a8c5327983ca", "value": "Transation Swift 0001.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d12a6e6-0d02-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658853958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853958, "uuid": "97f4c9ac-627e-4625-b507-2b777880fd9c", "comment": "Malware payload", "value": "6ae06a20835915b46f81a0d908c1e000", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853958, "uuid": "46fb6621-f6a7-44e3-943b-74f3f3c34da3", "comment": "Malware payload", "value": "c6f2da1453ef95ae98eb31c8a467e4418d8eb863e602c7db6e96f63d66b4112a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853958, "uuid": "1204b8bc-0a87-420d-807a-539be18df8fa", "comment": "Malware payload", "value": "0c43174481e2e775642a37fbb5d5e0c1558d55e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658853958, "uuid": "ce17be27-3293-44e1-870b-8704247c1c24", "comment": "Malware payload", "value": "3e440e7679b189f58b42a88e5281667c8328db87f726c0b16dad79c5a731d759a5e562ab41b3e606b56fbb72d5376b5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853958, "uuid": "3a100ec7-5ff1-43c3-b033-7147ee09c79a", "value": "T1EA02D811B3E88BB5CDB907716CB2A341177AF7929917EB6F29C4000B5E536C88FE2760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853958, "uuid": "f7d51f12-1628-470b-a6ad-fae1b1512e4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853958, "uuid": "3ee8ad71-c38b-4152-94fa-9e1019c9000f", "value": "96:ec8OSwvxQ6cK12LIiPqbWjX/DrRvHKOCeQrgzGSBMBkapUXkIvyi9zNt:e5ObfUIQqCPDJCeq+GSee50Q/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658853958, "uuid": "b722187a-2fa0-4ac3-83eb-172cfd7ee488", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658853958, "uuid": "4835085d-7624-4c74-8390-dc935af8caf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658853958, "uuid": "9a3c1b4e-1c25-41a7-b281-43baf62c4f8c", "value": "6ae06a20835915b46f81a0d908c1e000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a900473-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658851028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851028, "uuid": "9296aa3d-7837-41ab-a99e-3273c928b3e6", "comment": "Malware payload (RedLineStealer)", "value": "74df6ce1819854ecc815603f23a93635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851028, "uuid": "898314b4-cc6a-41c0-856a-a29e4b17d3aa", "comment": "Malware payload (RedLineStealer)", "value": "c6f4c9aadf6d1353c3e0a6ccf7245365cc4f9fc1462f79d831495adf5980ba76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851028, "uuid": "11bbae35-722a-448b-936a-f19d5ed7edf4", "comment": "Malware payload (RedLineStealer)", "value": "e4b77a1db71ee4c83817a93c8fe0ba74e88d8db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851028, "uuid": "96e5bcca-37ce-46d9-9cfb-82c1617f23ff", "comment": "Malware payload (RedLineStealer)", "value": "0b3ccded0d9ca1d3656c56892a05121ffa709dde028253b8371ba2606adb3949221c182ce951f6a21d48f859c0c4b080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851028, "uuid": "58c576c4-691a-4511-b120-11195ab5c964", "value": "T1FF548D00B7A0C03DF0B711F4797AC2ADA52D7DA19B2455CB62D67AEE5A386E0DCB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851028, "uuid": "5d737fe1-6e5c-4f5a-bacf-94bbc4a05a0a", "value": "341ace376080222d26a7767debb6055b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851028, "uuid": "e1e674f8-c681-4818-a899-ff4f7396771c", "value": "6144:XHzVgyldXsx5NmD4Gko0X+VmZ5a6dhxBHuEpCK:XHPNkGko0AKI67xSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851028, "uuid": "2659a4a0-3a91-4d13-b20c-1b8de6d08bb5", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851028, "uuid": "a77c6e92-08ae-48ac-9dd5-9c4da71bfb7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851028, "uuid": "5de79304-4a24-4abf-948b-a9c32ad93780", "value": "74df6ce1819854ecc815603f23a93635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55e4b77-0ce4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658841275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841275, "uuid": "37063062-a11b-49c4-8d40-43e4fc8648a0", "comment": "Malware payload (AgentTesla)", "value": "558b5f6a4155c25c7e6b832750721358", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841275, "uuid": "c94cf0f3-f970-4b02-be3b-1c560ecd09b8", "comment": "Malware payload (AgentTesla)", "value": "c75377daf0e591f095260dcec4055ebc62d0790d20dae9f2365c07b406c87042", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841275, "uuid": "5b8fabc0-269e-4749-a958-328f55de3e57", "comment": "Malware payload (AgentTesla)", "value": "f1582393547a06dc50f2f2f655fa64f39625faa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841275, "uuid": "4bab7fc6-3a49-4d29-8b04-bdf1e5dca260", "comment": "Malware payload (AgentTesla)", "value": "3026e5e2b8680e8a7899d2c46941dabe9918e9de2a74ee2e2b50505d3a4eda263126c5d77940f2705f97f4bd64404938", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841275, "uuid": "ec3e4982-b0e8-4f08-809e-ffef0a140e59", "value": "T19CE47C9C3692B2DEC917D4728FD85C64EA60B837970F5213942313A9DB2DDA7CF150B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841275, "uuid": "882a3b43-669e-4984-94e5-d6a2ed5d9fc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841275, "uuid": "bfaeceee-f33f-4b9c-a936-c6951d9e8065", "value": "12288:T9Z1E2iNDXR0y/kLxszw+NHsL9icTONPGg1Xi4xLu+AQeA2vMxJ8j+cGGU3H24OJ:BQ1r9/kLxsz/NHsLIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658841275, "uuid": "41918877-8ebb-40b6-b6ea-15911ff4f1c9", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658841275, "uuid": "af9729b7-8a5b-4fc3-a218-1e0e381422e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841275, "uuid": "6dc72493-1070-45c9-8e66-e1f889b343d1", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1790eb99-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1658851238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851238, "uuid": "249bdfe7-5c32-4a78-80f2-71bee4b0dfab", "comment": "Malware payload (Amadey)", "value": "763786dcf92cba095d7d692a426afd49", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851238, "uuid": "fd050d8e-563e-4891-841a-03630d5103b7", "comment": "Malware payload (Amadey)", "value": "c7c1798658efcde7b63988c0eec3b8c17729868942a32d2ccfde0572bea49aa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851238, "uuid": "65e7dfba-c24f-4fb8-8a29-562ae8fc356b", "comment": "Malware payload (Amadey)", "value": "82abcc48c1736ab8cf53d0e179457e97e8b332f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851238, "uuid": "056c0475-8de2-4e5f-830e-82face74d193", "comment": "Malware payload (Amadey)", "value": "daa4d00c41fcc2302537e55675e3b67bfc7e823067e1b04d45faee1102725681fd24ebef84e33c91a046b8ef0b1ec178", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851238, "uuid": "4f57d19a-45bd-4b6d-b4e8-42b5c2afccd2", "value": "T12CC36D73F1D08872D0B10E7CAD5AE698663EFE202C351557B6E94E4C6D3B2C2296D2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851238, "uuid": "75243c13-66c3-436e-a863-55a77182a068", "value": "a02ab1a937fc1433a9abad7bc2badee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851238, "uuid": "6d5feacb-74a2-4da1-9c28-2ae2f4c17367", "value": "3072:Ix7pOYzBekxtuB3W8aWWGHGSVG4238JWgM+M6OCq8L3D3a9:Ix7ZNhxtJ8aNsJbM1y7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851238, "uuid": "47a42840-1c26-4cf6-aef7-d668013ea8f7", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851238, "uuid": "4d1feb91-1fac-4c5f-bd13-6093d67d8f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851238, "uuid": "c44895b7-c01b-4c94-b968-e954580ef65b", "value": "763786dcf92cba095d7d692a426afd49.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fdaaa3-0cad-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658817498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817498, "uuid": "db273e02-fd47-4f91-9fd1-38d47e2c4ec2", "comment": "Malware payload (AgentTesla)", "value": "25e8204e8ecb9e1656dde6f3d23ae3d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817498, "uuid": "9e2aabab-adf8-4cc2-a806-a922f1293f7e", "comment": "Malware payload (AgentTesla)", "value": "c7efccea724a61af9b3de68bdf2bb66997770ef6c2f26ee66fc25aa20022c826", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817498, "uuid": "3ebd0b17-a619-4786-9eec-1e8196d350b1", "comment": "Malware payload (AgentTesla)", "value": "a895bd6f5958c4c5e5887412c480717a40037723", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817498, "uuid": "3dd5ecf1-c017-4213-8713-72276e1787d1", "comment": "Malware payload (AgentTesla)", "value": "8685d5326f6c164d3b3e167a40450b42f1115942cf270f86f68903b9625d06afa0d1b9f3199254cdc9c0f8132fc93552", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817498, "uuid": "654a79e4-d4d2-4e76-82ff-4c7ecabd31f0", "value": "T13DB4236B70AF90733EE9520176D6595FA0ADCC4701C074E862A9BF339B800979D269FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817498, "uuid": "4431f6e7-3ae2-46a8-a7cb-36f51388ffa3", "value": "12288:CoLxGegl/aujQnu7+NbZ0/NWW30MI47WBM40UlnQ8ETR:NAh/aLn/NdNWEMBlzUhQrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817498, "uuid": "e4ed2e1d-3ac5-4386-906b-bbed205a141a", "value": 523550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817498, "uuid": "909563c5-95ec-40a5-855e-2b499a53bc78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817498, "uuid": "4185beda-5d47-4db0-b141-69a790683550", "value": "Request for Proforma Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567943a2-0cc0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658825574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825574, "uuid": "59a188cf-2814-4172-bf84-62a9f5153326", "comment": "Malware payload (Formbook)", "value": "e41add39f43c7d34db2474fcc3e011f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825574, "uuid": "946c5b3a-ede7-4ec2-bde3-ae5be74292e4", "comment": "Malware payload (Formbook)", "value": "c91e3f6a5e0b9dffb8ab95355c93ffa6110bd0104273e33f7da18f5f02a86075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825574, "uuid": "2d554610-9f26-495d-8d77-3b695ef46ab4", "comment": "Malware payload (Formbook)", "value": "bd02b88f902bf34984e4a464cdc0a7b26f8fe89e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658825574, "uuid": "4918339b-3205-4326-b723-556b86ddd2f1", "comment": "Malware payload (Formbook)", "value": "998be52af5867758621ac6b97496acf1121557a3df8e97c646b3e0e3ff1cf4c3576f34fd4daf0e1234adb049a880a74e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825574, "uuid": "2bbc593b-3f72-4ee4-903c-b05f7febb4a7", "value": "T1B773CB822045ECDDD45328F2586ED570A0B57DCF8169CA0D3B87BF2A94E734234A7B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825574, "uuid": "5bd30d7d-33fe-4b46-af42-ac286d045e04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825574, "uuid": "8e8ffd13-9aff-4873-9100-f803b6e5c8eb", "value": "1536:C0HurO6jOkGttwehduf+AAQt/S2sUeBbbpvCqS/LmhtuKk12qk/M:C9rOAOkGt6+duWA/t/SHUebbxCbGgKkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658825574, "uuid": "e9504033-2bb5-4c65-b2d4-780f55c37bca", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658825574, "uuid": "97a6857a-ef52-424e-a33f-7615553439d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658825574, "uuid": "e46011cf-004b-44b1-83a6-e07b01084d48", "value": "36122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d4fc4f-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658850997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850997, "uuid": "28c42f24-4626-4639-89bd-03a811374dec", "comment": "Malware payload (Smoke Loader)", "value": "39faf6680fa5733c9da6bcd4e38a7926", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850997, "uuid": "37b6aa87-0547-45e1-87a4-b93bfda29488", "comment": "Malware payload (Smoke Loader)", "value": "c96595844ec5098914582c82310207e1409dc6f3935d2372275d7fc63c9fca5f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850997, "uuid": "a1d35bc0-66b1-4e5f-93a9-87946d1c62f6", "comment": "Malware payload (Smoke Loader)", "value": "6b78c44d8455b34792834354521ee0d00b0fbc60", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850997, "uuid": "4875725a-8dc2-429e-92cc-5837f4d835d9", "comment": "Malware payload (Smoke Loader)", "value": "09520775f0d422e764111ac69c287fab7cef659ebf6bbaf59002fc351c850bbf886ba4df569b8556db2b6e7c1236b1a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850997, "uuid": "b7482db1-3cc5-4123-8357-8f7e050512ea", "value": "T13B648D50B7A0C03DE0B711F47979C3A8A53DBDA19B2455CB62D63AEE56386E0ECB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850997, "uuid": "c376ac94-400a-47ae-939d-4912f10b75b6", "value": "a84028b75ca9a4c77c8d440f9d2e525a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850997, "uuid": "a8273aba-19d2-48c3-86cb-f9293f0d0392", "value": "6144:g6v122TsB/UL9NYuFAcY/VXsZydZKLaeEtpsE:g6xgW9NYuF2/1eOkaeRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850997, "uuid": "1774cde1-7fba-47ce-9965-cc03a9b5790f", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850997, "uuid": "3443263c-616e-45d6-8c77-6f08a2dfb915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850997, "uuid": "f8b6d8dc-9f70-4ea8-a99d-35a834558f48", "value": "39faf6680fa5733c9da6bcd4e38a7926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af415194-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843332, "uuid": "bbd89c2a-2d4d-42fe-a0eb-926add6fc410", "comment": "Malware payload (Mirai)", "value": "640e2432fa910055f047ec1b7a007dc8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843332, "uuid": "141552b1-dd45-4a16-bf79-25d725135d72", "comment": "Malware payload (Mirai)", "value": "c994bd2418a7f0681540723036fddcccbf67cab917d21cda2ae89e3965431e8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843332, "uuid": "5b6999f9-4b85-45c4-ad91-b78c0c71d068", "comment": "Malware payload (Mirai)", "value": "dd642b6af3b8c27f8063f0e1f34f21a87c32b6bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843332, "uuid": "d1dd8b4e-cc6c-4d10-82b2-ea5881edd62b", "comment": "Malware payload (Mirai)", "value": "58b5d743dbfd1e03d1a0596656e4b74e5761de043c2c84f2695a9e3a563b37437c22785c6b5f6514f431411542986988", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843332, "uuid": "cfd0a148-89fa-4a04-9aef-457d9c99cacf", "value": "T1ADC35B46EB818E03C4D51776BA9F424A3323E754E3DB330699285FB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843332, "uuid": "2b3ecc4c-29eb-48a4-a7cc-f742a5df0724", "value": "3072:MPhTAK68DP1S8Crs5FY8G+vWJk1M/9LNQj:MPh968DNS8Crs5O8HWJOM/9Lej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843332, "uuid": "f0d1132e-9088-456b-98f4-8344ccdeebe0", "value": 128282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843332, "uuid": "9f87a530-5320-4eff-bca6-abd7b9f09c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843332, "uuid": "b67dce6d-b72c-4aa1-a810-8f9ea3c30543", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659bf5a0-0cc5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658827747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827747, "uuid": "06ba9d29-de88-433d-bd6b-422185460974", "comment": "Malware payload (SnakeKeylogger)", "value": "69c72453f71f6c7b4cba90968a751041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827747, "uuid": "d49b1cde-892e-4e9a-984e-941b17599353", "comment": "Malware payload (SnakeKeylogger)", "value": "c9a3c01698ff2ce6241095524dd545e23db462b6fb04810e86b91c43da8d2a92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827747, "uuid": "2e51d913-63ba-4ab0-87a3-f3fd3ceb3089", "comment": "Malware payload (SnakeKeylogger)", "value": "24b155831cbfda29c01f0b7cfcebb32aad2bddc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827747, "uuid": "226210a1-1606-4d9b-bf7e-2113cf8bad0d", "comment": "Malware payload (SnakeKeylogger)", "value": "26c7623df2037f2e98ae40ba6410b86d11d870e1c2598972eede280c4262d075be87619f442a0fa451f1d04e082c9a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827747, "uuid": "4cfc82aa-a22c-4fb5-9911-c3459bdde36a", "value": "T1BF259CAC366075DFC86BC6B9CAA42D64EB2034B7530BD603901345EDAE0DBA3DE154E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827747, "uuid": "32c939a1-3ac6-4c08-8df3-3b7bbf38206a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827747, "uuid": "22d98658-a56d-46a2-99c3-06a2716645eb", "value": "24576:Nw4UZvybcv8vPGFi9UEBEIRoeOMp1xY6Hl:N6d8nGSUOEkOCg6Hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827747, "uuid": "1b9bd9a8-8d09-4346-b792-2d740ad71c01", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827747, "uuid": "3438f0b3-8f88-4be8-9845-130fdb96baff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827747, "uuid": "ef7529d5-eb0b-4c11-a554-dd6e44665221", "value": "INV O000000000000005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b51c599-0ccf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658831944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831944, "uuid": "f6620b4c-5bf8-41b6-9193-7cee07f534fb", "comment": "Malware payload (Mirai)", "value": "2eb4e0d6b9e09639921d75469c12a849", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831944, "uuid": "03541d5e-85a3-4840-bd5a-7efe1879588c", "comment": "Malware payload (Mirai)", "value": "c9c6fc659e4edca1bc0e2d99c363bf508597f61024ce51f67fa131f895e5d347", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831944, "uuid": "44e6c754-7bdf-445f-8fc7-4023c856c31d", "comment": "Malware payload (Mirai)", "value": "5f77d8d149325e475b94c1a184475df741035aa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831944, "uuid": "19fddd06-44cc-444e-b66d-6d488a6964c6", "comment": "Malware payload (Mirai)", "value": "bd1b4ed00f71ee7d09f90e4efb741fc124d5476f86cf9381dcfb508f572b26e58b250d64b22b8c6a453145ea3b6b8a51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831944, "uuid": "7c94fead-30b9-47f1-8db5-16df2fbca3b0", "value": "T1CF7329C469C1E3F5D8192A39612FE732BEB5F8799036EF52DBECD4636C50109930236A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831944, "uuid": "5e9e5f79-42cf-4925-9832-186b7c58260f", "value": "1536:EtaznU3f6vFl4og2ekotzYzM5AQH4YVqKs+O3+NjtvuQjcNqXOSWxjWWWWWWWWW1:aqnkfIFl4og2QZs+5NjtWGGRSWxjWWWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658831944, "uuid": "96b1179f-6677-42ca-b1af-02e1cfedcd00", "value": 79456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658831944, "uuid": "65138b08-bbea-464b-90e2-981fbff88237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831944, "uuid": "55ce2e14-a6c8-4fbf-b6c1-35e65a1bdbd1", "value": "2eb4e0d6b9e09639921d75469c12a849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e53d4a-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658846865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846865, "uuid": "e31e1c8f-8bec-4d1f-9c02-b29846e44a7c", "comment": "Malware payload", "value": "ab0a05c913db89ae8be4f4dd80cb4e66", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846865, "uuid": "3ba9c883-f9c7-4789-b5f2-aff9cc28afe8", "comment": "Malware payload", "value": "ca96847f1b419cbb805966f54c45d851571343f81655d4651946a1843424b07f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846865, "uuid": "c42a4426-1332-4bc4-95ec-a7f4156f9aa0", "comment": "Malware payload", "value": "21ee73f9770ac1f11395f9aadfda028efc3d3c90", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846865, "uuid": "bc6e55d2-6ff6-4da4-9c16-2492604416cc", "comment": "Malware payload", "value": "05ae4b6c08d2049ed61c09208211c381762c81f3e38bed29524078eb1a851d25d796d0b48aec83c0a92314c62c170bbf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846865, "uuid": "295e2b08-21e7-4910-ac3c-a1b3b686aeb7", "value": "T1D5752392BAF74F96E35D52BC204B5F3A10A9FC4E174A70BA7199B9C1153F731248720A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846865, "uuid": "9bfaba2b-2aef-448f-84a3-3d6a904fe948", "value": "24576:Tt+z1Cm61JXzWX9XkGwramEnmzwDu+Vw2mIwEq8PclTR9ZPAWDOL14zXIQx/OO:kC8X9ChEnTq+SIK9P6mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846865, "uuid": "3f2db5c9-fe0b-43c6-900f-045a365459b0", "value": 1602048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846865, "uuid": "436009e0-0afa-4d02-9a21-564216017443", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846865, "uuid": "a3844194-9a3a-4646-b1e7-a133c3d61e4d", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.31094.10169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5812a5-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658848639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848639, "uuid": "4d5f955b-4e04-4e3b-bdc5-674066a31e79", "comment": "Malware payload (RedLineStealer)", "value": "5502ffaa27bbc53c186001d55e8ec6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848639, "uuid": "d6a3dab7-996d-46ce-9955-5cd5fc1e7e82", "comment": "Malware payload (RedLineStealer)", "value": "cb669b48124cb5fa6b643aada9e773454d0db48e614cc54b45ecc319444b308d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848639, "uuid": "2ae3303d-6370-4c7b-b3b9-48df5222b203", "comment": "Malware payload (RedLineStealer)", "value": "4182bd82491885a26c6ebe22a7f1822bcf32a100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848639, "uuid": "554b5058-c2c0-4b2c-853e-9ebb5598b959", "comment": "Malware payload (RedLineStealer)", "value": "2a902fa3e4595f1ba9b1f83af0a2627381a3c052513e10b82741e4453f5e5a079fd8a37f1ea5acc6dfa43c8905db7f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848639, "uuid": "2183c3fd-e332-44b9-86cb-348383ab2f4b", "value": "T1F4558D39EB8629B4DA175771C59EEB379B04BA148032AF3FFF4ADA08B4330167C85255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848639, "uuid": "d0489415-8e31-47bb-8a04-43b356f2718a", "value": "da0a8429d07681e0f845d1d4f08ae833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848639, "uuid": "4d477738-90b5-4dee-b76c-018cc12cc134", "value": "24576:9yoRyOvIhzG1iinaaYXYaonUJm5M9ydT4y0zhcb79oqkwAs+O7T/HLaLjDT:9LyOvIxyFB7B+O7T/HOLjDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848639, "uuid": "2c035583-b0c1-4965-a035-37f959748b92", "value": 1407384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848639, "uuid": "9b694f0e-87a3-4187-a81c-2cc11e39bbad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848639, "uuid": "6c4302c2-62f5-4820-9d1c-80afc8ea329f", "value": "5502ffaa27bbc53c186001d55e8ec6c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd507556-0d08-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658856670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856670, "uuid": "61fb4a10-bdc8-415e-8a7f-c674db51bec1", "comment": "Malware payload (XFilesStealer)", "value": "1a26fe7100e97ea3c1c6d0556a0d87ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856670, "uuid": "5bcf9798-3405-4e1e-a2fc-8bb4ba4c7e67", "comment": "Malware payload (XFilesStealer)", "value": "cbab4cfcbca79f53ed3faf1ea4fc48270b44c50529a96698c3b5ab250e438454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856670, "uuid": "7dcb25fc-5aac-42a9-85fb-dcbcfa2e4a63", "comment": "Malware payload (XFilesStealer)", "value": "20aecd2f4c177ac59900c895c6013f1e7c82a312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658856670, "uuid": "ff59e278-1a84-4ba6-bf98-5290dc178370", "comment": "Malware payload (XFilesStealer)", "value": "ac862fc80d75641540e7a89b823b5192e65f6774f00709c3166ca9afdf0640efcd9b407efce4b421702f653a47fcf634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856670, "uuid": "63246bfa-535d-4f57-bed6-a05dabd0997d", "value": "T10DE4228423D2BC57D0CF9D7AEE0176888567EC6A5E13476AB03C6D84B9200F1AE5773B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856670, "uuid": "e3c5333d-6176-4291-a54e-7f30d686b1c8", "value": "12288:++YYs7AN/uQ8iGw76O31PS764wu5uwNsJazvNpT55G6DnJf:JK7GuQ7OO3RS7bX5CUzVpTbhDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658856670, "uuid": "835c19b4-0bcf-43f0-a9bb-cc63080a3525", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658856670, "uuid": "08a6e755-2736-47fd-8b1a-0311ca18d8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658856670, "uuid": "edb989ef-13d0-49ce-a7b0-7396221e9970", "value": "YUMIPlatform.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fd0d14-0caa-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658816144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816144, "uuid": "ee942bb2-8450-4740-9be1-1d654e2dc08e", "comment": "Malware payload", "value": "cece32f3716e7a6ee2eb4f7ca6959d1a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816144, "uuid": "571e53c0-77d6-4a05-a8f3-a0286fdb2948", "comment": "Malware payload", "value": "cbd5ce212f302bdc2a81485ee4d2e4081bb32559e97aed9b663de550f6a29c50", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816144, "uuid": "4da451c0-10db-4f56-9db9-5b77534c7621", "comment": "Malware payload", "value": "29160fd9ed3b96003f18d239fba78f1a64ecb50d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658816144, "uuid": "35ec776f-b3ec-4ff7-871f-c7c11c09cfe2", "comment": "Malware payload", "value": "8635cb0ecd4cf3017586e3612071e4b163f1c70e0514bf7f23109c5b24f767b1812bf5155a6a270ea358c134201ac5fe", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816144, "uuid": "dbbaf19d-2527-4b5f-8793-600b3a255ed3", "value": "T1F324233A5AE5490C00F6ED7978B4C432EB85D8457FB361AF39A63BC635C03764AA4839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816144, "uuid": "10a9369a-a5f4-4473-bc3d-e6515edb16bf", "value": "6144:DYCACPPFyB2oqBniA3lC+aHaGhCq20gVoPt9BhESaFNZhH3:RD3Zj3M+a6B06ytxRQhH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658816144, "uuid": "e25a0288-5cab-432b-8825-19335798d6e1", "value": 228049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658816144, "uuid": "4ad4aa56-1ebe-4adc-95f7-31bb6bd6435b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658816144, "uuid": "be5e8965-89c1-43b8-bc31-608eba9f4d3e", "value": "Unpaid_Loan_07.25.2022.7191.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f12d835-0d3d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658879222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879222, "uuid": "9b7efdb3-6af1-40bd-9d49-61dce387501c", "comment": "Malware payload", "value": "5ab7f2f81c7ebb143f5e3dd1949ef7f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879222, "uuid": "7f8183f4-e5c6-47d8-bd25-e0b1b8347d83", "comment": "Malware payload", "value": "cc32026b3e9ae6f3c93d8ec1ceb185eabf66be9981752b0623511d2fc1c93501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879222, "uuid": "0cab90f3-2450-4295-9aeb-af1f1721b89e", "comment": "Malware payload", "value": "b704fe0eb662dbbdd43e7a075f08de860219c98b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658879222, "uuid": "62cf835c-c4f1-4139-8b16-3e836788af33", "comment": "Malware payload", "value": "8a8371323ddaf69a7f77a692b63826572cc169433e69c8d9b23b9537755d6c2d14e116e5c5f00c1b5d5feb1c7240d06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658879222, "uuid": "6dadf4fd-7b10-47e6-9e65-7660e9785287", "value": "T1E72449629486009AE53281B5C531BD4C7A2A6C37DF05CF99FEBC1BEBDBC1E419A31706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658879222, "uuid": "c9152c54-644e-4398-aebd-232dc531a69d", "value": "3072:ex7Ooa5ttrdjvLz3m5BOa9VnvRev0SBLyMLDPt+d80UJGmJQIo0BT0nt/jXj3/tc:C7OF5LdrLz3Azv4r0JmNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658879222, "uuid": "83272b01-24be-4918-9a03-a4488beb41f8", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658879222, "uuid": "71a30767-09c1-4602-9dd9-05ebcf23e56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658879222, "uuid": "a61ee624-7b5a-43a2-9036-068dcc96452a", "value": "h1imal.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6473c44a-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658849220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849220, "uuid": "fa94bfc4-acec-4582-8e7e-8a86c367e53c", "comment": "Malware payload (Loki)", "value": "52db61446129ef2190687d959b952e9d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849220, "uuid": "2ff5ce8d-fe4a-4aa1-9f29-3c6fb0863cd4", "comment": "Malware payload (Loki)", "value": "cc57baa27248180731466b4616e0e199faa48f0d3bf640a0bf12f4db06e46527", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849220, "uuid": "0c65b527-a4d3-49ff-8865-d583a414cd19", "comment": "Malware payload (Loki)", "value": "a03adf5b52eeb9d12db54cc097c7a3dc37ecf863", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849220, "uuid": "28d3c48f-ad27-4d1a-8030-1be29c7fae54", "comment": "Malware payload (Loki)", "value": "a321042ea5b9d990ba1bbb454af8bf97cf25bd00dd37588749f0745828fd6768b380baa53b84afd82ebfff7439986dd5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849220, "uuid": "e19dec85-61d0-4d34-8042-c1aabeff2308", "value": "T1020412585B54460EF6D2AA7FAE25C32041398CBC7813BF0BC2EA71D7E7F0A5A4D54392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849220, "uuid": "f4f7ac65-05df-49cc-8fbb-8ee67aab9f13", "value": "3072:vUEvK17SjUkMghUYMRvdFstFtEyF6G9+D2f3ZF2PHWyVXITHZaB5qUoX5o5GWWj:8EvK0jUBYMRvcz9+D2f3ZQPHWyVXC5aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849220, "uuid": "cfd1abef-ac59-44e3-9eda-e29ac6e2a4af", "value": 186008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849220, "uuid": "a1d8175c-6259-429b-aebc-c9471a93a848", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849220, "uuid": "54698ea1-e368-47f5-960a-7749e41482d0", "value": "\u0627\u0637\u0644\u0628 \u0645\u064a\u0632\u0627\u0646\u064a\u0629 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5def1df4-0cbc-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetSupport)", "timestamp": 1658823868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823868, "uuid": "4d1558f7-3f84-4064-9c17-96f82f97b223", "comment": "Malware payload (NetSupport)", "value": "4a25c0fdb8364340222e697da995093b", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823868, "uuid": "6cc39d2a-d753-4f5a-977f-82cb662f0938", "comment": "Malware payload (NetSupport)", "value": "cd1675dfc58d83207ba48ecb51207feb63aaac4fb4355c8eb49505dcfaea562b", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823868, "uuid": "41b13874-5a0e-422a-bbf2-64c1e18e1495", "comment": "Malware payload (NetSupport)", "value": "74940a0ac2f298153376e48745ff1b3ab03c54bd", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823868, "uuid": "fa79054c-c6fb-4eee-993c-4b668c99f5aa", "comment": "Malware payload (NetSupport)", "value": "ce062d9ed49ca4239eb02b5c516ea1be2f1bcffd5c4bdb08f821ae833ac5cd7b7acc2d065619cc68d52e04f7a4257a1f", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823868, "uuid": "de60b547-1a80-4afa-a8ef-3bd9d4a59995", "value": "T135A533B93EC534E3DC1A3532F1FD5284626CBD3196D5912BD356EE718827EA233884E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823868, "uuid": "0e81297f-282d-4a9c-819a-37bd2d40c2b8", "value": "49152:DvzA85waN88kAFRHhzoC+B4zxUzQhNxTXT:DvN6aKl0HhzH849UzsLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658823868, "uuid": "e3d74baf-554d-4e3d-ac07-01a72bb177b0", "value": 2263645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658823868, "uuid": "87cdf997-24b5-4d0f-963c-52d19c152fa8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823868, "uuid": "c292d967-9ce1-4d13-a258-f798558795f1", "value": "WinSupportUp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913a3bd7-0cdf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658838987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838987, "uuid": "ea1a5c01-bd7e-4e53-b34b-4b77d0101c97", "comment": "Malware payload (Formbook)", "value": "7e5e67c6e398af34f1cdb8c5133ed8dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838987, "uuid": "9395c363-e161-44d4-ad0e-f3b7c87b0096", "comment": "Malware payload (Formbook)", "value": "cd8eba06bb4896fa2e84a9f8e9577e027a9e77fedbb5182326d942dee66b7067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838987, "uuid": "08930cf5-c177-4d0b-a1e8-0ccb8cd72233", "comment": "Malware payload (Formbook)", "value": "f515949e0d84442593c56c1b519e476b3f1ba56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658838987, "uuid": "db2eba67-5094-4590-84e4-c82028411685", "comment": "Malware payload (Formbook)", "value": "211d7c90396aedfe660b475c85bf8c5bfc5404c2dd54abb55ba5eabad0e8bae543bca0d1d2965a13a5d2cf38bec3cbc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838987, "uuid": "0f654c16-c5b7-4c8d-8caf-f40339f90468", "value": "T148357C9A3BB075DFCC67CEB9B9742C74A6103666533B9602909315F8B90DB93DE034A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838987, "uuid": "63e97644-b4be-4596-8efd-468fed2a360e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838987, "uuid": "85a1ac9e-586f-40f5-8149-7e52d0472f39", "value": "24576:Rw4UZvybcv8vpMMl06naTgpI2RZzxp+HmV:R6d8hMBTo7+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658838987, "uuid": "d8bc6a1c-7416-4682-99b0-f789ce8da8e4", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658838987, "uuid": "f9a55cdf-598d-46a7-8337-022f458dbf7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658838987, "uuid": "4c321e4f-3482-4a97-8fd5-45798b15d9f8", "value": "SecuriteInfo.com.W32.AIDetectNet.01.10589.8398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc008ca6-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658818013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818013, "uuid": "69bef6d1-c7b3-4748-8072-6636a69d30df", "comment": "Malware payload (Mirai)", "value": "5bf0954d9dcd4eee1ae22697b0c2f67b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818013, "uuid": "70d771a5-d5de-4e58-831a-c39faab17b25", "comment": "Malware payload (Mirai)", "value": "ce8d02721b384f6c1fc46c6e74bb1043bf7b1e01bcf32fcd9f4236c1bf573ac8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818013, "uuid": "3235f223-37e8-4cb8-bb47-b8944b06fb70", "comment": "Malware payload (Mirai)", "value": "2a7e0e6ddad1c3ca59193685b3e7cf4b5a42e141", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818013, "uuid": "e5265396-5628-454e-ad67-c159f53b6c24", "comment": "Malware payload (Mirai)", "value": "32617e5b5c4fd2cd7959461612830f19383da3443bd998def16af24897d3ad166bc2a08bfd079d5fd5c8c5d7b54b172f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818013, "uuid": "694611b3-aa86-4e0f-86b6-b314e36ed063", "value": "T180435C21BA362E1BC0D1A4BA11F74B15B6B16AEE25E4C54E7D720F4FFE116406903DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818013, "uuid": "5931d5c3-f4e3-4596-a6df-353ffc64b8e4", "value": "1536:HZqG1ZUx+/5Yncu63Wn/KXTlpJ7gIfiV0Vl:55h5XTTNgNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818013, "uuid": "037f1e58-dda5-4ed3-bcfd-581b5fbc3844", "value": 60064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818013, "uuid": "ea191632-2553-4638-b4b5-102221cd6aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818013, "uuid": "bd025838-fc24-41fe-833a-8d45181800b1", "value": "5bf0954d9dcd4eee1ae22697b0c2f67b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19a3405-0cf3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1658847738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847738, "uuid": "b3474e6d-fffe-494f-87b1-4872fdf6cf32", "comment": "Malware payload (Socelars)", "value": "4cb9be06f064680d52939eecd7ba1723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847738, "uuid": "57fc6611-b63e-4735-9b03-baf3775231f5", "comment": "Malware payload (Socelars)", "value": "cecf17f5684028c26876ec62f2ab64dc2b0bb899077c1edce71fe3ba581e39e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847738, "uuid": "9680ef92-6bdc-4357-95cc-666ebb1aabfa", "comment": "Malware payload (Socelars)", "value": "a12fcd0326074e4bbdb62339f99fb4a1cb8e748d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847738, "uuid": "072132a3-250a-4e07-9473-db77736c37b8", "comment": "Malware payload (Socelars)", "value": "c51768224aabe340bd6d62c7bb91ce6362f3f11f7bfcdf028d0278623778d99e285950be15c5fd129fdcb1d6c691a6d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847738, "uuid": "d3684bb0-24c9-41ca-afd6-de72817d354f", "value": "T10D659F11F642A036EDE3007282FF5AFECD28BA21031454D7D3C45D6A6E619F27A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847738, "uuid": "ec4b0340-bf6a-4e76-8053-423762814885", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847738, "uuid": "1fea61df-e621-45bb-9592-3357a3b12533", "value": "24576:OsLp0FasdJu/+/dfMs2KLoyaU/5DejgtMyPtTEZ0o/WMd:jpncZO+bCyPtTEio+Md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658847738, "uuid": "a05b9095-8f28-40cb-bad0-dc50fd08d6f5", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658847738, "uuid": "2da3387b-cf78-4eb9-acf0-86b0f6719d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847738, "uuid": "3590b3eb-8314-4dbd-8c12-98eab34bf2f9", "value": "cecf17f5684028c26876ec62f2ab64dc2b0bb899077c1edce71fe3ba581e39e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89ff476-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658848555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848555, "uuid": "edc06002-3332-4702-ad09-e8b2590dc655", "comment": "Malware payload (RedLineStealer)", "value": "d6f0163147bcc42acb623abd002cca71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848555, "uuid": "b60462e1-cec1-41b9-8120-91a904059c77", "comment": "Malware payload (RedLineStealer)", "value": "cef86aaea77b2d3f0d449003b1dffa9e8af91d4d1f711f0da7138db754f9d2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848555, "uuid": "1584e842-df43-4f0a-b0fa-077f47c0db13", "comment": "Malware payload (RedLineStealer)", "value": "481575d2eef86e0c0712a9ec66290ef1f5f832f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848555, "uuid": "2f64952d-24c0-4637-afda-7b1e41a2c66b", "comment": "Malware payload (RedLineStealer)", "value": "19105ad91f615b284a5bf8fecf8aacf761f035f77dc0b0d5327c5f9a54fd092aecd3b370db6eb213108f14b5b26f9d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848555, "uuid": "d51ff975-bb7c-4012-9a09-f91015cc017f", "value": "T14EC50A136ACB0D75DDD23BB4A1CB633AA734ED30CA3A9B7BB608C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848555, "uuid": "02b0555c-169a-4213-a10c-8e493cb73320", "value": "da0a8429d07681e0f845d1d4f08ae833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848555, "uuid": "435f3f3e-318f-4729-8b44-6a3bf92215de", "value": "24576:syJByOvIAzQKrZnasYXYrMqDJmqML9dTVy2ufBbTxwmSx+65c+os+O7TiiLoLjDa:sWyOvIeZXDXnNA+O7TiiMLjDtAl3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848555, "uuid": "2af31a81-41e0-4d92-a955-1d47f3c3a13b", "value": 2551713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848555, "uuid": "75ec2148-9eed-400a-92e9-7949776024fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848555, "uuid": "b5f7e4c9-7db4-4f7e-b34a-13a3a42f187a", "value": "d6f0163147bcc42acb623abd002cca71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35425f93-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658849140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849140, "uuid": "8cbe5106-fa22-4994-a476-8b32b0f36952", "comment": "Malware payload (RedLineStealer)", "value": "3328abaccbf37c8160845ce66c4bcc1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849140, "uuid": "c6fa9556-8ce9-42ce-909c-6709a27914af", "comment": "Malware payload (RedLineStealer)", "value": "cf07409f4e5046042afca5fe4ccae8b22e6f96e4ba957543d7c93bcc2652ea5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849140, "uuid": "2f68edf1-623b-42fe-9322-9726b791f8cd", "comment": "Malware payload (RedLineStealer)", "value": "1955d16afe0f71d0199480cb325d1bf60493d96c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849140, "uuid": "4a69c0b0-9e43-4e9f-b968-b921af3b0217", "comment": "Malware payload (RedLineStealer)", "value": "c4efc79744c5827dabb62cbf26199625bca3eda04e542d5aebf48af0b705cdf2e5e725e0d13dd5a40395ff8b0e5e0128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849140, "uuid": "ca1c5ea0-5a73-400e-b107-fee108381d73", "value": "T17CA34C3077DC9F19EAFD1A7564B3011443F1E08B9092FB4A4EC4A4EA1F67B42592BAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849140, "uuid": "bd59fc79-82cd-4343-9817-3193343f3e54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849140, "uuid": "5362b932-a45b-4576-9983-b7a0a9d9b0e5", "value": "1536:V907dL28btlbG6jejoigI2yYLB3UicrMFW08UAiqumbfcxv0ujXyyed1mtmulgSG:o12iLY2ciRWjUA57C0ujyzd7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849140, "uuid": "cbf9ad23-db9d-4335-9190-2c5d80fc4764", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849140, "uuid": "d1a69e67-964e-4bc8-a325-d8d098f76a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849140, "uuid": "945be998-1056-4b5f-ad78-a48e9401200b", "value": "3328abaccbf37c8160845ce66c4bcc1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb5d619-0cbb-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658823386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823386, "uuid": "1edc28d0-fd4b-4d6b-9a00-d4ea570316c9", "comment": "Malware payload (AgentTesla)", "value": "d55ab6e5a705e970ad32977be467294e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823386, "uuid": "17628292-f935-4630-be9c-c61f7ba2a7f7", "comment": "Malware payload (AgentTesla)", "value": "cf1d56bb74474aeee555731dc0ddbfacf0e4ce6adba42070154a4e2aa157b532", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823386, "uuid": "1f48d394-512e-4ce1-b380-6f5285b1a51b", "comment": "Malware payload (AgentTesla)", "value": "286c13677d6e0ea6450d11028cce45a3f5552a88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658823386, "uuid": "0592e95b-e41a-47ab-bf4d-e13cf4f148f8", "comment": "Malware payload (AgentTesla)", "value": "fd61ee3059054ca43a24ab617e510118622d001199bd027d9642b66284183da405b8a277e1daf561142aa20ff9efe4f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823386, "uuid": "951ab491-9a28-4690-9cd6-609f5b236518", "value": "T1A9E47C9C3692729ED917C4718FE85C64EA60B877970F9213942323ADDB2DDA7CF110B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823386, "uuid": "45feb83f-f69d-467e-8ae2-f2b24c363f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823386, "uuid": "a8c03984-bc64-4a65-abd3-c96e8220a957", "value": "12288:OVcgR2iNDXR0GncRYx90+HKXE9i/KhCm9oD208AnZIoa6ew6J/O+B7UPzMIr4ujQ:2cW1rRnc+xVH0Qi/KUmMRdGTTwcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658823386, "uuid": "38515410-011c-4c26-9bfc-3cf32ab806bb", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658823386, "uuid": "fa7b3b0d-2b18-414f-a419-fbe2c58aa394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658823386, "uuid": "704b6f20-747e-4e53-ad1d-743579286c44", "value": "d55ab6e5a705e970ad32977be467294e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc43fc5-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801645, "uuid": "45722042-fa79-4dc7-a3d2-2a9df88363a3", "comment": "Malware payload (Mirai)", "value": "4bb4820d5624775be3d8e140af8083bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801645, "uuid": "051cdde2-c6e3-41bd-830a-2c4d29a5dff7", "comment": "Malware payload (Mirai)", "value": "d156251720a58a83171d37d84fd9d174fb7d0fc1a4212603d676bc79a41ca32c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801645, "uuid": "1ce84b1e-1a02-4398-96aa-f4adb95d43f3", "comment": "Malware payload (Mirai)", "value": "a6531369400fdc0a5c76eece381a984fcbc4e780", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801645, "uuid": "47f1fd4d-8a95-4279-9442-24b7b11dccd7", "comment": "Malware payload (Mirai)", "value": "e21d0d02490941ea3cc0a09bd24426559c466d6aed8ae599f46669f23c7d2444e9d38082b72c2bcca2224ebfdcd36905", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801645, "uuid": "80c90535-92c0-4a76-80cb-a7e23f8a9874", "value": "T19292E128994BA9B2C3A04D3FF57C46A167EF09F8D2F43B20395843799A4106C6BF8747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801645, "uuid": "d566a8be-ddeb-429c-a40c-bd702f03689a", "value": "384:g7y9AFUB49/SFR5SPqYgNNXUhymdGUop5huyfn:mVFxSb5J3Nes3UozMIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801645, "uuid": "b3ce87c9-3ac3-41a3-a403-7dec34a8577e", "value": 20504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801645, "uuid": "2dee3698-3e28-49c9-9776-55e64f065179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801645, "uuid": "ec150788-24cb-48e9-bd8e-5f831f9b4280", "value": "infect.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0b16c4-0cf3-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1658847680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847680, "uuid": "555cf53f-7e8c-4311-af6d-c3c5cacf60bb", "comment": "Malware payload (ArkeiStealer)", "value": "f4b7a3305f148e7f694728012325675c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847680, "uuid": "42959779-ce04-4e0f-b6f0-8e2c8f34d6b0", "comment": "Malware payload (ArkeiStealer)", "value": "d1c44903ba997665c526db05ae246d5cf7afe31059702ce87bdaf2fcfef0dff9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847680, "uuid": "65a1dfdf-ea93-4a76-86c7-7fb87b6bdd19", "comment": "Malware payload (ArkeiStealer)", "value": "c776add9d91de18873b068a2990a1c115301fde0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658847680, "uuid": "99f32da8-d9be-469f-9790-2b418b3e6cc8", "comment": "Malware payload (ArkeiStealer)", "value": "726208afc06a37ed177900a2be556ba81ea67fef4f4c3dcb67d45b0b3259ed38d0d676eded1cd787842a3a743c9ef142", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847680, "uuid": "a879bdc5-e341-430e-9749-e9d0927d55d5", "value": "T1EE64AE1677A0D032C2274631DE89A7B98A6D68317551604BFBD06E7EBEF02D3DA3470B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847680, "uuid": "f2dce23b-6660-4862-b987-72b60bb5b010", "value": "7bc932b76d6fb40222dcd19da77d73b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847680, "uuid": "de71864a-904d-4a4a-a80a-bf0938826441", "value": "3072:KxN3Blgx7Qk2kI/Si7hdMgffTqY39BdpHbWQeIRvCPTTVwG/MEJAid1Sd1FaF2U0:mNldXAmfVNR7WQeIqnVwI7d1SdcXyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658847680, "uuid": "7d6698d3-4f14-488a-a324-30ea9a7d5fb7", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658847680, "uuid": "718f7efe-bb7f-4c5e-baf1-c59925b266f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658847680, "uuid": "1da72ae4-3fb5-407e-90b0-a9958ea2df6a", "value": "o2p0l5hnl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdbec6a-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824462, "uuid": "82f4f15f-1064-4e87-969d-48a6c7fdb548", "comment": "Malware payload (Formbook)", "value": "d70019049c7fe356e78f4fda0ed33acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824462, "uuid": "78c0e86b-39f1-4a74-8de1-4d131c069c34", "comment": "Malware payload (Formbook)", "value": "d1ee65ae6b1b208435233e5fd097225a2763fc88a429a44c84ff82f05bae7af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824462, "uuid": "5f43a985-0cab-427e-88d5-9db73ddb0cbd", "comment": "Malware payload (Formbook)", "value": "1228f63167b11e37f0c65f333f72cced874a2e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824462, "uuid": "92e02f99-d2b9-4e23-8531-312ce6418b92", "comment": "Malware payload (Formbook)", "value": "12f8d4c7cef633031593a39c6b02d7b30b091aeb51f7e559dbba9718a607b372be0e97aff8fe4cd3b854e46f2d26569c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824462, "uuid": "89103edc-c8af-4cec-910b-6afe6681a099", "value": "T18B944E2C3A6D5AE3FC1FC0B045038A94BBE20B87364099935BCBA5F9875E1666D54CFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824462, "uuid": "c2521f80-6936-4e63-8a51-976335e6213e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824462, "uuid": "d9113c9c-bf42-4c08-a9c3-42e606859ccc", "value": "6144:okHwe/MEf2aqtX/CojLBUfrJqqqUpcx/CkEh3GYUkWJt1forPnntHPhp3fuD:dQ1y2ab0BUzD3cxfCWS6poj5P3mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824462, "uuid": "46a11a81-eb7b-45ec-8d97-fc1b02eadd7e", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824462, "uuid": "2f662d71-ae34-4d46-818e-0a251f81bd5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824462, "uuid": "3035f151-aca1-441d-9e49-504bd6275212", "value": "SHIP PARTICULAR MV ADMIRAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6efc644-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658848902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848902, "uuid": "ce22233d-1745-4317-bea4-180a115786f7", "comment": "Malware payload", "value": "896eeab4303f2896a3142808ec21e12e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848902, "uuid": "8bad0b23-c9ed-4746-b142-2db25d0a3d1e", "comment": "Malware payload", "value": "d22422e4dfa3d697d55cf9027891ef1968c2dfd92e7a4e0e5cd87d8d0c694bcd", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848902, "uuid": "2af12bfb-7eb7-43c2-9a77-6075e89f5dd0", "comment": "Malware payload", "value": "15059852f84673ef6c2b380cf94d8ef384eda681", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848902, "uuid": "a8b6b3a3-ea52-40e1-9502-b951ca9becca", "comment": "Malware payload", "value": "575f31b2ec9abb43ef97602e736111ffe2e074948e6d25f3ac649e7ddc335102070cf929beef55319647f410f8a1b2b5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848902, "uuid": "13251425-3f0a-436e-ad04-91c9090491e2", "value": "T10904DF353A92C854D94447330CE596AA7637FC918E7B438B32D5F32F6EB379089E2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848902, "uuid": "3019ec3c-4d13-4ed3-b18d-9f56770817b8", "value": "3072:UrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAL2QdpqPDoGJEDUToaLV8sJcKxn/dwfG:+xEtjPOtioVjDGUU1qfDlavx+W2QnAL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848902, "uuid": "2689848e-d3dc-4039-9db5-a23d44ff0645", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848902, "uuid": "f2926ef2-cb1e-43fa-8c35-4f71a4cc64c4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848902, "uuid": "5aab5221-fc47-4bb8-8941-87fe09630cfe", "value": "Product-Description.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214aef0b-0cf5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658848248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848248, "uuid": "4128ad1e-d751-4549-8798-449968fdee3d", "comment": "Malware payload (SnakeKeylogger)", "value": "8ebcfb76f35748c0f7b03447197cf452", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848248, "uuid": "01f1459a-6678-44cf-996d-4c17bb4f0b94", "comment": "Malware payload (SnakeKeylogger)", "value": "d28be2bafd6104e7a6ba1f29f9fd8aa259b05b09924caa976285238e7ff71677", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848248, "uuid": "df8ff71b-7e27-4e34-92b0-c2cbf127ee31", "comment": "Malware payload (SnakeKeylogger)", "value": "f0aa1e4df0e1e8bc7c8da267b5acf037db5be729", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848248, "uuid": "13f440d7-cce9-4d5a-9f0b-b3f444415fd9", "comment": "Malware payload (SnakeKeylogger)", "value": "6f052cf7e114754e1356612a0ba6745a4c821d6081a1aac106bdf6b75f65eb2f612e4fbb576665535196873329f4a20b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848248, "uuid": "01eab8a4-dfea-446c-9218-b1ceb1c39415", "value": "T1A8B412512A654B75D97E4BFCD01271002BF1F1677341F729BEEAB0C16AA6F210B60AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848248, "uuid": "d3ca3d06-3c68-4d89-806f-80d0f6d8964a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848248, "uuid": "a914c642-c867-4eb1-84b5-41cc4e14a12b", "value": "12288:EjD3dv30XVIYa5/sja28bdonygwVHNVZ8Vx8:K3dvEFIYa5EWbbdoeXZ4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848248, "uuid": "9036a7aa-0866-4cdb-b07b-9395195473b7", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848248, "uuid": "42b04f14-306a-40ef-9307-28638b617613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848248, "uuid": "f24966cf-d9d9-4958-ab0d-c68f73ee7082", "value": "Dhl-51015370367858.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddc8af8-0cf9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1658850014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850014, "uuid": "2ee32244-80f2-48c4-920c-ca0f018e2a45", "comment": "Malware payload (RecordBreaker)", "value": "f052acab310330627d5e20b1107b9d76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850014, "uuid": "5dae5a24-2498-4ef4-bc8b-575392b06858", "comment": "Malware payload (RecordBreaker)", "value": "d294a8bc0b704479728f1db750e69503c7d9623690b5b3fbfd7802c4e0be10b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850014, "uuid": "aae06ca4-61e9-446e-bbf6-dc72ca9f281d", "comment": "Malware payload (RecordBreaker)", "value": "6bd331d16fbf5dc132d49458f4649c28ec871c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658850014, "uuid": "b11e58af-d205-4874-929c-b8acea40c3a1", "comment": "Malware payload (RecordBreaker)", "value": "01f9c027fd9c24cb321f5659e6b52fd1b0ab405e55075dd25328e73af06432add3846d94c4e8dabef3d87cce90f1eab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850014, "uuid": "6b4d8d1d-9c7d-4208-bb0b-d5a8e55ffd54", "value": "T13465232DA641513BD0931B74864BE3B5B632FE084BBD55CF72CD0E1E6D3734B0A6928A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850014, "uuid": "5909b675-c8de-47ce-afa6-6f4d13c70ceb", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850014, "uuid": "b4c22939-f373-4979-af88-cb2b44409671", "value": "24576:pAT8QE+kdj8L5W6+QqPgXOuhtFYJH3qlXPdu/NGb/r/fE5SZSledc9tGnJcnUZ/f:pAI+WYLA6eJUtI3+Xlu07fG8dcvaJcn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658850014, "uuid": "7a13bb3c-6cb3-49bf-93dd-7f6b89110ea4", "value": 1426131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658850014, "uuid": "86a4e647-ad89-4921-b410-fadfd82c5e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658850014, "uuid": "ef1ce544-3399-4d30-906c-9cdb2b836604", "value": "f052acab310330627d5e20b1107b9d76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0764cfca-0ca7-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1658814704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814704, "uuid": "382edbfc-e72c-41cc-b833-3c48b4242d3e", "comment": "Malware payload (ModiLoader)", "value": "0dfdf8105fbdb69ca7634f5d1eaeba7f", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814704, "uuid": "5cf46797-3db9-4f88-a5dc-85caffa25ceb", "comment": "Malware payload (ModiLoader)", "value": "d30948540393f18ecea174d4d02af2946592d9643e48e704673aa55fe60ddf64", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814704, "uuid": "90cb1283-d376-4b65-a3e9-3af6d0e2d1ff", "comment": "Malware payload (ModiLoader)", "value": "4e79b51f68e459b52d1a384e3088a954a7d69a78", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814704, "uuid": "08bcd6cc-ef3e-4db0-a2c1-fedff9b222bf", "comment": "Malware payload (ModiLoader)", "value": "807761d88c2234ea93db6a982b49f781735903aecc49df66e18c25e071f89ecacaff2c48b6a1ddc525914b16160cf963", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814704, "uuid": "fb3e14ac-89c8-43ed-bd3e-7f8ddbca29b1", "value": "T1F694231E536F680FDA518F558D84670C9FD98FD0D816ECABE5DCA0B1E2A878304E87D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814704, "uuid": "9e0d3624-82d2-40c4-8e7f-401edcd57d77", "value": "12288:f0jM8C8Wb8iilPMLJ7jH/yJQqSKEj6Y6EwzWUg8Xw:f0Ob8iixMLVjfZqtEjvCEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658814704, "uuid": "d70adf9b-8314-4f90-9d85-d1bc648daa41", "value": 432163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658814704, "uuid": "975e14aa-da73-4aed-8548-77fc2a265b44", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814704, "uuid": "a3a02719-09f9-4c7b-adab-e56f462a1cfc", "value": "FEDeX-Tracking Details_Updated.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4975e8-0d2d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658872368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872368, "uuid": "1baede1a-43f5-4f04-af9b-97c24d987abb", "comment": "Malware payload", "value": "dfe9eb9641a6d2b8c20e3697068d24c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872368, "uuid": "d8fb9507-a29b-44b2-a7de-acf3a97965b8", "comment": "Malware payload", "value": "d31c93c082d1f410c4ff31dbb88d43b96b1fc06ccbf78293aa3159a317350de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872368, "uuid": "eb7116bc-db4d-4291-bed9-dd1cfb5603a0", "comment": "Malware payload", "value": "e6f97f79fbb982ed17848fea75e5072ce6d1b90f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658872368, "uuid": "691e3784-53d6-40c8-8a68-8957e60ae1e0", "comment": "Malware payload", "value": "9368abb00ce466836f29c1e5ca31e3ef77c589f97912a4a180e8e81db2af5169e3eca21713cd3a63586a31ec812233fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872368, "uuid": "5dfe54e4-d02d-42ce-9ed4-53b2ee4ef2e4", "value": "T1A5D4CE21258B7714EB39F77816D8A060AFF5EC13D305E16D6EA633A68737E604E72123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872368, "uuid": "b99229af-4e00-47d6-9c3b-aee4d55811a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872368, "uuid": "fb2a43da-a140-41e7-850d-092373f00916", "value": "12288:2UMWuajixgV2iND5HlQkxpoSyntiRhXz7q/wY:2SixgV1bekxpodntiRhXz7q/wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658872368, "uuid": "4e732590-e84a-4c60-b20c-c2c04434fb25", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658872368, "uuid": "d0789410-5a3e-4c1e-82b5-914d71c95eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658872368, "uuid": "8ebe9559-987f-4e07-aeef-fd7705aceb9d", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ef3c14-0cc5-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658827633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827633, "uuid": "97a4d45e-84b7-4ea7-9989-75083e196517", "comment": "Malware payload (RedLineStealer)", "value": "e2d89c8d6130689b8dd21eaff2082c79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827633, "uuid": "fb7b19a0-fa7c-48f1-b305-de4e7059829f", "comment": "Malware payload (RedLineStealer)", "value": "d400f72babb8d1860cb0f5e3a48322ac0dcb5cc5917f6099f48f7ce5be5f9086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827633, "uuid": "bddee912-6f99-4636-81bb-83e23c4adae1", "comment": "Malware payload (RedLineStealer)", "value": "ef01881bb1433494a93371e788585ddf08cee4d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827633, "uuid": "d6ee7d97-e360-4170-8f6a-7cd1ebd89104", "comment": "Malware payload (RedLineStealer)", "value": "a5a025d457f9f2d56379a6047405bdc7848e813627826280dfdba066fa21a6d22da7a996b2b1896a0a76344ecb4f99f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827633, "uuid": "dad9c211-b259-47ef-8a5f-0e6cf84d354b", "value": "T120562080FD3C5535E0D7553788BB720BE268E9FF6BA0A502AC2C5961672359C1CB38BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827633, "uuid": "3aa2c64e-3408-49ba-a8c2-df1a86d91c95", "value": "5e79f75a686d41af0f44cfd9665020d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827633, "uuid": "209daa11-b7cb-4d20-a1a2-f104a41493a3", "value": "24576:M2dmmVhxV+AXJ0A5zJpk5wzTsIrlyKAFhYaWTWF5KG:N336d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827633, "uuid": "edf35b5f-d667-446d-aed6-be5a04b78693", "value": 5925376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827633, "uuid": "85bc4a01-b445-407f-a268-a287eb6c0e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827633, "uuid": "faa02a59-3ade-4615-b8e6-4fd189739b51", "value": "e2d89c8d6130689b8dd21eaff2082c79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30859b4-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658817971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817971, "uuid": "7a0c7b37-1cb8-4c30-8566-5a6b1ddbc297", "comment": "Malware payload (SnakeKeylogger)", "value": "17c088b92377c557f1383f440d1a4b3e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817971, "uuid": "17cb41ef-744b-4e8d-9c13-9422a449504d", "comment": "Malware payload (SnakeKeylogger)", "value": "d4373d9ad0fdd30a20fc7a01f266a6db3279a85c0c7cb8214dea7bf9a21bd4cf", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817971, "uuid": "3e9874e5-0157-40f0-8c1d-c9552e2fd9ab", "comment": "Malware payload (SnakeKeylogger)", "value": "02a173d87d7f4d837e8e13957ab9317be4ba6371", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817971, "uuid": "9d5c9049-5d5a-4747-8d3a-3efb1df5635a", "comment": "Malware payload (SnakeKeylogger)", "value": "0c185c2068877e135fea0d75e6bb4d7f09120999032185b074c52b54c450aebe14b8674817eef3979cd1793294d5f026", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817971, "uuid": "bd595047-00f6-4dc6-9874-5615e08cb70c", "value": "T11B515C7CEC1BE270E8681D38A1ACB060322D7D3D188C8E942909C5705B866F73C53ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817971, "uuid": "e645bdb7-7a8e-4c19-80b4-8e7052a59e14", "value": "48:9/1OeSFGjkd7hNZXEiAH1rKP8p2UDlQMeqjH2A4GXwSfykwCNve0D2PiSLY0:11AnHEi9pUD+GrrwCNveE2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817971, "uuid": "600fce4d-8908-4a5d-89fe-2863f99ef8b2", "value": 3013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817971, "uuid": "f0a83454-05b8-40c7-bed8-1b4481eaf310", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817971, "uuid": "fc35d708-d9de-4521-9238-3f63d7d3c55a", "value": "mLTQD.zIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a43ee6c-0ce3-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658840478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840478, "uuid": "d6b10b24-1707-4b6f-b99a-39af1e958497", "comment": "Malware payload (XFilesStealer)", "value": "c78020d9a17e9ce1a42cf5ffeee07f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840478, "uuid": "7af596ec-27f7-446e-953e-4324333b94ad", "comment": "Malware payload (XFilesStealer)", "value": "d4611165f4a07c224687bd53d116ae8093e8a94f2d0b719852285b42a30fecfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840478, "uuid": "a440a51f-7f17-418b-8090-be5438309965", "comment": "Malware payload (XFilesStealer)", "value": "995e33c60d6cb62d44f75f049ec16bca438fa5ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658840478, "uuid": "b009ba3d-87e5-4570-9e12-038a80090dd4", "comment": "Malware payload (XFilesStealer)", "value": "dd043f14932608f56f600b52a50199abd427c164dd355bf38ea448adf9af731e96cdc6bb28bcb3bb1cc4cc061da84175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658840478, "uuid": "8d80af5c-c7ec-4a61-a6aa-a27f0b6316f4", "value": "T1AFC633650EFCF948FE94853D88636C0B1AD9B81DEF29EE8323B19D54CC35AD2147D286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658840478, "uuid": "8fbfb743-7411-4e22-a548-cdb72ece0bbd", "value": "196608:j3oG9pU2sVmDDk8jmPsmufjUR1sIaVnVovGa4jiBsywBiMMMvVkXGADhUNJ:ToGXH/k8mkmuoRCVjaZBsyOeMvmWs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658840478, "uuid": "f2fcd219-96f9-44a3-ab18-f489245cfeac", "value": 11561584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658840478, "uuid": "818051bd-9d3b-4b14-840a-e757f79cc26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658840478, "uuid": "9aed562c-87c3-447a-9a21-1ed19ce67e2e", "value": "ChromeUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ba09df-0cad-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658817271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817271, "uuid": "a6e2f67f-07e9-4555-b4dd-3c2e6f84e7e1", "comment": "Malware payload", "value": "410618182646a152b9618f485511e135", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817271, "uuid": "61f941d8-d447-415a-9a96-59bff12b3603", "comment": "Malware payload", "value": "d4fa9582da4dd30e6b92b94c52a0fe67f01132da8d40bd229e3c4f7403dc302e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817271, "uuid": "4f1c2c95-5ba5-4815-b3ba-193e79997691", "comment": "Malware payload", "value": "7094a71b7ad5c4974e9db6a179a0bf09b3f58127", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817271, "uuid": "37fe40db-24a8-4922-8175-5793aab743b3", "comment": "Malware payload", "value": "044a09fc1373b2c7c38c8e7c4d2e561b4d62e47bfcd4cf914747b33b7e3f42e96193deb3995351363d7a7520e2b3175e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817271, "uuid": "b387e395-699e-458e-97ff-8a84814269bb", "value": "T11035330AA5249622DDF450F3A9BE52F143EE4CDCE55D31A859E740F067932F220BC5AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817271, "uuid": "5780cdd4-ebca-40c5-9b29-f4f9ae9bc54a", "value": "24576:9BTeZMROUOkTLYOXc8XPd7jLD1wx9Yru4PCmfDFm2aydS+K:iZRkTnM47LaiCmfZMydtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817271, "uuid": "9080196a-244d-49a3-b1ac-f3100ec49c81", "value": 1158118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817271, "uuid": "f0223fa7-dd4a-40e1-95e2-a745126abc76", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817271, "uuid": "54377e1d-725e-4996-b5c9-df970f33f728", "value": "2507-FR-UE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5e1571-0ca6-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1658814472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814472, "uuid": "5a734615-d8e3-471a-a0cf-8fcb8365086f", "comment": "Malware payload (ModiLoader)", "value": "0257de2112f11e4ef81778517fcd5645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814472, "uuid": "17a9b808-6d09-4465-9666-66d36ca17ddb", "comment": "Malware payload (ModiLoader)", "value": "d509f13850c42ed1167dbce488855daf8fef40d16fcf8d898d5fc1fd7b76f569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814472, "uuid": "42a42f76-cfc7-49e5-bf4b-4b49e1e4128f", "comment": "Malware payload (ModiLoader)", "value": "0b7ac74597b3941aba0676caf69eca7582d93d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658814472, "uuid": "8ce4845b-0444-4010-88ac-6b1a565e64f4", "comment": "Malware payload (ModiLoader)", "value": "d2ed4899f3af3f61807d10c7749892ca21170bf990fc5164b8f6accf4e0987a83a50a441c007248cc3849fca36941528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814472, "uuid": "34fe3ffd-94be-4f75-802b-1e49e0a76f97", "value": "T179258C22F2D24433C173277C9D1B5365993ABE102A78DC8A2BEA1D881FFA74179353D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814472, "uuid": "fd50757b-40dd-4443-9bb2-2767ede5353d", "value": "205f6434858f3f8cc9e8b96d094507a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814472, "uuid": "ccd5cb79-60a7-479c-a5f0-cfd99a7b7dfa", "value": "24576:5DA1mchKTwkH17WtMBhiUDxvHiMYStUtVSn52pAf2rDNtl2aCHX:5Dhc8ZPbVI5Sn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658814472, "uuid": "da9910f7-bbd9-4b24-a108-f12eed3b194e", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658814472, "uuid": "ea58bf85-92a0-4045-8f16-4aaea07301e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658814472, "uuid": "4a5cda53-8127-41bb-ac8b-6610f1e86c61", "value": "FEDeX-Tracking Details_Updated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6646884d-0d0b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658857813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857813, "uuid": "2f25558d-cd35-4e58-b31b-8141b1e127ce", "comment": "Malware payload", "value": "eb9590bf67ae61a0425e0f20b562f3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857813, "uuid": "c54bfa11-7c2b-405b-8eec-295fea3349cc", "comment": "Malware payload", "value": "d7069e5c1894839d238bf8e32491c9da345f346fe886b8fd5fb5bd58995316ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857813, "uuid": "99d9e7c3-2b3b-4ccf-8462-1e9030182b9f", "comment": "Malware payload", "value": "6eb4ab4a623801673e64dbe0389c4c8b11e236ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658857813, "uuid": "ad351599-3d31-405a-b95e-be14580fb06b", "comment": "Malware payload", "value": "21626ee067289a7e0ebc6acdcf7bf9d7e05b087959b14ea9769619505a3c52e31769899743feaf6c7dd2dff444d6e35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857813, "uuid": "20399ac7-c155-4c2b-9a50-661a7799e644", "value": "T14E23C7107FEC5301EABE4B3585E3728366B8D95B92C1DA7E488191D27913BC1EA431BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857813, "uuid": "954366a5-e4e3-471e-8198-9d98b10565b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857813, "uuid": "cdb116f6-c7f5-4a05-bf33-00f50447594f", "value": "768:Iwnw7d5l5TYZZbDrxor5bsEBDynaqDM5w01OAfqGKpzp:IUMrQZ3No1bsExynaqDM5jOAflKpzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658857813, "uuid": "68b78c79-737a-46f0-a408-c5c5ae0cd4af", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658857813, "uuid": "1ca73db2-29e5-48ce-a465-3a81bb47eaee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658857813, "uuid": "11bc236c-f672-4383-9be8-35ecd4afb4de", "value": "SecuriteInfo.com.BackDoor.AsyncRATNET.1.26656.24903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc92572-0c8d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Cybergate)", "timestamp": 1658803896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658803896, "uuid": "947aafbd-7e40-4914-b32a-c0b73c63c115", "comment": "Malware payload (Cybergate)", "value": "66a87b563d106753301b349a883eb8f7", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658803896, "uuid": "a7d118a1-0d79-41c2-a40a-32ae414ab369", "comment": "Malware payload (Cybergate)", "value": "d7ca6a9d5e44cbb1ab5b1badecf0a6ab023e6e562a2089ebde235f181d85fbe1", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658803896, "uuid": "54d0dd06-41f2-475c-b942-db156735a646", "comment": "Malware payload (Cybergate)", "value": "df6e478dace0cf3a8117a34c11bd5a725b8d7ace", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658803896, "uuid": "c3797658-ba5c-4fed-875f-59463cf2e3ba", "comment": "Malware payload (Cybergate)", "value": "645c074d6c0fdf75605c1b84bdd008ac6d4e14685ef2125e47289cf192c0e64144fdf577fda23ce0998f5b75c77acc42", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658803896, "uuid": "9bf707f1-f4da-49f3-bf6b-75e9814eb0b8", "value": "T12894E037E2A078EBC30798BD59C154837F2FA483D512885C869AB7557E02463E6FC73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658803896, "uuid": "de3d7dfc-1fcb-4592-9b31-8b393a117cd8", "value": "b933ae8a43209add82755dbf35ea2600", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658803896, "uuid": "134ecc11-b9a4-4453-a521-5a814a500017", "value": "12288:zQsboe9nYIEE+T7TdkQjKm0nsJgNpvTcuE6RsI7P:EFWYtE+7dkQ4YgHwuE6R17P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658803896, "uuid": "e715533a-d859-4726-9a3f-07e368c7328f", "value": 434597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658803896, "uuid": "1e3ffba7-66c0-49d4-919f-f7764c8a96ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658803896, "uuid": "f50c9b31-7769-4470-aca1-ef776d1d92e2", "value": "D7CA6A9D5E44CBB1AB5B1BADECF0A6AB023E6E562A208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aaca9b-0cb4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658820660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820660, "uuid": "2da703fb-f622-448f-b968-580220f6c9a6", "comment": "Malware payload (RedLineStealer)", "value": "2a37ba09699ea360ee1bb76753a0fe5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820660, "uuid": "a8d461d7-5d51-486c-b216-d066ca7ed436", "comment": "Malware payload (RedLineStealer)", "value": "d816d7d5b5bd82c20a23960736c9884a5152387d9df70bbbc9d77e2ddd106fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820660, "uuid": "54da8ba3-f06d-4edc-a44d-e5e4edda71a2", "comment": "Malware payload (RedLineStealer)", "value": "54e5483e3779674d58c3c76539456a9afbab79cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658820660, "uuid": "78bf01d7-1b80-4711-9b44-029eaa80dda7", "comment": "Malware payload (RedLineStealer)", "value": "24833b6bb8bc90760e512ae274d89fdb8a74358795dc086e0e45dfb4e2250ce1d52085e023b5bafef9a1be19a4faf02f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820660, "uuid": "0518772e-87fc-4a0b-beeb-13cac3b71b93", "value": "T1FA94CF40B6A0C03CF4B752F4BD79C3A8752ABDA19B6051CB32D57ADE46342E4ECB521B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820660, "uuid": "06647557-0f88-451d-a4b9-648ca0bb4ac3", "value": "504d97a665c5990d2e90f1479886157c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820660, "uuid": "23004e04-63f2-4535-ba3d-0d8021b00c7d", "value": "6144:lAEHqsqRsilWUl4re3gvdqUUUU6rNI1IiFCPThsfxlU5MP3LaJ/DWf+QygfLG:lGhsixl4re38QIiKul/TUWf+Qyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658820660, "uuid": "6bfc9457-b5e9-4768-abab-104d9456bd5b", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658820660, "uuid": "cd72a72f-a0a3-45ac-a08e-4714eea4dbc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658820660, "uuid": "d55cd1ae-d20c-4789-9f54-da20ee692174", "value": "2a37ba09699ea360ee1bb76753a0fe5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2010933-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801649, "uuid": "e1ca1ffd-de64-4fc6-9194-e012f288d689", "comment": "Malware payload (Mirai)", "value": "42c6b92bb09976ab4c5d90aad1b17733", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801649, "uuid": "ce1a691f-40b0-4d8a-9573-d30e96845aaf", "comment": "Malware payload (Mirai)", "value": "d855e3facf8d9a5d4e1bcfbccaae43daf7e94c628807916eb07d419ddd8a93fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801649, "uuid": "2e408fa8-b3cc-45ea-ad31-ef08b0448197", "comment": "Malware payload (Mirai)", "value": "0cfb05db90981c7205ad21e381dce82cc36585ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801649, "uuid": "23a089c7-e0bf-41d5-886a-d7ec75577c62", "comment": "Malware payload (Mirai)", "value": "06de50d6b5283efd9a6432afb572308fa4b2682d5d11c814a68b783b28f031a654d61263f2c82acc3b1632c0766a4932", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801649, "uuid": "4346fea8-a25d-434d-87ee-746d72d47e3e", "value": "T1A5C2E0128166142DC2D509FC4CE371A778DA7821FFCD460F7CA62A971DBA8D3A583D32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801649, "uuid": "58d534a4-ebac-4c5f-b370-a122080aa9f4", "value": "768:NqsiIR9vF9hufKWJLZRJik8GFszXduefsV:N/XF9gfN7RJiMszzkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801649, "uuid": "c7548408-5929-4ec2-b856-15ce23f2d917", "value": 26836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801649, "uuid": "158ffeee-c02b-4329-8296-312d51cb437d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801649, "uuid": "fc464dcd-eb6a-4baf-8339-f0b23975db02", "value": "infect.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b48ac4-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1658824343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824343, "uuid": "62669631-7780-42df-bcc6-e374f2837e81", "comment": "Malware payload (DCRat)", "value": "92a4036d9cb068abe0806868c090d490", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824343, "uuid": "3b021248-e151-4db4-9b3f-c6e02d93310b", "comment": "Malware payload (DCRat)", "value": "d860be9b86d6c4cedd4f7cb06ab1090cfad1a6ea2f713838500b9ef07a043cc9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824343, "uuid": "252b4dec-9d41-4e91-9b5c-99cc27c84b47", "comment": "Malware payload (DCRat)", "value": "35a7e33a7180ecc444111c364f9d4bb53b0929fa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824343, "uuid": "edd130df-a87f-45bc-b09f-6f1b11e0f240", "comment": "Malware payload (DCRat)", "value": "30467832fbcca196495c26f8c8c27089e7264da37944066ae0d59c396b335c103cd3945b43128e4bc787218db3099641", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824343, "uuid": "fbfb5ae0-170f-4f67-abf8-5080b7286cec", "value": "T15E557B027E44CE15F0192233C2EF454887B499556AA7E32B7DBA337E29163A73D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824343, "uuid": "a603ee87-0e42-49f3-ad85-f37af232628d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824343, "uuid": "495ccbd9-85eb-44f1-9ff6-612599d3a851", "value": "24576:FnmM2hSNRbdksISoFp5Jk4irWmc5hoqHp2sfHTp9mD/NZVQCHeWx:F8hekhv0KTv99mDHVQxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824343, "uuid": "5e74f3b2-b328-4393-a3b0-94aaaa61a2df", "value": 1295872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824343, "uuid": "7d97f79e-b6f6-4e10-8a70-6920cfdad579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824343, "uuid": "06f6482b-06a4-4f45-ae58-dca5c21f8984", "value": "D860BE9B86D6C4CEDD4F7CB06AB1090CFAD1A6EA2F713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b01c47-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849329, "uuid": "cd5e0ba4-ffb0-41e6-b6c4-cdf842e833de", "comment": "Malware payload", "value": "d368d379a331e5c908271b3e721315ed", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849329, "uuid": "08f113a5-03f4-4d93-a30c-785feb0de5cf", "comment": "Malware payload", "value": "d887cc3c33557ac04ed425e479d75940f71aeb346180809b3047e29b4269070d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849329, "uuid": "5a45dce3-9910-4a87-b835-974315bf184c", "comment": "Malware payload", "value": "cdab4fb5ea1cd72f687c3d31b049e856447568b9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849329, "uuid": "5bb03b5f-4816-4154-9442-90a692518e8a", "comment": "Malware payload", "value": "b8c9366b9cb29e853d086862f104af35c9f4c7640130328b0f3a92403f4d9e6baa07feb38b7b449a1e35276f8dd9835d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849329, "uuid": "21bc8f9b-963a-4c77-841a-abf69132b5bf", "value": "T136619B011BDA129AE3B74F766BF9F2511636F4B1EC0BF37D0240A48C45A2954EC72E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849329, "uuid": "808ff140-ea1c-4ac1-900b-714846e49d69", "value": "48:8DPbI2/u8BwURtxNqhyBLYAnvgXIzp24eQI:8DT728TLNIX6p2ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849329, "uuid": "c73315be-1a15-4730-b69c-e38579f08b83", "value": 3204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849329, "uuid": "0041557c-52c8-4636-96f4-c11447e29b33", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849329, "uuid": "a53c0097-b3d5-46ce-aef2-0e6a2c5fb71e", "value": "lebenslauf_2022068 .pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986ced37-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (StormKitty)", "timestamp": 1658817953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817953, "uuid": "cfb2037a-563c-4fdd-9a38-960c13c35438", "comment": "Malware payload (StormKitty)", "value": "cde7c5dfeb156e477580638939926614", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817953, "uuid": "6a12adb7-bf1d-4d34-8297-6cc00472f684", "comment": "Malware payload (StormKitty)", "value": "d88aa8b13dd489d8051baf82a5ef10973efaa31d2a485834032d529cedf23846", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817953, "uuid": "1dc01035-7dc5-4b17-85d9-f014f29c82e1", "comment": "Malware payload (StormKitty)", "value": "61d20d0bf37cd7e15042a7d2d9a868afa2af883d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817953, "uuid": "4f9250d8-ebcc-4691-b70a-a18b3f488d23", "comment": "Malware payload (StormKitty)", "value": "ca216d5015b2523ba23d330cbbc1e007f3b2fd0046a50a58259622042936ade15293f01b7267ecf1093d307abbe37a34", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817953, "uuid": "e8576e00-7138-41f5-b2a1-1e78792d8df5", "value": "T1BCA17DB7AD741012ED4E03AB570DA31FA1576E2EE003A69005E03F7A6C9091939ADF27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817953, "uuid": "5737ba5f-d9be-4654-af09-c42bbdda8d82", "value": "96:S5c0VsDz1QsdvNsQeFghMG5mISuz/HW+tlkj4U8vCVWtqGQHbAcX:S5fsDz1Q+oEMGk7zSGj4jqeqGQ7Ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817953, "uuid": "1f38250e-a417-4cf6-8edc-01dbceeb4760", "value": 4789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817953, "uuid": "0f515202-3d7a-4867-bca5-87a65f4fad1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817953, "uuid": "2eaab163-0c05-4bd0-9cd0-ce54ad0a1e29", "value": "yHYWC.PDF.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e6dd18-0d03-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658854431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854431, "uuid": "9a92d31a-26aa-4e1a-8445-c71763914f6f", "comment": "Malware payload", "value": "544107beb5ab8c894253576d2cef1b0c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854431, "uuid": "bdc68e17-8d8c-44c3-accc-3a917ad595d0", "comment": "Malware payload", "value": "d93155adefca33960a5a125f10854dc8178e80e9bf3b86600a4c59647dd80114", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854431, "uuid": "a25619de-9615-48c9-9b4a-ec1fc2958fd1", "comment": "Malware payload", "value": "5f42204b2bac349c60e460b31ed7d8cb3cfc0118", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658854431, "uuid": "b8efbb4a-70b0-449b-a910-7b9818d7aeed", "comment": "Malware payload", "value": "69c34e87ce0d728ff94be70beb63924918503fc542e38d970fc30dbd97813122981f3c6bb8ccbbc89086db5815d79e7b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854431, "uuid": "ab28a2ae-9049-4dcd-8818-4499d8864512", "value": "T189A5C393F6B251E8D9F6C0398B527626BDB1B85583399BD3960086174B32FF0E93E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854431, "uuid": "3440c915-e384-4c5d-a7c1-acc60f57cc1c", "value": "dac5b93f6c258f24c39d99199bbf54c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854431, "uuid": "11a08ca2-070e-4347-8009-9474245398b9", "value": "49152:j5SIVCIjU0CpDH/AHvQAZj2YpZo3F0waehC6CJCRp5Bk0OIW9S+CCotq37IafnWz:ddgDH/AHv1Vmy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658854431, "uuid": "a445f1b4-f9c7-4444-b0b2-9a6d83d4db85", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658854431, "uuid": "baac3241-56fd-4c2a-8161-bd8cbdd7ad58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658854431, "uuid": "8f699a08-6cd2-4f71-b295-8f93dfaa2b9b", "value": "msb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16a889a-0ce1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658839980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658839980, "uuid": "81954006-56bd-4904-b049-83e06cff7e4b", "comment": "Malware payload (Formbook)", "value": "2b745f02e77cde516395697b21138214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658839980, "uuid": "4e06552c-fa8e-4461-8bab-de143fdbe0fe", "comment": "Malware payload (Formbook)", "value": "d9b1dea9a6eb60972869e3bd8f0dea1ba348e0f729129faf6337052fdf4186bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658839980, "uuid": "9c78ebc6-a980-4efb-b084-16f694b619a2", "comment": "Malware payload (Formbook)", "value": "c5d44dc77c43d212265912b17c50a96b44d5fef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658839980, "uuid": "a0a9951d-3439-4161-bbef-da802dd848de", "comment": "Malware payload (Formbook)", "value": "dbd705f8b2d5ba219e42b0e2150c80b791e014b224a835a2517df64b106837e3c54aa60219f268cabfa0818591f5104d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658839980, "uuid": "92922535-d97d-437c-940c-61710ebd5ebb", "value": "T189A4F146F457CFD0F8295773A352872589ADAC98D837941B6BE143CB801E7D806A3FE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658839980, "uuid": "d10db705-4bcc-432b-b59f-481f0f5211f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658839980, "uuid": "ac4f6760-cf37-4086-9cd4-0eead3ad2667", "value": "12288:nIu6j/G1eLs80gv7Kdz8JxRMO8YS2QUHeNnEoLfZbi:nT/eZXTHRu2QFxEoLfxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658839980, "uuid": "fcfffd64-2a90-426b-9953-f11d40779324", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658839980, "uuid": "65b7bc44-1742-45cd-a22d-943338d94f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658839980, "uuid": "32a55b68-de81-423e-bce5-47f8999858f1", "value": "inlawgvd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b65a51d-0ce4-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658841044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841044, "uuid": "2f95942e-142a-4544-8281-71e64436c727", "comment": "Malware payload (GuLoader)", "value": "4c6966459f0eab5873fd5c112625c69a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841044, "uuid": "2ea32b9f-d932-4e4a-b9fa-3553f8fa7e3a", "comment": "Malware payload (GuLoader)", "value": "da1397ae25e670aee10a92b2d3993d045cda7d804668f094944f040f863d55fb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841044, "uuid": "1b625929-5315-45fe-83af-dc954aaea82c", "comment": "Malware payload (GuLoader)", "value": "2742efc22cdf94ad00dd12c2cfdddd6df74cc3fa", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841044, "uuid": "1978b89d-e33d-4edb-89fc-f2e37a515290", "comment": "Malware payload (GuLoader)", "value": "e49e3f886629e003eb921495aa03984b4eea51b8459b1f626196bade01c302bdf5e6333034ea354a7fe2d537265e8bfb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841044, "uuid": "bd99cc5c-9497-4276-9767-0f2f7014a5eb", "value": "T188942309E47BAB5FDD54A1884B0FEE6406C570CEE6C4754C649BE702DBE368F4E2188E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841044, "uuid": "c6f2f43c-c788-47ed-8de7-0b7f32b62167", "value": "12288:PwzyALUY/Qry8B5etKleSxrkDW31J940LUbzBB2:PayW5+yQebSlkW31YDbV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658841044, "uuid": "37b8d611-06c7-4032-b952-d82252309736", "value": 421954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658841044, "uuid": "87712c51-eae0-490d-bc90-256a9f2e9196", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841044, "uuid": "27687bce-8905-4285-bebf-224014f02631", "value": "nuovo ordine del mese 0002327778844495 07262022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575e92a1-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658851345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851345, "uuid": "749ba773-eee9-46c9-b493-c4f3e6369414", "comment": "Malware payload (SnakeKeylogger)", "value": "e35f73bd495850aa45e48520dc6978f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851345, "uuid": "90d67da1-349c-42f0-884c-b023b4031d67", "comment": "Malware payload (SnakeKeylogger)", "value": "db855c07793f58674c2fed0e96fe361bceda2c4d47537b9825238396978c64e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851345, "uuid": "0a41e02c-623d-4c85-a4f3-b928e862d77d", "comment": "Malware payload (SnakeKeylogger)", "value": "68bdca8c4030e83fce0fa06be84e1249396ba0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851345, "uuid": "c41eb367-ff9b-4cb2-91a9-2e0d047a1291", "comment": "Malware payload (SnakeKeylogger)", "value": "2893140e75d39a56cb08c3f0935b13174e91159b4cc08e42f179ecb43f9f088f87209e796b16e88f4eabc931182b49b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851345, "uuid": "ed09dae7-9530-4c9c-9360-7fadc7bf0ea6", "value": "T14C942C2EB7686015D5FBC9B2047266A6AB317D220B92EC0F13C1EA453874643F5B6F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851345, "uuid": "3d996323-07f4-4f36-a330-122b6b252553", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851345, "uuid": "98cd04df-191d-4792-ba21-41c5823b7458", "value": "6144:UvEN2U+T6i5LirrllHy4HUcMQY6zLato8gObOHb9:GENN+T5xYrllrU7QY6zLatoR79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851345, "uuid": "923b24fb-aa41-49cc-9a20-3c1bd8b663d8", "value": 408979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851345, "uuid": "3e6d1aa6-7331-4611-bbdb-b81d9e3eba31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851345, "uuid": "b27c71f5-afef-4c10-8e84-5b5fb1829ff7", "value": "e35f73bd495850aa45e48520dc6978f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc769b2-0cbc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824027, "uuid": "40e782be-63cb-4108-9a3f-4d531adc0bd3", "comment": "Malware payload (Formbook)", "value": "fb399b6632892d4e8ec9e0f7855cdef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824027, "uuid": "44c76a28-b0cd-4a90-afd0-9cc621eb2cb0", "comment": "Malware payload (Formbook)", "value": "dba99585218765f78dddf353fa0bc8cda522649bb25e13d71dfcd316e5d7c3f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824027, "uuid": "bc481c11-f659-470a-a511-0277be68bafe", "comment": "Malware payload (Formbook)", "value": "a117ae3562ee7ab10460312aea893bfd47af40f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824027, "uuid": "3d0fe120-3d26-4920-af99-c6a7769aa055", "comment": "Malware payload (Formbook)", "value": "49eb3f65344fc6047f4c58f3a2af8419be97ce3811557f8fa024a1f990b3c9ec23a42806083ef2251deeef88196d8b87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824027, "uuid": "19c233f0-8602-4a63-9d97-355cf1473d66", "value": "T10E359DAC351075DFC86BC6B989A4AC74EB203C66530B9643909319DFBA1DBA3DF044E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824027, "uuid": "16ecece4-0fe0-45bf-864d-afb0b5ab8d6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824027, "uuid": "9417ce2f-774f-412b-870f-a392c4e49e8f", "value": "24576:Qw4UZvybcv8v7uev+DUa0izOSSMJGxl/H:Q6d8K9UUyS/U/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824027, "uuid": "a2540168-bd7e-4689-ab70-375352886575", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824027, "uuid": "d8ad707b-dbcd-4514-ae40-74fa5bb8eee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824027, "uuid": "ac3ffc4a-fe75-4ac6-8520-366e5cd72536", "value": "NEW PURCHASE ORDER.zip(~353 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3ffe8d-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658855007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855007, "uuid": "b5f4066c-08c7-42ef-9839-e0d28f9d4b68", "comment": "Malware payload (AveMariaRAT)", "value": "b8c557eeca1424f542bb24a9db909f0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855007, "uuid": "9b940cac-bcaa-46fe-971a-ad0a0076a53c", "comment": "Malware payload (AveMariaRAT)", "value": "dc7ee27981481cea1abe6c9db90bd1aeb84885ddd1466d79686bcda0ecb708e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855007, "uuid": "676c4df5-d3ac-4f42-9bff-5bda6991f0b1", "comment": "Malware payload (AveMariaRAT)", "value": "a7dc0feaa6790d2c610e6ab19082f086f1fc4a8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855007, "uuid": "3e70e6f1-4d87-4a9d-a6e0-6513a754de2b", "comment": "Malware payload (AveMariaRAT)", "value": "7e73b6ea33bf7e7b5542e5fe16c169fb651d838e896fb3005224ec3fcad7b168a735f72d45b8cb96bf25af333585d240", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855007, "uuid": "f1813b9b-4c17-42a3-8bba-cf5663e2c6e2", "value": "T17BD39D13BBE64436E6F202B02DB97E7197BCF9341A25C68BA3945546AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855007, "uuid": "032f758e-9ef5-48f8-a31a-7b6812899b8a", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855007, "uuid": "29ff6d2c-6056-4d37-b14d-0e6f1d714388", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658855007, "uuid": "82736360-a415-4985-992a-3aa017d16ae3", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658855007, "uuid": "f0859dc5-971a-467b-8c1a-cef3a022448f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855007, "uuid": "eab06bf4-35d6-4481-95e1-23c3dac04cd3", "value": "b8c557eeca1424f542bb24a9db909f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1ba7b7-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801644, "uuid": "683f61c7-2edb-44c5-8ac9-6f13958888be", "comment": "Malware payload (Mirai)", "value": "bf07a4af369d67154fca7c923faf6345", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801644, "uuid": "ef9e8262-70df-4ea8-9f14-5225466dbc74", "comment": "Malware payload (Mirai)", "value": "dd64d9c3e519d2dab3b14da2096bcbcfea3a856470266ed27d4c7e71b4f6b10a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801644, "uuid": "9929852c-0bc0-40a1-b3a9-8f5da55d3f4b", "comment": "Malware payload (Mirai)", "value": "87d042e3055256d19aecd1130904883107e84b26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801644, "uuid": "49a83950-e7d5-440b-883a-5c72b24379c7", "comment": "Malware payload (Mirai)", "value": "5d1d88be25c9ef9d24a3bee0035798a2b29c89ce7a0c274d7f146909e5e5c52ea30d75ec2f8d3107437a9b9a20a47bc1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801644, "uuid": "90e6333d-698d-4c6c-ba3a-a2415e32337e", "value": "T15E2301716A6865E38154207D7AB44E82A06C47F4F3B33173F2AA44B538619D2EBF4EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801644, "uuid": "f29f5a9b-5c45-4042-9afc-bf3bf99dd070", "value": "768:LB6aX/qdBIwG3/o8zKdheU57/rSWNw4CCd3rf2YYB/79q3UELKw/oWvUB/6AbbP:LHXsBC3/o8Gv5r+WNBF72lyLKw//oS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801644, "uuid": "d73ba099-3008-4862-94da-9105b3fda57e", "value": 49504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801644, "uuid": "d83d5db8-ec66-40ec-986b-2fad89374316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801644, "uuid": "0670666e-fcfc-4060-9b3e-17e99f00bc2b", "value": "infect.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088e7b97-0cf8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658849495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849495, "uuid": "10e3a191-5858-4d72-945c-020b83e2a9d9", "comment": "Malware payload (AgentTesla)", "value": "7ce78287d9a7c474f504a7a1dcae3aba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849495, "uuid": "6c3c161c-0d55-4b03-b142-895633c72e2a", "comment": "Malware payload (AgentTesla)", "value": "ddc5398dc265db1c4df2b4df8f5305e3da5f9fd48d9aadf20d08c3280dfd9832", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849495, "uuid": "9819ed97-c80a-4736-ab14-116b2bd08215", "comment": "Malware payload (AgentTesla)", "value": "82cf5af8a3e48524d6b9f9e1794667c8735882a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849495, "uuid": "eb6e64c6-e7ae-46bb-9b75-94b9b616bac4", "comment": "Malware payload (AgentTesla)", "value": "869a5cba3ca4ab0e51e4c58d7ba711da648395660510dc05ba1cece84708ab04d2c9fef98fa980926790c8e2ddeec945", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849495, "uuid": "6d637045-1242-4193-974b-a6ba125fe8e8", "value": "T1FA34CFD8BA9079CFC95BDD72AAA41C70AF70B4B7571BC243A01352AD5A4D78ACE041F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849495, "uuid": "ffadf189-f4be-47a2-a640-23aba8b60a67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849495, "uuid": "48fe6bc0-1f9f-4c79-b2af-8bbb90e1f5f8", "value": "6144:J0guubaTS9DH4TM0c9rDGAkDUFoKnb5BQ2K+n:Nu3Q84LgbK1G2K+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849495, "uuid": "f5d3792a-cc54-41c5-bfea-78dcea138b66", "value": 233504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849495, "uuid": "d6c8c3a9-870d-4636-ac73-7f192e7995a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849495, "uuid": "5d528e6c-3f4f-4a6f-a2d5-ab591b01e526", "value": "DHL_119040 Empfangsbeleg,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17cd626-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1658828733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828733, "uuid": "a01a2e38-90b2-4fb3-9ae9-6370c0a606b9", "comment": "Malware payload (NetWire)", "value": "b6c18768c7043853fc9879044d10a01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828733, "uuid": "50e05f6c-813a-4827-a5eb-9166f9b6e249", "comment": "Malware payload (NetWire)", "value": "ddd2f1305efa9e79461ecc7e387fc890bba66326cbf18f760887bd97540ba588", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828733, "uuid": "7cd34e84-0b8e-4966-bee7-c6e8b80b60c8", "comment": "Malware payload (NetWire)", "value": "83c8052ab0ee996e96982b3d1b1c5cfc921a0b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828733, "uuid": "c2c2a730-47e1-4da3-a17b-f5c45454a502", "comment": "Malware payload (NetWire)", "value": "5da5ba9878bed7c5ce32e290a97f5257bd4d093b28030fa4add14b1f7228f8150d7b2ef437272654e75d7262721024e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828733, "uuid": "0371b06e-809a-4d11-910d-6ad6e5124a5b", "value": "T1EF2512392AB44F07EDBC8BF8441006109BB57E293557E76D4EC1F0DE2E7AB908946B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828733, "uuid": "a250808b-a17d-4f92-8450-27e94a1c3870", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828733, "uuid": "4381dbfe-e624-460c-9924-d3e91d58374b", "value": "24576:cc8w4UZvybcv8vk7Gs+oRI9TcE1b/HkfhUTNyme/jdTWJjGsx:cc86d80+yI9AiEfnme/jdSJjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828733, "uuid": "f0b9dac4-a577-4aa2-bd67-d5cf8697e5e7", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828733, "uuid": "179ecb98-d7ba-4ca5-ac8d-149f252fc6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828733, "uuid": "99e1566a-6ed9-4af5-b501-c57c5d5406eb", "value": "SecuriteInfo.com.W32.AIDetectNet.01.2581.32314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5c70eb-0ceb-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658844049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844049, "uuid": "f81f43c8-d5fc-4451-a454-6d9c5d702af0", "comment": "Malware payload (SnakeKeylogger)", "value": "108f41c262c645213d654f90f1151bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844049, "uuid": "d677a863-4e76-43b8-906d-0e713c6e9038", "comment": "Malware payload (SnakeKeylogger)", "value": "de915c5f58d13fdc778957e967886c6f61055572c99cfde3d3a01c9248b84f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844049, "uuid": "2f120cd8-4e3d-4175-bba4-752c97ad5204", "comment": "Malware payload (SnakeKeylogger)", "value": "39a616eed07efb2525e8ed811643c7e04174429c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844049, "uuid": "2aea8f35-5bdd-4d70-983d-852aa58cbe32", "comment": "Malware payload (SnakeKeylogger)", "value": "82e0cbf9f4ce131ecfe32777c5a31200d09e2631d71f4e6c47d42a49a799fe8b0949c2ad3d7f6b0f63f6dd6f5b7f31ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844049, "uuid": "06f8c3fc-a71c-4c92-938b-4b4dc4af5846", "value": "T12145AEAC352075DFCA67C6B989946D64AB203CB6570BD607902331DDAE3DBA3CE050E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844049, "uuid": "e17b4773-7714-4dc1-8054-d5c0af817837", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844049, "uuid": "6d956228-f829-4702-a009-b9b503466176", "value": "24576:KEw4UZvybcv8vUg3rAhgFupMhQPol41Xx5ljHQvLe:l6d8VbzfhQNdHQvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658844049, "uuid": "7fe6350f-b13c-47ee-b34b-34da5500ebb8", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658844049, "uuid": "9594ac1d-07a2-4197-80ab-a1ce01bc6514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844049, "uuid": "4a94ffd4-0f3a-4f18-b12b-941f2fe12e04", "value": "M.E. L.O. COOLER PLATES GASKET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7a429c-0cad-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658817667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817667, "uuid": "a100907e-be12-4292-9c44-8af62b8a9834", "comment": "Malware payload (AgentTesla)", "value": "d322b84faf4c81cf3fe19299ba10984d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817667, "uuid": "e56c8232-0146-4ce4-9306-0592cac8fd05", "comment": "Malware payload (AgentTesla)", "value": "deb9e61405ab9e42325c114986687ce3de13d10f68371ae65620460c19b1291b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817667, "uuid": "fb0a927b-531b-4ca0-a941-e2d334a4753e", "comment": "Malware payload (AgentTesla)", "value": "d8ae5a13ebd268c41c4edb3060b77184d1f62422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817667, "uuid": "d635deea-ed7a-4849-b4ab-122c8cb134ac", "comment": "Malware payload (AgentTesla)", "value": "12161879a6a7c0efed174c6c8e07050e053bcbcbc54f07ad3396e38a2f5fba904988d6b579cdab7a8c9230ced4218358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817667, "uuid": "04623355-0b94-42ff-af58-9cf73a9a5648", "value": "T15994A2F872E1E27EC80582312A607C7057F15CA1DD71EA12ECDEF9E4C634EE66B21256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817667, "uuid": "7648f0c1-67d1-4dc4-8732-9742913d623c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817667, "uuid": "722f204a-472b-4410-8222-d74449583244", "value": "6144:7G/xEpREeRkLnvFNNPSNVyojhrxncF5SXKQogLXax:7GUmzp2bhxy5SXKQTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817667, "uuid": "81fcaf36-2e63-45d1-9712-5b6b3689e9a9", "value": 411168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817667, "uuid": "e984e580-6b17-4385-abe9-607b70c9b2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817667, "uuid": "fe7d4942-085e-4a01-91c0-843a63faed9a", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.448.11707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae22d1d3-0ce9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658843330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843330, "uuid": "7d6e4eec-ff80-40fb-bbf3-f9cc0de96fd8", "comment": "Malware payload (Mirai)", "value": "0bb69af4ee885fd0a01843c03ce8f7e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843330, "uuid": "b84f0a48-5b50-481e-9a32-b52084530d18", "comment": "Malware payload (Mirai)", "value": "dedf06be77543ab90c5e8610a193d6fd0f0282bd1a3bdfd2f8e083b18cc18561", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843330, "uuid": "38aca087-9f4f-4cfa-b7ff-cf48bb73cba8", "comment": "Malware payload (Mirai)", "value": "25418d559af2b3a6e31742d641d6928fd24bf63f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658843330, "uuid": "983f59a8-7b96-4922-bc29-ef8ce2f1f4e4", "comment": "Malware payload (Mirai)", "value": "d249be35369387a8fba7eeeeb78ac255d45dcfa81cdee57f187ccfe6e29a4b3cfb0109ca30e0f66810317309ff875556", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843330, "uuid": "3e94cb03-5ab9-4844-90f4-0aedf31d207a", "value": "T1AEC34C46EB418B03C4D51776BAAF42493323E754E3DB330699285FB43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843330, "uuid": "3b329c05-2396-4862-808d-c47fada4ab82", "value": "3072:MPhTAK68DP1S8Crs5FY8G+vWhIaxVLNQj:MPh968DNS8Crs5O8HWhIaxVLej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658843330, "uuid": "5f199c22-587f-4ce2-ae99-712747513619", "value": 128282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658843330, "uuid": "e236509d-b992-4496-8fd3-a84d30fb3e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658843330, "uuid": "9682ae8a-cf1d-45f7-814e-acd1a6958deb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040aa1cd-0cd9-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658836173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836173, "uuid": "d1e31126-8c73-45d1-9d46-eacce44376d8", "comment": "Malware payload (XFilesStealer)", "value": "2a5d4e5cb15563356162d3a6d6353b4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836173, "uuid": "ccf1a838-01aa-4771-8280-1717b161c854", "comment": "Malware payload (XFilesStealer)", "value": "df63c998bbd8f636780ac228fd7ab7c44fe52cd5bdcf785a3944b5721eb7f2b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836173, "uuid": "367a0356-482b-4e07-8b40-eb7b4c5ce3d8", "comment": "Malware payload (XFilesStealer)", "value": "b1c85fa7d41da036c94888bc973dffd5e703b268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836173, "uuid": "da769510-0f02-4daf-80b1-9185c16d0ad7", "comment": "Malware payload (XFilesStealer)", "value": "889e27b1e766bb318fdbe82902fcd1fdd54d201b0d6bdaa5481c493fc0461706f252df63694c4bb7132c7d79958893a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836173, "uuid": "08453b0f-9834-47fe-8d1e-134eaba0cb94", "value": "T143044BFC337A4F56CF6709B788214131633C966424ABE31B636418A9CDA379FE936847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836173, "uuid": "5a3af88e-0490-45eb-8347-b4d089a1334f", "value": "3072:XUhDEEaDmTeTfJ62RJCQIWYmpWxnA6bCE5yJnMpMW0UMZys:k4PfFJJ3EQdEJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836173, "uuid": "f131f798-6db6-4d26-837e-4d039ba0ddb6", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836173, "uuid": "08a96209-0338-4444-87fd-d2432125fabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836173, "uuid": "73ce2020-e7d1-4e4d-a2ee-f9d016a3839c", "value": "Windows 10 \u5b89\u5168\u8865\u4e01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac77e40-0cf8-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658849499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849499, "uuid": "61854215-f96c-482c-b120-41d57d457ba0", "comment": "Malware payload (GuLoader)", "value": "c1dad5e01dccc8d4ea8f004ee559adae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849499, "uuid": "a0cc19a0-d4e9-4743-8af0-9de51c8e9ade", "comment": "Malware payload (GuLoader)", "value": "dfb645322c12b830f6dd90f7f3669ebba3a49ac3910e9962f732b127bf5c1ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849499, "uuid": "170c5b34-b798-4433-b83d-d6ca392c7fbc", "comment": "Malware payload (GuLoader)", "value": "74aafe9de51aecab50069ce565e08b098311818b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849499, "uuid": "4e462d90-2cc1-4803-947b-e9ecc93612cb", "comment": "Malware payload (GuLoader)", "value": "2f54718ffe6a4b64834a3196e0781e742b1ae507419eb263588e600ab45e64e3e0a81431cb255477cf18bf9d5210e3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849499, "uuid": "8b038129-7a14-4a54-a0bd-0d85b97112ba", "value": "T18684DFCB7242D432D47346310CB6AE492675AD940AD14707FB80B27E3E736E16B1B79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849499, "uuid": "0ed68e35-a3ca-434d-b8d5-5d6501f68e06", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849499, "uuid": "18ef9732-143d-4927-a8a9-a332859eff7d", "value": "6144:RNeZPJl0Zar/43SOTGklrru0TSwMZXCf8TwA5WCVmPfFCY:RNkJO3SOyyppGwA51mHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849499, "uuid": "0da1b630-838c-4f4b-8422-5ba261ac68bb", "value": 393872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849499, "uuid": "82c74813-0269-4e02-9c43-e0820a64c621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849499, "uuid": "01e17151-ae12-40f8-b5d6-2d2bf294774e", "value": "Seguimiento de Fedex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bbe1b0-0cee-11ed-93bb-42010a9c0043", "comment": "Malware payload (MassLogger)", "timestamp": 1658845594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845594, "uuid": "0201d9b9-32ed-40a2-b6a2-dab9425e2313", "comment": "Malware payload (MassLogger)", "value": "c5fac65456d0cf57baa56f43b6935ac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845594, "uuid": "cec89a53-423a-4b9d-8ed3-f75b25ddf078", "comment": "Malware payload (MassLogger)", "value": "e020b424ea22cc6206b882a18f6d1e5e39499982e96bc2dfc9bd461e03d40149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845594, "uuid": "952357e5-3fc0-4007-aa14-7c6fd5f2a3d3", "comment": "Malware payload (MassLogger)", "value": "f0128eb5a26160c60a5f41cf1987b34456f21e4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658845594, "uuid": "631295fa-6bc3-4321-876f-d9d6f72d5a3e", "comment": "Malware payload (MassLogger)", "value": "78db1965346a07116a4a7824ce5f93f81b4d3dcd2b9b3c4021b1c6e2c12b9d275893f41cd182a80e7d7473e374f4c350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658845594, "uuid": "8c7e8924-26dc-4d4e-a4e6-3b0ec3ff9981", "value": "T10D14BE987A9078CFCD1BCE7299A45C64AB20B467631BD383A05316EC9E0C79BDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658845594, "uuid": "cc116b63-0538-45b3-8252-24a0de8171e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658845594, "uuid": "7f491d96-0e28-4159-b9a1-fc00996fd5e0", "value": "3072:R1189pcrQ1AoHs183Uae8scYLr8v1HoMo5gvsscsZ+t3AbCwVZOlKpy8R7Y:B8DRrse3s01HpoaxQhAbC28ldE7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658845594, "uuid": "cac441aa-d11f-4033-84ce-71fe5adfe502", "value": 192544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658845594, "uuid": "f20aff48-56cf-4e42-a1ae-e6672d66a3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658845594, "uuid": "972aeae5-ea59-4d50-ba60-eed7a7277b75", "value": "Request For Quotation And Sample.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e4d196-0d0f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658859666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859666, "uuid": "34a9c36d-bf19-4013-b19b-3fa40604af46", "comment": "Malware payload", "value": "c55c526d009881fc505db4c93f510e3c", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859666, "uuid": "29d3a76d-3dac-4a26-906f-0ff36d91b7e9", "comment": "Malware payload", "value": "e033fff31440a1d1e5acefec9881f5f26f26ee16e2a2cb4aa277ab48ce4a425c", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859666, "uuid": "2f42ef90-309c-4775-9fad-99172979e45e", "comment": "Malware payload", "value": "a0e14096d8a3f524fffaee4ed9e309518a28ce9c", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859666, "uuid": "87af3330-f2f6-4e87-8286-d567cbb5964d", "comment": "Malware payload", "value": "599e3f6c1c010e660e3f9ef192f2d3d72c9c6c0f67d5cc7a32ac166c13da680c3e1de9b425b4fced36a09e2dd5ab58c0", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658859666, "uuid": "faeaf176-ffef-4f30-bf35-c7052f04c193", "value": "T189C3024F9924EC45C3422C3DCA095DFDE51D2207D863E15F2588BA463E922D77B8E2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658859666, "uuid": "d82b0780-114a-481b-a5ad-78034592ebae", "value": "3072:MqMvZQF483ux6KoT/jki1XCqRRAcQnEWzY24cwF:7idsrkmDRicQnE724cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658859666, "uuid": "02eebd6d-f5a0-42f3-8cdb-b85ac57948c0", "value": 126847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658859666, "uuid": "f5735170-6f55-4f0b-b754-1a329bc25694", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658859666, "uuid": "79a7ab24-8131-4421-8299-f36a31c6fbfb", "value": "VNM-1018633786.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e12dfd-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658851175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851175, "uuid": "edbe7505-2cbc-4293-ad71-c15ffdbb7602", "comment": "Malware payload (Loki)", "value": "605c10dfe6cf32f244acfe357d1c702c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851175, "uuid": "3b4054ad-93b2-43c6-85c9-2e968695553b", "comment": "Malware payload (Loki)", "value": "e039acdaeff157a82dd7205cffb812a4a928d81a1e62830326754e59114b4769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851175, "uuid": "8dc05a25-a5de-48e1-a9e9-ee77f4c28135", "comment": "Malware payload (Loki)", "value": "f2a13e4c4af1df886eb6b76fc21bbc2f95a3ec2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851175, "uuid": "154d871a-4124-4331-8126-94ec909b5918", "comment": "Malware payload (Loki)", "value": "b98448c7c9fe8ca036fb2c67519e5bc6a8baa4fd41b9e4794f60eab8b63a5de1161b59f5844329f63a68c5ea82b36da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851175, "uuid": "61e4e75d-6e2b-41f1-819c-03d8f04179e3", "value": "T10DA4022D7B98FD2BCB7D47FC8492C11853F2A1636253E7D5CCD291E126C3B640226A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851175, "uuid": "536bec59-dc78-462a-84be-bda93e9f95a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851175, "uuid": "6677d337-a493-4c4b-9358-a561a68d48b8", "value": "12288:CJH30k9Vy/j8bMNMeMxHbXg2s5pkwHqm1h7tTvCgvx8v4tGG:CREk94/0MajVbXLwKwTvvvxZGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851175, "uuid": "beb8df4c-51f9-4ca9-8803-67608f0fc681", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851175, "uuid": "566b520e-8608-46db-a475-d05d7f83be6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851175, "uuid": "ed8e691f-ddc3-4ee4-bbf7-67b79c339e0e", "value": "605c10dfe6cf32f244acfe357d1c702c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f81fe9e-0c8e-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658804060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804060, "uuid": "c83841cb-fc5f-49cc-a2b2-479b9b7c5541", "comment": "Malware payload (SnakeKeylogger)", "value": "7d6f2de6e47e0a33e41af04f47bd1d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804060, "uuid": "94537b01-abd6-4b60-8c00-8d1fdf0edc05", "comment": "Malware payload (SnakeKeylogger)", "value": "e0561b104da5f5190a77bcab39fc11ee19eacfeca8cff952f6c3ba2a295345d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804060, "uuid": "55b4c1fa-67cb-4f7e-990a-0768f188cdaa", "comment": "Malware payload (SnakeKeylogger)", "value": "3810814ddb7e058a0250abfaa6ebecf292227b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658804060, "uuid": "e9325886-d466-4b78-a580-5fea9c84bc24", "comment": "Malware payload (SnakeKeylogger)", "value": "124031a270ad41b0cde6a2708550668b14e6f4a1f8a21c330756fc456bd57bb3b2f98f96d38a2bf0ff4a15f626e10c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804060, "uuid": "4fcbdd5c-9b25-4c68-8a97-ced7fbd915d7", "value": "T168B412542A29DFB8C82E4FF9A92223405BF5B5563303F32D4EF6B0D95896B580381BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804060, "uuid": "b1150c38-eef6-4405-9ee9-15fe4eeb9622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804060, "uuid": "f9dba30d-60a8-46c5-8bd9-b973e21dda78", "value": "12288:TjBtmv30k/6zhbhSq0Nl18bu+8c0o6G5qXo+nXPGahCxOif5uWx8:JtmvEJzyl18bu+t76GUnXPG5xVRuWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658804060, "uuid": "b2999443-cdbe-4bfc-88bb-340b09bfcf86", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658804060, "uuid": "37755baf-e409-49a3-a74c-495c58605744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658804060, "uuid": "f1c830f6-4012-426f-b7d6-d26d87856763", "value": "Proforma Invoice.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f9872c-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658849242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849242, "uuid": "4339cf1a-e53c-4238-ac3c-60d60819cfea", "comment": "Malware payload (SnakeKeylogger)", "value": "7b36f4622aadc28a56dc1e1e2c45f452", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849242, "uuid": "daac410e-9558-4675-8bb9-bb24535db20c", "comment": "Malware payload (SnakeKeylogger)", "value": "e108fc9106824a84fe23abd994c407391b93fda4681d4d08f3fe1deb0bade1d5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849242, "uuid": "b705f2b1-f948-4f90-9385-284714e917b7", "comment": "Malware payload (SnakeKeylogger)", "value": "cbb1d886e14915d90c39531552cc4f7a8f33b1a7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849242, "uuid": "da66bce5-80a9-406d-bc9c-7a8d9e17ee91", "comment": "Malware payload (SnakeKeylogger)", "value": "ff59d8b1a626cd6e2e281c6a2d5f7b9e7863f78721f5012ed7058f36dce4a31a8c77b8550d3655c95afaeefc1b644a6c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849242, "uuid": "70d8bf0d-3efb-4059-a195-01a1fe662d0e", "value": "T113E42353FAD23FABCDB7BF7A424C3409585FBEC79A18F187681036998932E3590095B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849242, "uuid": "f63a4827-b8c0-4824-8868-87b426e6060a", "value": "12288:RsYynQTDqKaiGnGoRhgAC8gNx+hqnCCKTaXiXXtfar6L+2XrkLBNuNP4NpjQaNRE:CS+KGnhcA0Nxgvj82Xg/upqpjLvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849242, "uuid": "f381eb65-774a-47f6-bb30-6f38c8e75f1f", "value": 689928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849242, "uuid": "484bd8b9-fb71-401b-a1c9-135d0a15eac3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849242, "uuid": "1dcb17be-3ed1-4df7-9439-513e00b714b4", "value": "orden de compra.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad91699c-0cc3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658827008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827008, "uuid": "b99f39de-6ef8-4afb-a614-f1a2c683347a", "comment": "Malware payload (Mirai)", "value": "ef7bf9d39a1736ec8d21b9c16edbc922", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827008, "uuid": "7729bef1-b285-4dfa-a614-09ed0e91df9f", "comment": "Malware payload (Mirai)", "value": "e1a69cfd6edf389135b911a2e8bc484b84710606882e95628d38fc33982df3d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827008, "uuid": "12ce11ef-9d45-4562-ba57-2b4a5732b95c", "comment": "Malware payload (Mirai)", "value": "cc237aab6db3cf9c77b4e2e5e265f469b1814111", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658827008, "uuid": "007730e7-1c1a-4ec0-8b1d-f0a67188f17d", "comment": "Malware payload (Mirai)", "value": "85983b8809aeaa3fe94efe33d4d1e66fe462e2663ac9d968327a1a6f7b38f61f45bbd7656022bbfb510fc512ff766b29", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827008, "uuid": "420a881c-0ac1-48bc-8f5d-47870e76bab4", "value": "T1D743F171E8D2EA73C9982534FD26508763CB277D439C3964201C4E19B0968DEABBB387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827008, "uuid": "18b4d9c4-aca0-4769-9295-facb945b39f1", "value": "1536:Fcz5sfGwYZwys81N9s4Di598/OXA5nQRLu44+J9GLmro3w:UuPywyNW4DS+/5QRLQ+nGqrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658827008, "uuid": "a7b01e91-e277-4d9e-9023-825ab3846f7b", "value": 58072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658827008, "uuid": "8acc01e6-c5ec-43ec-8d7f-08b9a1252767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658827008, "uuid": "0526b595-cf39-4c1d-96b5-805ae491e8d1", "value": "home.arm7-20220726-0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb755107-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1658849473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849473, "uuid": "deddee1d-9356-4a0e-b3fd-f65c3fd48d80", "comment": "Malware payload (SVCReady)", "value": "9065445fe49c64eb2ad67f624188e237", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849473, "uuid": "dc952e14-a518-4274-bbf2-f9fc790d379c", "comment": "Malware payload (SVCReady)", "value": "e1ee3b07c0e80b16561762ffc169bcc5061a717c43f8e5f8020f30e530e171b2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849473, "uuid": "b6776c57-67b8-4cb9-a696-1924674fb789", "comment": "Malware payload (SVCReady)", "value": "5a1f87c7e011c02e88ace79a8e8e2b4d16605796", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849473, "uuid": "d9112142-7a98-4f0b-8773-bf7cd1cdf868", "comment": "Malware payload (SVCReady)", "value": "8e5990e9ccb27c5a03fbcee31bf90e70fc43084a054bea3f736c30e7028e5a841fb8bcfe16317630c863b1c267497833", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849473, "uuid": "1f5e41d7-b835-4af5-a013-19b3d4e4a567", "value": "T108F533F2C4E1502EF7CB79E55E288EBA0A178111BC6B39C153DE8026C85EB93ECB5553", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849473, "uuid": "9b7b539f-9ad3-4ae2-ae35-391343ec921b", "value": "98304:1ChvjtO2nTmWKHs0R1vXp0nq6zJhmHBjMHMm4kbDXZVFlg702HT:1CRjt9nSWws0XynXABjiMm4kbtVfghz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849473, "uuid": "6851a993-e860-43bf-8938-7f405502a139", "value": 3534486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849473, "uuid": "b2f17434-da0f-494d-8098-ad9dead82295", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849473, "uuid": "971a5603-0c0c-48b1-b362-8e956923d3a5", "value": "andreademarchi invoice 26.07.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5e082b-0d39-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658877737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877737, "uuid": "d89ab051-2363-41f9-85f7-d587ca89de9a", "comment": "Malware payload", "value": "35dec7e763bd4e35363ee527031ccbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877737, "uuid": "50fd8c5f-1ef6-4b13-a068-53776eee0dc0", "comment": "Malware payload", "value": "e216eb87e85cc5c7e5445d1ff94cf9790c62824c1fc5ca2a3e20f19d54d88ab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877737, "uuid": "c42a8c76-ce15-4623-81f4-a784222e8b96", "comment": "Malware payload", "value": "93c9aa68f7067d644ce7f20928b626cd84ac8898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877737, "uuid": "d1725690-35de-4a79-b8d7-8b97deee2513", "comment": "Malware payload", "value": "d289aebba7b7b0effc7af34b1cc81f710458707e35d4f741beb5734769e92ee93ff27347a435924f583f932d48551747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877737, "uuid": "04c20b2c-3586-45e0-b905-411e08af1c04", "value": "T15F357C99365C75EFC897C53689642C14FA24B667A30FF24BB01721AD9E0EA57CF009F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877737, "uuid": "71410a1e-f769-4b42-b07b-9e6526dfba1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877737, "uuid": "472b65aa-0a2f-4bbd-8502-50bc903f050b", "value": "24576:HO2W/gGjvZlcAaJwJxZd04z5EEkX9RkoPlf:HHW/nBlcAaynZi4zkX9OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877737, "uuid": "c201f51d-fb51-432d-a2d4-96c5ed73815a", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877737, "uuid": "68055574-3d99-4cb2-be4b-17c6721dac76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877737, "uuid": "2d12901f-f18b-434c-a6ff-937f2e685979", "value": "Purchase Order Frank Manufactures.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813a10f9-0d06-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1658855710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855710, "uuid": "feb182ad-ab28-4567-878e-d0fe5de9fd8e", "comment": "Malware payload (RecordBreaker)", "value": "8e5e3b7e941cca43224caa96af57e959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855710, "uuid": "4079182a-3421-4faf-a7f8-d089c5be93f1", "comment": "Malware payload (RecordBreaker)", "value": "e2baec713e48b74764d044346e7170179b4b99f8e0d8692ccfda231002239b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855710, "uuid": "b391bb36-81b2-440d-bd7c-59af95cbde64", "comment": "Malware payload (RecordBreaker)", "value": "e4411edc6489c504e0c97adf79f843ab87a36b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855710, "uuid": "f9a3c50a-5781-4f36-9495-a36805082090", "comment": "Malware payload (RecordBreaker)", "value": "1635283447b861888d670af0cc7f6efaf5a2bbfdc262fdd6cd61c5d507745a51bef22368536da10279206f9199d104f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855710, "uuid": "9fccf114-d4d3-4635-82e7-549bb7458ad4", "value": "T1B465233DA641513AC0931B748657E3B5BA32FA084BBD55CF72CD0E1E6D3734B0A6928B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855710, "uuid": "7c95695e-ebe0-49a8-b271-dc4cf31a90a8", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855710, "uuid": "75610e98-8070-4ad6-9b63-7d2482549658", "value": "24576:pAT8QE+kWj8L5W6+QqPgXOuhtFYJH3qlXPdu/NGb/r/fE5SZSledc9tGnJcnUZ/g:pAI+5YLA6eJUtI3+Xlu07fG8dcvaJcn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658855710, "uuid": "a6077a25-ffe7-4708-a703-66fcc3cf613f", "value": 1426029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658855710, "uuid": "ee9cb340-1ec4-48a2-aa97-9397077495cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855710, "uuid": "117e9b05-57d5-4e97-bd8f-7d14fe0178ee", "value": "8e5e3b7e941cca43224caa96af57e959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c5bbc4-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (YoungLotus)", "timestamp": 1658849386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849386, "uuid": "23ef558b-4c96-421a-97f0-fe06ec5ea59b", "comment": "Malware payload (YoungLotus)", "value": "8b5de17c15da13d5d31426475a83a7f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849386, "uuid": "23c76d69-af50-4ff9-b200-ee819bdda277", "comment": "Malware payload (YoungLotus)", "value": "e2c126990fb981c5414d0222e41722945944a33644da49c3aa07dce36e9ca201", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849386, "uuid": "980ef9a1-49f2-46bb-b2e3-af21a8855030", "comment": "Malware payload (YoungLotus)", "value": "2b231111a1a43ad2c9989cdccbff52980bb6c811", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849386, "uuid": "73c8b272-0496-4cf0-bcbe-c4394fe41f0c", "comment": "Malware payload (YoungLotus)", "value": "6e64e1682796bcf371c0e735720c8879e8991116df783783825063989b78a62c5d9ad88a5a2498780c7bf8ad1c8a7603", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849386, "uuid": "6f79182e-46af-4c8c-a20d-230f7bba88df", "value": "T13BF3B311ABE8570ADD4CC447F0F8C77992F66B18C55FE2CE1672AA272C9FD08572A84C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849386, "uuid": "96218444-6853-4414-aaa5-349502202000", "value": "3072:WqU7Jp0m1G7iv/cdZkMWWKs0/grb/IGK/OZn967wEnxywwOmNLjIn06C2qMVYV4i:RdvBbcaXkA7JYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849386, "uuid": "95233987-c24c-4dfd-884b-e9acce95466e", "value": 157435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849386, "uuid": "3f5a4a8b-5a02-4025-8228-10dd6b46a977", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849386, "uuid": "dcf5be2e-56a3-484c-9b49-aeaeb6a0d4ee", "value": "Quotation Sheet_Products_List.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a307f1-0ccf-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658832094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832094, "uuid": "da6fd6a4-f12e-472c-bc3f-6a9a0b51395e", "comment": "Malware payload", "value": "47d419da45b50d55edd1e9f1d6a49c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832094, "uuid": "77ec3ed0-227e-409a-8f81-8062fe2adc01", "comment": "Malware payload", "value": "e30f26ea0eabac5feffa76cf35c0cf8848ab0bcbbc6258cb681ce3969300c176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832094, "uuid": "e2c7f58b-d394-485c-996b-4c7d9217d164", "comment": "Malware payload", "value": "3712009d53ef61b66f675e866fb1ad8ab2c075fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832094, "uuid": "a833de77-ea7e-4e89-915e-7185d1fc2fd6", "comment": "Malware payload", "value": "0f2258cddc204157467019ad91a4f83bc7151fa2e18da956f57d7fc61736bf18eb83509ca2575b82874cfcc0641c6010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832094, "uuid": "d7c3a2fa-108c-4911-835f-c8821a964f87", "value": "T1A3E3121BD7B229CBD51684755D8ABB6011C1F63AA7598FD382D0B0F79CC0BF42E462AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832094, "uuid": "ab5cb308-3029-44ed-b0ad-b165eec282ad", "value": "92644df84cdbba7637462c128671f148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832094, "uuid": "e51a0e92-5a95-479d-8874-b97118a04290", "value": "3072:cjXoR2R/aORApDQmp/P0t1Nz0U2mKPeBwffD3j+jlyKgOQout:2Q2R/aq+/Y1NwrVffT2lyZoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658832094, "uuid": "c88b5d93-beaf-453c-ab1b-65184b5a1881", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658832094, "uuid": "958bfd1c-12c3-4d31-8970-15ddf803f540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832094, "uuid": "d7477ef5-0ca4-4b37-a22b-05b8750ca03c", "value": "ServedUpgraderBefore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209d5087-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658848676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848676, "uuid": "33d59276-20a7-4cbf-898d-29c890cf3c06", "comment": "Malware payload (Formbook)", "value": "d02ef1e71a4c5ce054dfac4360521696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848676, "uuid": "17a347d3-201a-44d7-b21b-d2ab64a78467", "comment": "Malware payload (Formbook)", "value": "e37dd35135ceeced0236922e84f403aaee463c25bb788f9fde9aebc66d261153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848676, "uuid": "c6cf40ee-126f-4aa7-9ec9-69978405724e", "comment": "Malware payload (Formbook)", "value": "12758a0796d86d9187fde02c58ba2583487ce6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848676, "uuid": "c782149d-5b46-453f-8a7b-e704c83c3867", "comment": "Malware payload (Formbook)", "value": "294cb6e34836509d81232d92949e2f5dd1e71359430a7df024196a287dbd46fe1ec5916b421107c4a8d82c40321e7c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848676, "uuid": "928ff278-10d2-4509-bffe-548facc6494d", "value": "T1C3047D36E741C070E2B252F5B26D1B7B883E1D343354A0A6E7A11AE16EF09E5B52D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848676, "uuid": "0f2c5423-a397-4379-98b3-3ca7d9c77d65", "value": "3072:z10zkYPa7Jvg8TosWreskXUxB+QZt2pgZM5qovFMFtyM5BcxV37gZrfL:z1scvTo0skZqugZM51vFMFtn+VLWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848676, "uuid": "1db7c6f6-2017-4758-9bed-a0fabfc4d670", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848676, "uuid": "212bdf1f-2757-47db-8c76-0076b38ab811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848676, "uuid": "21726ca2-c4f0-4e74-942a-5f95a26361f6", "value": "d02ef1e71a4c5ce054dfac4360521696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df9243a-0d3a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658877958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877958, "uuid": "067a6143-d2d7-4ca4-b3d5-f9165d154a71", "comment": "Malware payload (Mirai)", "value": "6c201d3a14777d60079c35d4726e2c6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877958, "uuid": "19aafcc2-0696-49d4-9f96-2376178c3e16", "comment": "Malware payload (Mirai)", "value": "e3a26188c0737228268df423a81169eab7417cb89e8cfed15b18a14c2bc6fe12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877958, "uuid": "e139592c-839e-4bf3-8f2a-661b79116b1d", "comment": "Malware payload (Mirai)", "value": "26c024c571e422a5834b3cd7007bf93bfc034a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658877958, "uuid": "886707c5-baa1-4095-b8fa-7b6df24adfb2", "comment": "Malware payload (Mirai)", "value": "e01ea3ff91bdc42694396fa32ab17915010c29eb823278a9572a7a7188335437d442ef9608f9672a3fd683c64979bab6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877958, "uuid": "48781c6a-44bc-431b-874b-a595d8417d35", "value": "T115D34C46FB418F13C0D51779B6EF42453322A79593DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877958, "uuid": "67f81f28-9c04-4e56-8728-bed44568b727", "value": "3072:5xioDMQI5nrxaf4vt3qZg2gWu6b4LX7LkDM/9gPmPw/t93:bioDtI5rFvt3qZgHWjgX74DM/9gmPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658877958, "uuid": "dbaaf708-122f-413b-9764-e419b53d02ed", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658877958, "uuid": "22ce8571-383c-41d0-b991-6e99dcaa1ad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658877958, "uuid": "217e9b1d-d071-4937-b7e7-ced0fe16788c", "value": "6c201d3a14777d60079c35d4726e2c6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12090dea-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658848652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848652, "uuid": "c5b76c58-20d3-4e38-b5d4-28d29537e7d2", "comment": "Malware payload (RedLineStealer)", "value": "6e0cc43d03c58254be1aea4db8d08669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848652, "uuid": "c47fa5b5-765d-479b-9330-c489e89784cf", "comment": "Malware payload (RedLineStealer)", "value": "e4ab02856caf1651c81f99bac789bb0570925f64afebc64701e487ad5dec0aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848652, "uuid": "94ddfc35-e0e7-42ba-829a-9e7fe386d0d4", "comment": "Malware payload (RedLineStealer)", "value": "c35c4fa80b60989f212dece24580466cfc475a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848652, "uuid": "4cad3363-1183-4a5a-8778-2c5f2027e2fb", "comment": "Malware payload (RedLineStealer)", "value": "526f01aff6f28c7edcc119953ee40835ff47707c6d25fc78fa9b8a964ab2cb03a8199c62db47421427f1c6c1f69d9915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848652, "uuid": "1235eebd-8605-450e-b813-31ebcb631a9d", "value": "T167557C39EB8629B8DE175771C59EEB379B04B6148032AF3FFF4ADA08A4330167C46255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848652, "uuid": "cdb1d772-7265-4a09-8324-e042aafec5e9", "value": "da0a8429d07681e0f845d1d4f08ae833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848652, "uuid": "97a5fd40-ae42-4a7b-8f78-8d44ac7d08e0", "value": "24576:XzTQ7eP4YlOY3Y/fpCJmgMZ4dzqyKX8bbeEsKDi67jpNLWLjDu+x:Xg7eP4YJ9TeEhD77jpNaLjD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848652, "uuid": "73d88703-f718-4935-9fad-972152f3856f", "value": 1404824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848652, "uuid": "b12a119b-cc79-4bbb-b231-12d39cc20994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848652, "uuid": "55eca5f4-6a72-45a1-a46c-d26483353a36", "value": "6e0cc43d03c58254be1aea4db8d08669.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cab0a3-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849143, "uuid": "23236c8b-bed4-4d75-9460-e363d042b253", "comment": "Malware payload", "value": "49f1053c0f61e3f3d5528a5839f5527e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849143, "uuid": "92efd597-0a1d-4a46-8f57-e119eaeee1d3", "comment": "Malware payload", "value": "e4ae583220dbe65ea35627d890a34eb5196c72cf684e2c3c79b2b5c6bd7e8f87", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849143, "uuid": "034b0a7a-726d-456b-8342-82a4f3fc2699", "comment": "Malware payload", "value": "90f73b8d5529128813feda6a745849a7d1931b96", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849143, "uuid": "d8ca4476-1b4d-4bac-899d-6d4edaf419dc", "comment": "Malware payload", "value": "a22a1ce413de0ea345abe160106430862ac79ec2df898b9d284b0207e4384ef2452b68411571398d7f2ab87246647c17", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849143, "uuid": "1d29dc7a-3d46-4c64-acbc-cab0736a235d", "value": "T10143CF587D55B246FF5EFA388923784A3A29AC61C340E786BC90F36C04F8976872DF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849143, "uuid": "5b5a6dc5-793a-4072-91d0-d933e53d0b42", "value": "768:rJFgvVuYUDHb3/FA1Pln6EXMd/H/JxWjJ9VjYhRuZukSMn5sNbiPvzeT2pd9RHFf:rgvToHL/FA1Pln6T/HBeJ9tFf5s5in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849143, "uuid": "894e56cf-8c70-4b8d-b3fe-7dd7c8b68199", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849143, "uuid": "b5975749-7e5d-49fa-a032-965b3b82fbee", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849143, "uuid": "98046a83-2788-4def-baf5-b7489cf51a96", "value": "201638907-054000-sanlccjavap0003-20922.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cf7e3d-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658851099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851099, "uuid": "dec152fe-06e2-4d87-bc7c-de0aebea7a47", "comment": "Malware payload (NanoCore)", "value": "5869c4d55d9513c3fe18b5f4a28de990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851099, "uuid": "e69c4200-42c2-4d2a-adab-97c443ab6a3d", "comment": "Malware payload (NanoCore)", "value": "e50bad4ff6bfecab12f99bcbb4152b0fda73f59bbff3a856b65a1c42ac65975b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851099, "uuid": "c09eacd3-9629-46fe-9af2-24a5d1b25ca3", "comment": "Malware payload (NanoCore)", "value": "843de0a250544eef459a164252a79415132afab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851099, "uuid": "2d8e4d38-33fe-490c-8e2a-acf21eeaced3", "comment": "Malware payload (NanoCore)", "value": "4b8903c438332927a9bc80e2d8117c7edb26a6c066d41b7e64dc3013f768465ae689b61e36d47c5d978eeeee555867f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851099, "uuid": "a65ea30f-050d-4c65-b191-3efd102ed18e", "value": "T16DC4220421258BB5CABF9FFC6015A14057F1B85B3303E74D9FE6A4D17992B880366BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851099, "uuid": "a2aebfc8-309f-44bb-b256-47627a9fe3c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851099, "uuid": "5410e8d9-ac4d-4776-9dea-b0c3725f79dc", "value": "12288:6jN3Cv30MGyB5/jLUhZe1wy1TfjbIoJdwH/HrjnWFjPQPbs8zx8:y3CvEKPUnvITjbJuH/fMYPbs8zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851099, "uuid": "fd66840d-29a4-46d7-a951-e472691a0b33", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851099, "uuid": "792685bf-6140-4668-90d1-bcffa111d8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851099, "uuid": "cb3176e3-35da-404a-be04-479b8685d91f", "value": "5869c4d55d9513c3fe18b5f4a28de990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7564e662-0cb6-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658821331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821331, "uuid": "01b37a3a-6d3f-4eed-862b-2a17e6e5b068", "comment": "Malware payload (RedLineStealer)", "value": "7cb1e8bf5a89dda5da4af5683dbc2912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821331, "uuid": "6aa06d69-f803-469f-bfc9-4e42db85edfe", "comment": "Malware payload (RedLineStealer)", "value": "e582d1eca8ca91b38e70bdedc251dae429d8981d21551c59a3ba0c68b2243f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821331, "uuid": "25987125-28a3-4fc8-b13f-34147c7ee798", "comment": "Malware payload (RedLineStealer)", "value": "f7b9d42ff0f909a2d1b6ab2b90c91ca74ef7dadf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821331, "uuid": "183d266d-4010-41f7-a98f-36879f879b13", "comment": "Malware payload (RedLineStealer)", "value": "ccaf2a50074404d7282577b4cbe312f92a8d85b628b7b564a9a69e50250c5c029277ff99e67b4c4a2f1c3c162b148e71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821331, "uuid": "43e5ee8c-6ca6-4da4-8102-6dab31e7a3ed", "value": "T1A594CF40BAA0C03DE4B312F47975C398B939BDA1AB2051CB22D67BDE96346E5EC75307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821331, "uuid": "b97e3dc4-2dc3-4c81-a83e-5ea7f576d5b9", "value": "e6c3aa777d2861625d0bcdf9e9a3689d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821331, "uuid": "cc8f6b95-e85a-47b0-ab4e-9041522405f8", "value": "6144:4H2COs6QIADY0kzZO3A+jv6dsDyfaP7v+wjcGEWoq2NJFl4nr/NcLJ3tW:44ANrkzZO3A+jv6uvh4PWsLynr/6ptW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821331, "uuid": "c611c102-0da8-4903-9ed0-ff1badf801fb", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821331, "uuid": "c4d029a7-d64f-40d8-84c3-81214e1bc6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821331, "uuid": "4882815e-40ae-44ad-a9ea-4c6126cf43ee", "value": "7cb1e8bf5a89dda5da4af5683dbc2912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371d1463-0d1d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658865464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865464, "uuid": "f8073436-9516-4dd3-bf57-c1ab0b42619c", "comment": "Malware payload", "value": "4d0fd34a80236c19f721dc84203ff5d4", "object_relation": "md5", "Tag": [ { "name": "3164374593", "colour": "#48D06B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865464, "uuid": "cf31bac3-1890-4a1f-b839-e941e1999c3f", "comment": "Malware payload", "value": "e6455292eaa87ea0011bfa12ada2a132faf4c4ba66290d453b7d8a40bc4469e6", "object_relation": "sha256", "Tag": [ { "name": "3164374593", "colour": "#48D06B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865464, "uuid": "99c184cc-37ee-4ac6-ba48-e8dad849f98b", "comment": "Malware payload", "value": "c8038a6c820658c4b0fc7930b342b7c63fcf7915", "object_relation": "sha1", "Tag": [ { "name": "3164374593", "colour": "#48D06B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658865464, "uuid": "f26ed5de-e7a8-4817-ac94-a5ef6d3b85a7", "comment": "Malware payload", "value": "314f6afa81d2b385750e5c15f8385f22ece400d54e1094247a77bfcdd29ff3b872b95dac71cf5c1bdc1533147fb6df4e", "object_relation": "sha3-384", "Tag": [ { "name": "3164374593", "colour": "#48D06B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865464, "uuid": "c0594788-42ee-49e8-bb0a-e6e76ae76d93", "value": "T1978302F60C5681D4E6AE8AB7702539CD97409B4EC4DA7EC2DF0261B257706B3B3D8B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865464, "uuid": "96d70b5e-2d89-438f-9624-60d1701b54d2", "value": "1536:D4bPvy2iGc0ow0/l5TgXhg4Iw1Xdbk+bXH06etuvnr4BARmi5zK6qlfpre:DQv6Gc+0/l0dJbXGovrS3iBKplxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658865464, "uuid": "407fb304-1250-41f8-9a4d-f15020ebe4e7", "value": 83681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658865464, "uuid": "7f6dca47-6ee9-4d75-b888-dce08a7ca3eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658865464, "uuid": "8a7be4bc-5680-41f1-8a62-ada1e0d960ba", "value": "document_54_invoice-07-26-22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245792c6-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658849112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849112, "uuid": "4f375938-da99-4219-9799-1f2acb508d8f", "comment": "Malware payload", "value": "7d88df78df664fe6121ae334a5935aff", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849112, "uuid": "744312f7-aa13-44d0-b9aa-d8318059960c", "comment": "Malware payload", "value": "e65e541c736abe995e749a813539e62c413abaa99b9554a24eb2e13a028ca96b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849112, "uuid": "ed79c54c-84e8-450f-893f-bd20b24f03e8", "comment": "Malware payload", "value": "4add83cbf9a2808e90f3ea8230552cba1dd77fd0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849112, "uuid": "47d6c902-0e90-4218-b081-b5d05625bae5", "comment": "Malware payload", "value": "d2916fc56f4a87a7e8e21abd00bc0292a4bb57826c128fb904c8487d933298b73da10879f976a631f4f60cd66eb9a9f5", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849112, "uuid": "1a881cf2-006e-4ae8-9e06-7d281a8c4542", "value": "T1FF43CEA85EB09C04D850AE345E3387055F9D1C067E06EC7122B7BF1EB43BE5629BDAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849112, "uuid": "9c6fe7ba-32a7-4694-82ca-2cbf88dbf240", "value": "768:2/8Jfx1WhY7ujeXkKd3/SDjzZzcNOtdrep1uvMqTPEjG0tUnNWnq2dzN:CyGe0eKDnZz4QreSv5TPEPtYNFkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849112, "uuid": "4716706b-4f6b-4688-acfd-2e5644aefaf4", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849112, "uuid": "abe26c11-8438-46ce-8a14-53651f7a2bd7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849112, "uuid": "bc8ed67a-eaf5-47d4-9b14-26f9d73a3f3c", "value": "PURCHASE ORDER COPY FOR JAI BALA IND.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1f27d4-0d04-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658855062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855062, "uuid": "90bfd40d-8894-4048-b727-4fa37a222532", "comment": "Malware payload (AveMariaRAT)", "value": "1d50411854b39c195e257fe4eb451cd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855062, "uuid": "e37fc1af-a5f7-4af5-add7-fb51c7c94be8", "comment": "Malware payload (AveMariaRAT)", "value": "e670e7e426009d13b122f0f1bcc48c4f3cfcaaa3dd6159704290435c23200190", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855062, "uuid": "e4f4e11d-9a4b-421a-a9b8-4b710c4b186a", "comment": "Malware payload (AveMariaRAT)", "value": "edadcc3146782c2fe591e5e2800c5b93512d06de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658855062, "uuid": "3ad8aa89-6aee-4646-8eba-8cd0fe7b5678", "comment": "Malware payload (AveMariaRAT)", "value": "4a8bf5db4c25a4bb16b3c4f5e2a56c86275123219513755c6e67554dbe7b0041f8a0c3a5f7e010a6d52de3756ccd05d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855062, "uuid": "2e27636a-1b68-48b7-87a7-ab9929324209", "value": "T1A0455A2AF79B4C32F076363C5AC6816044277F202AF5D8A136DDE948DBB5E4078F598B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855062, "uuid": "8141a720-78d2-434f-99f2-efbdefcc14fa", "value": "205f6434858f3f8cc9e8b96d094507a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855062, "uuid": "d47b9ac9-92d4-48e4-8d65-de12c7ddaae1", "value": "24576:DDA1mchKTwkH17WtMBhiUDxvHiMYStttVSn52pAf2rDNtl2aCHX:DDhc8ZPbVIqSn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658855062, "uuid": "ab15cbd5-700a-4182-8562-6f8cc93f3b3b", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658855062, "uuid": "c79b03cb-010f-4276-84d2-ad13eeddfac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658855062, "uuid": "f0ef4353-1dc6-484c-86c8-4361292e22b4", "value": "1d50411854b39c195e257fe4eb451cd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d9995c-0cd1-11ed-93bb-42010a9c0043", "comment": "Malware payload (MassLogger)", "timestamp": 1658832797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832797, "uuid": "23472909-dac8-4fe4-bf62-5e0a558bc8db", "comment": "Malware payload (MassLogger)", "value": "739c982fcbc0aa06b0d3e74525cfde2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832797, "uuid": "6c24b536-e456-42b9-9930-ed9e52404b09", "comment": "Malware payload (MassLogger)", "value": "e68526e8ebc0cb1342ed01317aa6966d83bea1b71b1285b55b653a512200304c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832797, "uuid": "2eedb378-bed5-423a-bc16-932795a7dcf6", "comment": "Malware payload (MassLogger)", "value": "1175a84ce38c884e5d5c2f0d51a13265be868049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658832797, "uuid": "36684f30-cb1f-4d16-b7ec-b23aaa62fe11", "comment": "Malware payload (MassLogger)", "value": "c9db8fdfa41df12bb3aa904febae4c6da3b62649db7cc6144353216b1bc0f926d5d511a83b827b0e14f338d7ac52c6c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832797, "uuid": "7b989b4a-c36a-46e4-a905-e3b02cbcf201", "value": "T1BC258D9C7520B99FF867C6BA89743C67AB343C66530BE243901335D99E2DA93DE044E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832797, "uuid": "f53b6ea8-c21c-4a05-8ebb-8b2d9c827ce5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832797, "uuid": "b4ea79b3-e2e5-4b77-b41e-efb808a69295", "value": "12288:Igrpw4UZvaVJ9ZzxUaeiGJ8Iy2TiGrS7JSbBn2GxYSmUOuvM0WpU9YlapBvKeOiW:Dw4UZvybcv8vUvJ1V9YlafKXZxJ+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658832797, "uuid": "b7d11487-c359-41d5-8098-1a52b9f4f32d", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658832797, "uuid": "92e33028-368e-4404-b81c-1d4ea11a7afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658832797, "uuid": "bebfb0f1-d656-493e-afff-58f5a138fd8b", "value": "Halkbank_Ekstre.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d109044-0cb7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1658821612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821612, "uuid": "30705cfd-bd04-48fe-a351-817d36a5e6d4", "comment": "Malware payload (SilentBuilder)", "value": "452dfac8b939c1c7c9190339d9392762", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821612, "uuid": "9114e663-f396-487c-87e3-d68d5e4298c2", "comment": "Malware payload (SilentBuilder)", "value": "e697f94e970d07b48cea52c3ddf2a06402e2243d20cb32e0d919a00e47a909f3", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821612, "uuid": "cc32104b-1954-46c9-9cf4-66852a4317ac", "comment": "Malware payload (SilentBuilder)", "value": "34ed585bc9131b26480181a46c586c2ca3ccb159", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821612, "uuid": "8b70fdab-e8b2-44ef-804a-c35ab984bfd7", "comment": "Malware payload (SilentBuilder)", "value": "9021126c0004396bd357c9642ac38173225133c06633fb6757d1a3e253f906c03b70757ce1fa39e9caa4fe0d3b3e41c1", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821612, "uuid": "c1a53c4e-2975-4adf-80f5-42073d2102df", "value": "T173933945B759DA5EF521833148E747AA7333FC208F6B47472228B3267FB99A05B0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821612, "uuid": "b9412f71-6743-4b61-ae3f-a28fe4f93a57", "value": "1536:PFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCHuS4hcTO97v7UYdEJm4r:tKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821612, "uuid": "88615229-622b-4a9c-bcdc-f701ae20379b", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821612, "uuid": "9491668a-30b4-4f33-a1ae-27d97543158e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821612, "uuid": "7d971edf-c07d-477d-894f-733431328d58", "value": "U4006753650070155929_202207071505.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5601aa51-0ca4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658813547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658813547, "uuid": "d5da7c02-f090-40a0-b71c-12eb9af5f45b", "comment": "Malware payload (Formbook)", "value": "d0ebc9fddc09272215be7771bbd23f58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658813547, "uuid": "b7822ae2-d71d-4462-852e-17efab56f3a0", "comment": "Malware payload (Formbook)", "value": "e69baaa8ba7dd3e8a02a70574a2b9b7f9d68b7aebee6b66ab5c4f9742b2623cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658813547, "uuid": "9f3a57e7-3025-415c-8db5-3f1b035ed47f", "comment": "Malware payload (Formbook)", "value": "2cc84616ccfa57745d95ef34edd86577df5d4a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658813547, "uuid": "7a1ec093-e517-4601-abf3-bd703e92a996", "comment": "Malware payload (Formbook)", "value": "e40019bf60750c9359d640abac90eae695a7f387583c5928785ab0eaa2e103a07f940542a809b0e8436beb49cfab66d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658813547, "uuid": "13221f0c-b6e6-40c0-8adc-863735b7089d", "value": "T162A4402C3A411A72ED8E91314B11DE08BB6E1FC3224CB99DD7EB15C6874F46D6D4ECA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658813547, "uuid": "245216a6-d27f-4446-9e08-eb9c2d9da3f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658813547, "uuid": "14226e5a-007c-4b03-bb02-777d6763c4e4", "value": "6144:nRdWwM2zFWxwnexs7Xc0cLP8omYm8JZQ4f5JMHyMdZxC1T/BRKK3Z:nD1FXnH7cRYpYFX7xPMLxy+K3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658813547, "uuid": "3e2396b8-deaf-40c5-ad55-22bc82e26378", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658813547, "uuid": "800b3ee4-fc01-447e-b3a7-385ef5f21bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658813547, "uuid": "9d9dbc75-0cde-47ff-bac3-747735ebf11e", "value": "SecuriteInfo.com.Trojan.Heur.DNP.Bm0@a8I2Jiki.30029.8824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f290565c-0cf0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658846451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846451, "uuid": "f30ec834-6747-4244-8e71-27172bbdd66c", "comment": "Malware payload (RedLineStealer)", "value": "af62622a709bd4eb8121755eb2203bd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846451, "uuid": "ef12744d-9288-4ead-b953-de9f290170a6", "comment": "Malware payload (RedLineStealer)", "value": "e79b96330e953aedb6d553bb9693644cb56bf1dffbbfcab97fb297722b59d7df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846451, "uuid": "46799151-0326-4789-93a6-a7eef4c0dcef", "comment": "Malware payload (RedLineStealer)", "value": "647e18875a519b5a70ab80b02d6b404d16cee3d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846451, "uuid": "2dfe2f6c-c0c8-437c-84d6-6697e6c27015", "comment": "Malware payload (RedLineStealer)", "value": "6bd4fffaaee4efe04a02517a33cc3e24d56cd1c9e3baa593cb8dcdde412f9bf390721e7d0360ed2a7d9578e8f0b3faf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846451, "uuid": "4e921599-c8ba-41c3-bb2d-1ad7e29e7146", "value": "T152E5D02AEB1655F4D6736271864EEB77C71878648032FBBBFF8ADA19B0734123D04252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846451, "uuid": "c49aa480-896d-4396-8ad1-d6bd74d97d7f", "value": "88b769756fdd2a37213ec16c474eaa33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846451, "uuid": "dee08104-8529-4d74-9b65-aa49a99f35b7", "value": "49152:rGkfkSYguOPuV4PozzgPO5AMnBlm94W1CEVq3lK7Bxg9HkHKEz+DsVlSjzzg:rGkt6fDnBi1NVq1K7BxHzZVEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846451, "uuid": "f1cbb501-dce9-45c7-9c0f-ff347b6bf3ba", "value": 3074048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846451, "uuid": "a44cb1a1-4022-4000-9826-8ea79e5b4f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846451, "uuid": "d128e4fe-bbfd-43a6-b84a-44600393ee37", "value": "e79b96330e953aedb6d553bb9693644cb56bf1dffbbfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeac7c0d-0cec-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1658844620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844620, "uuid": "9d06dc3d-0d47-452c-ba76-5d23c5c82a1f", "comment": "Malware payload (DCRat)", "value": "eb562e873c0d6ba767964d0de55ac5a9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844620, "uuid": "3e93f204-c72a-4192-b4f3-93ace2caebe5", "comment": "Malware payload (DCRat)", "value": "e8e3cddcc753e66757c3d6a47b63117f718103f03a039b40a4553849e04b8aec", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844620, "uuid": "7401b503-6a7b-4802-a5d2-c78a145b8877", "comment": "Malware payload (DCRat)", "value": "b0ca748a3046d721ec2dec8c3dbd0f204e01a165", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658844620, "uuid": "2421681e-c357-4ec8-9460-749f86560358", "comment": "Malware payload (DCRat)", "value": "08d5e1ebac207535a219d3c7d342590684319b2d6261c9c3b51514fec0031978c93c52b4b714202f629914f2362a1a37", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844620, "uuid": "e1be1b31-d0cf-4251-b0a3-97846741a80d", "value": "T1B636332A69E189B1DC7214798FE19671192D3D912F739DEF9364364C4F302C0BB3AAE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844620, "uuid": "da33faba-9003-40d3-aed8-f8f3ab1d53c4", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844620, "uuid": "0492e12b-fecf-49b5-82aa-c597f664df0b", "value": "98304:4J4xahbx26J9MTr2/omY1SsU6HN5mGU6w0SVu3noq+wzWP87z7FCM:4JNRJa+/omYwsZzmG3BWu3oqkazRCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658844620, "uuid": "29866e5e-3cfc-4afd-a41f-ddfacff26ff0", "value": 5033009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658844620, "uuid": "e5b80a7f-002a-486b-8867-78bcfc16acc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658844620, "uuid": "4bbe6e07-8b69-4114-9788-1d76cd05b1b3", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ff4f2b-0c88-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658801654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801654, "uuid": "c7f36fab-f90a-4f50-9a2f-434c543518bb", "comment": "Malware payload (Mirai)", "value": "7e1e51dc4ece0bf19710a35dc93c66bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801654, "uuid": "0c4d82be-8654-4149-a70a-3f91b98b5b09", "comment": "Malware payload (Mirai)", "value": "eb01ab94d533b2d57ed396ef7a2e37a0daa96649d8ec6ab85e09ae1228411b5f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801654, "uuid": "5e8450e6-fd62-4c66-9a3c-b3d3b05c882e", "comment": "Malware payload (Mirai)", "value": "a7e5a4a8f567106a43f3aa59010d876ae305a8de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658801654, "uuid": "07383bd8-9257-4706-8152-64976473dbc9", "comment": "Malware payload (Mirai)", "value": "f1f646dd71a065ab279c5cd41c91157061ee5bf79294db176bcb36b7b0eefb33e5dcc84aa0175479f21d1744f530cfc1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801654, "uuid": "71c0f68f-1be3-4ed6-a19d-ab649787607f", "value": "T1ADC2D0584B0244D4C519D5F9DFED0B412ED92B22F813BC6AED88D613FDCA84438076C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801654, "uuid": "12d2633e-8286-414d-b20e-2c433b07ffb8", "value": "768:ctYe3VDFhSRqUU7VrxMD9Zvpg4YI009fpnRwlx1JJgGlzDpbuR1J2/:cbVBhJUU7txyCazfpnshVJuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658801654, "uuid": "1cee4409-94e6-4858-9c37-d96c24189b65", "value": 26404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658801654, "uuid": "0dbe0bff-db28-4d9e-844a-bd76568c9e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658801654, "uuid": "e8741637-9158-4f3d-9e02-bde19fbd6138", "value": "infect.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5c6487-0cba-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1658822978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822978, "uuid": "73b560ad-3826-4400-b0d5-a62d324c8488", "comment": "Malware payload (ModiLoader)", "value": "08b492ad6ba0d387be330c80c76af8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822978, "uuid": "d74cb2c6-3d10-4561-9f6f-055db08237e2", "comment": "Malware payload (ModiLoader)", "value": "eb3e531a9ad7bac52885f66e9224dd9543704d18cdf94d95979c7b6d9d2c1e08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822978, "uuid": "af632946-072f-487d-a8ca-abec68c5bc3c", "comment": "Malware payload (ModiLoader)", "value": "61c569dad6718873519633cc3cad76bb24fce616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822978, "uuid": "79e79ad3-de53-454f-bd2b-4bae3b53f70b", "comment": "Malware payload (ModiLoader)", "value": "193c0952092edfa7bdaff17314fdc05f982e70c1a9e792c91ec6bc54ae011c4d9a4f11703ab1cbc37451deb03c032f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822978, "uuid": "5c6da6eb-9113-458d-8da2-a19044e29294", "value": "T133452AE1F75A0C33F4A23A3C590791607D2D7E40BAF8D4CD76ADB9481EBA28168F0D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822978, "uuid": "0094ee79-9145-4f92-9529-b26c0f97e52d", "value": "205f6434858f3f8cc9e8b96d094507a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822978, "uuid": "709fc2c4-5e72-4031-9eca-7a63c44798ac", "value": "24576:NDA1mchKTwkH17WtMBhiUDxvHiMYStitVSn52pAf2rDNtl2aCHXy:NDhc8ZPbVIDSn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658822978, "uuid": "5a250a9c-7a4b-4675-8f6a-59cd2d537bd1", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658822978, "uuid": "418f25f5-8799-414d-aaaf-c4e7e29214f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822978, "uuid": "7b69b70c-b30a-4e3c-af6b-e08d5f210d2c", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da196740-0ca7-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1658815057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815057, "uuid": "f009c440-ccdd-4d4c-886f-1291d4855853", "comment": "Malware payload (DBatLoader)", "value": "8ee3a607383d9d5edca0adf67c9cf9a5", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815057, "uuid": "7d975927-04f8-40b0-b31f-59ddebdb0188", "comment": "Malware payload (DBatLoader)", "value": "eb8ae76848fc325a57796a28e45185ad9a70832fba3ad6170f34214f58332064", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815057, "uuid": "c5234ab6-4f4b-4a9a-9f93-4bc7a37adae2", "comment": "Malware payload (DBatLoader)", "value": "abe5b2cf41ba63022e90a16144d95ed8c68c64e8", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815057, "uuid": "de43c49b-ea04-49ef-981a-7e76ef47eadf", "comment": "Malware payload (DBatLoader)", "value": "9cdc9fa5a0eb5d6cbdd52dc008d63d618006cd024a641c3f8ee105b682a8a64a4f7fa28debe444223c45d63176cb5012", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815057, "uuid": "070994ee-746f-43b9-ae92-000ac3874a11", "value": "T109559E27E7608937D153193D8D0757A199357E103A28D88A3AF92E4C9FF9B803A353E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815057, "uuid": "d307c781-2144-47e6-baaa-b22321447f79", "value": "24576:rWWH7k2z/m1uA7Zo4pdUtVSn52pAf2rDNtl2aCHXrO:rWrqMpd+Sn52KNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658815057, "uuid": "c30e7b09-03d3-4380-a682-c3a126a71ed7", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658815057, "uuid": "1b6946a5-ef8e-48d0-893b-ad8211d67ee2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815057, "uuid": "5c5af954-cc20-48af-9d73-5a7fb2cfb76f", "value": "Purchase-Order6734687837.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d66943-0caf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658818486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818486, "uuid": "5e799482-680a-43ac-998a-5b426d740ad2", "comment": "Malware payload (AgentTesla)", "value": "40f36c7a40f464d47dd1f85075c0fd55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818486, "uuid": "d8000223-ce34-41d3-b824-58af1f1c230d", "comment": "Malware payload (AgentTesla)", "value": "eb97084979292344afdfb6a24b152f27b6252d5a0140abaa05111f10c92d9513", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818486, "uuid": "28cebde2-5b0f-446a-9251-bd4820907ee3", "comment": "Malware payload (AgentTesla)", "value": "ebf5286b8c03865bc0f343177eb916b932fa14f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818486, "uuid": "fd0846da-ce5c-49f2-8d7d-fca58507d303", "comment": "Malware payload (AgentTesla)", "value": "212be822cd18ae4db7bdfb3c10cb56dd897961fcf8f2ca988e0bb500f9d21534e9eb7d1b90e1c1ad607699dfa88d2906", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818486, "uuid": "abd54555-e470-4892-8cc5-ffd621943383", "value": "T182E46C9D359276DEC917C4718FE89C64EA20B877970F9217902322ADCB2DDA7CF150B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818486, "uuid": "1e64ab1a-1775-4584-9a21-f5bc504cce20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818486, "uuid": "fafec46a-bf15-4263-8297-4ea1121b30a7", "value": "12288:0+2iNDXR0WPNEqjWv6/zI/vomZge/nwo+XslLC6YVkw1qxdK3vyTvTGOu:J1r3NHj460/x4orL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818486, "uuid": "d6e96f65-65f8-4186-bf8b-89cc87cae132", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818486, "uuid": "78ae5148-d848-4e0c-9508-bf17b072af8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818486, "uuid": "ae181d63-5ccf-473f-a144-f8a7b8c3ffb5", "value": "XiImxLyaaFC3JRB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447b4fd5-0ccf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1658831986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831986, "uuid": "932bd24a-f2e2-45a6-aa32-51d58ba748ff", "comment": "Malware payload (Stop)", "value": "248eaf78e609859febb3bd4316d8df29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831986, "uuid": "17e35283-c354-4084-8715-be80412aa903", "comment": "Malware payload (Stop)", "value": "ebc88e64b881fb5001d4121111ed8bce4ee580d65eb7410b0378645aaec315f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831986, "uuid": "df402ee9-588d-40c9-976f-87e5b8652313", "comment": "Malware payload (Stop)", "value": "8fe40f604f1a377ef7b4913c026d8464c8b5c07d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658831986, "uuid": "ff1da1ae-6342-4554-a028-464ad46d4632", "comment": "Malware payload (Stop)", "value": "3b9341b1d2b0ce730c8578eb3d215310ffab94413659a900a320c5263e3f1cbdfd2b0218176a3e033a329a561831096b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831986, "uuid": "cd43cd70-09c5-4b4c-92f8-439507b78f5f", "value": "T13A050200BA90D03DF47741F479B682A8B52EBDA16B3481C722D93BEE56346E4ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831986, "uuid": "9593d6e6-ef92-4628-9171-0d898bb79b2b", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831986, "uuid": "399e7408-15b5-4384-8a91-47bbf60ecf0e", "value": "24576:lE114h0SbTy9yoThJU66JV/6nxZFiX2y:fzbTyQgzY8xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658831986, "uuid": "b4ba24fc-5944-4849-a1f6-094a85c9fe81", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658831986, "uuid": "ac79dfd2-2bb1-4c45-9361-85cb5d719514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658831986, "uuid": "773577da-fc37-42bf-9f2c-27b3e6109600", "value": "248eaf78e609859febb3bd4316d8df29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9971d986-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1658849308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849308, "uuid": "a28787a8-273a-4276-aa28-6ff754201097", "comment": "Malware payload (SVCReady)", "value": "3e43e586ceb8faeb735fe86e8945cd92", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849308, "uuid": "b9169122-d729-46c8-904c-4cce0ec6fe38", "comment": "Malware payload (SVCReady)", "value": "ee9f450ad795bd9caf1ad830a3be0ca0c6f3926aa59d8e9fab80e1d48fac2e27", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849308, "uuid": "7a4872d8-9a9b-45c4-b20c-6c1984d934e3", "comment": "Malware payload (SVCReady)", "value": "9e92bc926332cba7e7d00109b6edda386bab2f75", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849308, "uuid": "c55a3177-9a7d-408f-a702-9c587c71cc4b", "comment": "Malware payload (SVCReady)", "value": "1e1d54284854ca53aaeddd0f874f88b66ad346bba41b651e265213e3134627f3b34584a0114942368e7e9f15dc1148fb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849308, "uuid": "53b4e362-5575-4699-8644-e0a8e9ef8716", "value": "T120F5331047287E675E4B2EBB7B6456D44D08C5E3A6EF84B6E658DEF336CAC631B840C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849308, "uuid": "4bb90b8b-13d9-4bef-81b1-4fe7f81d91d3", "value": "98304:hiLyDLwx1GHZVlCSbACTu4c/C8kFqYgS8H/i2Zat9kqFDh:gLGwxEnlCUAGsCPUba2Qkqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849308, "uuid": "386cc70e-e59e-43ff-9d52-0ed54c6ffb6a", "value": 3487535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849308, "uuid": "d7eb6755-08de-426a-9320-9abdd91fb33a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849308, "uuid": "6bce741e-fbe0-44da-a2b1-ce7e7d06a9c8", "value": "confinalp.file.26.07.22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42e34ee-0cb9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658822778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822778, "uuid": "bedfc1d4-b8a9-446d-8d6b-1207d1a97e20", "comment": "Malware payload (RedLineStealer)", "value": "ae66a44a251d2a2ca07d1a31afbe805e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822778, "uuid": "3a298f92-48f7-419b-a5b7-9a0efdf1bcbb", "comment": "Malware payload (RedLineStealer)", "value": "f1762ffff906266063b828d10e377f623def543da51cec47fadd78e52d44af62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822778, "uuid": "b182452d-8f23-4891-831c-a1f8392d31ac", "comment": "Malware payload (RedLineStealer)", "value": "1fe82304fe6c81a05de3d11749b2239ca047c393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658822778, "uuid": "6d7be2da-7e4c-476b-9cc1-246654e9b1a0", "comment": "Malware payload (RedLineStealer)", "value": "a9c7a430e3fe37a77d5938d48cfbd086353615a04d76b5c3b793f318b0ba06840dc7d0bc7d7327ff1f37984dc9e9fed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822778, "uuid": "a0b3ae3d-bad2-4bbc-a6ff-d8d41b4de01d", "value": "T15E642BF872E0F27EC81586312A207C7097F05CA1DD71E912E8DEF9E48634EF66B21656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822778, "uuid": "7f5da3ef-4402-4609-8851-c8630fe037be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822778, "uuid": "9ddb37fe-c5f3-4533-abbe-dfb7d7f63a2e", "value": "3072:xZ2DSOahaF7P3cz+m39neyGw/zECqAAS2OKwocmonONL1Y111111405kKjdB:2DSOahapczF0YLEWh2OKwocmogLXax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658822778, "uuid": "cc1ed661-ccd8-4fbd-b405-55695b84db26", "value": 317472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658822778, "uuid": "7ad6aaab-2dbf-41f7-a775-7724be331161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658822778, "uuid": "8ea72f7e-3d53-40c0-ab25-37f8add12c12", "value": "Purchase-Order-Requirements-and-Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762b0ef9-0cc8-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658829063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829063, "uuid": "4d0f4d49-3c1d-44b7-af10-0246681502b3", "comment": "Malware payload (RedLineStealer)", "value": "6b15f9cc210adf324f4fcead7e2e9e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829063, "uuid": "4bc2e329-9673-4cbe-80a5-729fa12a8113", "comment": "Malware payload (RedLineStealer)", "value": "f198bb20b9dfe4b0d4eef203cb71d00eb5351076151408ba16456e8f9bc3281e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829063, "uuid": "548709d7-a1de-4af2-a520-69486ffc0148", "comment": "Malware payload (RedLineStealer)", "value": "3a621f865546067e5502ef58b7f670483fa4ce25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658829063, "uuid": "2516b998-0373-4ae3-9871-79ecd4627078", "comment": "Malware payload (RedLineStealer)", "value": "91ec70b33fe043846da6c1a8183e3c42f297cac961b6c6ca922e6be8c566ef4a51ab7a3223cd18f9e8f74d1d4282a44b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829063, "uuid": "ac3b9de7-7b4b-4723-8102-e1fafc41e02d", "value": "T1CD94CF40BA60C03DE1B712F47966C3A9B52DBDE0AB2455CB22D53BEE56342E5ECB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829063, "uuid": "a3e317e7-f023-402d-a59e-da791bd7d683", "value": "9f971d78258087988285d908160f80ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829063, "uuid": "e5bd18f6-495e-4718-bfcf-6db75fad6087", "value": "6144:0yKmxzFsJOCmPUt/sFvX7poB01L1zWweSemxTTThNtldZl3MT+bfr4:0uEEUt/oDpoBohySxTPhVdbXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658829063, "uuid": "365e126c-1d5e-49d6-9c43-2a1e164d43be", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658829063, "uuid": "e1a3a426-e142-492d-bd46-488c214c7bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658829063, "uuid": "fb6cd635-6b27-4227-869f-7ed07d908194", "value": "6b15f9cc210adf324f4fcead7e2e9e52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d449c0-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658851336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851336, "uuid": "6a535fc9-0953-4798-a7c2-6ce679fcee26", "comment": "Malware payload (SnakeKeylogger)", "value": "c8f89d5a3620e6d425b893b3cd15ceb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851336, "uuid": "592473ff-60e5-46de-b7a5-8b17f5b44431", "comment": "Malware payload (SnakeKeylogger)", "value": "f2930991924778faa13ceb64f8dac5d36d9780a71d953e16e9479a82652cc29d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851336, "uuid": "8fa74602-e65e-4027-8a7a-29b51122a930", "comment": "Malware payload (SnakeKeylogger)", "value": "128c7e9484b8e9dc01ea6cf3e559f14ddcb73a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851336, "uuid": "21c7e55a-ca38-4f65-8944-6c44535b8fd8", "comment": "Malware payload (SnakeKeylogger)", "value": "b9e28a8d3f8d1143b3fb7d85b845b7f74ea93cc310dab5707e4621afe868670cec32fd7572ab05767f80a7530ffe7686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851336, "uuid": "ee76f223-0166-473d-8ed6-16a29bc389b2", "value": "T11A943A1EAB947019E5BFCAB104B191A6FA316D111BC5DC4F57C0AB0938B9243F9B6B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851336, "uuid": "925ecb87-6372-4ae1-ad66-cd419df62ecd", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851336, "uuid": "684dc91f-dbf5-4393-8f70-93cfee250134", "value": "6144:UvEN2U+T6i5LirrllHy4HUcMQY69hzbFuJbX:GENN+T5xYrllrU7QY69htu9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851336, "uuid": "f8b7a667-5b7c-4724-8ffe-f6ee4be6c64a", "value": 408453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851336, "uuid": "558d97b6-f7e7-4dff-bf92-4d2174649a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851336, "uuid": "fe16ebd0-e3b9-4743-b43e-30fb37f0eb95", "value": "c8f89d5a3620e6d425b893b3cd15ceb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55b69f6-0cc7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658828739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828739, "uuid": "77f2206f-4d59-4c97-a18f-a0d320ed28cc", "comment": "Malware payload", "value": "1b9142e9364598845076f2af66f38616", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828739, "uuid": "318c4a4f-f878-4439-a447-78083cd24a67", "comment": "Malware payload", "value": "f2986d0e81cf57ed16bfe0afc22d0fc9bdce099de39854ffd76e1c0e8a16f106", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828739, "uuid": "6406d27e-b669-4405-a7dd-6789e352d59d", "comment": "Malware payload", "value": "f19ed37abbffdb65b0b16876deedf73f9d7d0c3c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658828739, "uuid": "536b48f5-12a9-45a1-98a4-0160bff0ae46", "comment": "Malware payload", "value": "4c74de4dabe73b975c85ae0925985202eb0ac3f66da82c65509d0a59859840fabd195e1c3087f7ae95e5ad7cfc6c167d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828739, "uuid": "baadddf6-acd7-4fe4-b48d-94fa32751ee5", "value": "T17C161505D17DE6D9C337A730684D5FFA8F789408662607B36184D124FEBAA208E71DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828739, "uuid": "41bedc2d-d45d-411c-8e18-651a164c4e80", "value": "24576:89PXMpsuLQY4irQ5QrilYqhti0Wj7aTL5MT2FYfSB0betgH6p8Dm1IPCxkLOdQeN:8OILtgglpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658828739, "uuid": "63723950-780a-4d4c-970e-823237251cd4", "value": 4020736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658828739, "uuid": "c2f94ea5-44c7-4754-9ed5-7191aebad93c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658828739, "uuid": "a8609dfb-6ae0-40f0-8e4d-1659fbb9888b", "value": "SecuriteInfo.com.W97M.DownLoader.2730.13493.16745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc79063-0cbd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824484, "uuid": "98060a5f-520b-426c-8604-2af2f6584ec6", "comment": "Malware payload (Formbook)", "value": "bcc89ef2a9d0031a25942d9dd92e7fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824484, "uuid": "18d985ea-80a3-439f-a6b9-72025e9429ad", "comment": "Malware payload (Formbook)", "value": "f2f1807e10def6ed679f26782bf880eb6246fcebb71e51bde767835cb1e1a5ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824484, "uuid": "f3362ee3-6e4e-4cf4-a1af-959f190706a0", "comment": "Malware payload (Formbook)", "value": "396debf228f6660c52915521c87a285bd346c040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824484, "uuid": "c27df48d-8f8d-4549-aaca-09ed3bf0ca94", "comment": "Malware payload (Formbook)", "value": "b0171439864737a5de65b387276c7ed07cc597d2ac006bb2ba264d4451afaf5036380abf0bbc6eb7e212dbeb15d446a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824484, "uuid": "184b2dde-3670-4eab-802e-6f1c4a2a270e", "value": "T1A2A42C1C3F014F7AED8ED13285018A24FF2E0E937240E9D253FB6AC8D75E4B55D668A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824484, "uuid": "30ecaac4-5736-4b16-bc99-3a3fc6b3408c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824484, "uuid": "d91804b9-644f-4b1a-92c4-10da119fa20d", "value": "12288:MMAe3+4mW72bdujIQleAncqiK3nxuIhjKY+Yz/UQYAaDZ+kM78bH4Xbv22zSIlBt:lL8YCoTYRxrFG2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824484, "uuid": "98ecfcaf-13bc-444e-b7da-e5bd793055fc", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824484, "uuid": "8aa5cc51-41ed-4ef3-8cb8-784a94ebc15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824484, "uuid": "48aecfba-6769-429f-8d2b-7f95f09ddd76", "value": "MV HTK GALAXY (DWT 61,400MT13.01 MTSW, 61.40 TPC).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf99c4a0-0cda-11ed-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1658836944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836944, "uuid": "3574dc6e-bd91-4436-9ed7-bf76de2003f4", "comment": "Malware payload (SVCReady)", "value": "a484630dcbd57dfd48ab5fa0dc6a5268", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836944, "uuid": "ea4952a3-c205-45f2-baa6-9c81ee752549", "comment": "Malware payload (SVCReady)", "value": "f343fba9c1a8b5f43e74f9ed3ca9d495f431aefcc0ff2bbaa5c97efce34f82d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836944, "uuid": "14520253-d712-43a3-83a2-7a9d38b054ab", "comment": "Malware payload (SVCReady)", "value": "707b2a7abb4572bbbee0d479834bc3e910bba3e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658836944, "uuid": "9413456e-b4d1-4d7a-a505-4edc67f748dc", "comment": "Malware payload (SVCReady)", "value": "325100b49f28d247716d7530bdd4a9948f6a76f3868fa6df930bf8df081e69ba3f934c0e90b98048a2ad8ab6e1490d37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836944, "uuid": "87d68ba5-5b35-44e4-a780-6bed522dc2b0", "value": "T1BF55AEB875047CD6667F526BC9A6ADDC13761633DA8798C8B07C7BC70BA3321EE12805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836944, "uuid": "df527b55-a6b6-422d-95e4-013e71c77760", "value": "65ec0ecd44c5fd13dc81281d7bfa8210", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836944, "uuid": "a44e1b19-4358-4eeb-8ae7-fa7040dbbe16", "value": "24576:E4EH7qD9S/DaKiQGa+L7RcJpEv8pH8qeV2iHqvkjjXKJZdWgrO0njXK3:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658836944, "uuid": "1a1efdf2-c607-4bc0-ba8d-102611844ba4", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658836944, "uuid": "e0069edc-09fc-42b1-9611-c9d46f7b48d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658836944, "uuid": "6697ea94-064f-4282-9820-4c3f67ad0698", "value": "y56B2.tmp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3536f7b0-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658851288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851288, "uuid": "e12e5cb0-be32-45b9-8990-a8dbca50fcfc", "comment": "Malware payload (AgentTesla)", "value": "0f86f6afc92fd86f2f413c69fa603245", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851288, "uuid": "480cb851-cb90-45ae-b3f4-9c9359232a00", "comment": "Malware payload (AgentTesla)", "value": "f358dd5247bd06944dd05a9dfd1688a480697c4d18e2660e5bf41ead6a566212", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851288, "uuid": "02306065-7399-4b56-888a-b1165d6b723b", "comment": "Malware payload (AgentTesla)", "value": "04c46ac45b362ce02f99d480168ef559cbe68577", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851288, "uuid": "c3d6a8e9-7837-4811-9402-a644278ca0d0", "comment": "Malware payload (AgentTesla)", "value": "a6340b8f6eace9fcad90bf2b3282cb5eef4766dea5c5c940de87ac3d072a61bd5bb3caa6a231d5a29df2b926e2d4554f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851288, "uuid": "737b0d42-2c31-4841-b484-aeb6338ae0a7", "value": "T17124097E17C55C41C6EE41BDD0A6815811F0A707836AB38F6EE248FD1B172CEFA2A9D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851288, "uuid": "32a3e75c-667c-47a5-bd45-fb2328f301f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851288, "uuid": "431f5a1a-9505-48da-87b6-58509e305201", "value": "3072:CUBIJLFdVGkMGL2ukXucGmhAqmybUSfP5VYJa12IDSHjUrSF0cRiHZf4oaO+r:hBUYiWFGrCUSfP5VJmDUrEyba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851288, "uuid": "12288ade-84d1-4211-b602-4a5734c9e7ae", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851288, "uuid": "1d5c18f1-2a1e-4f79-b23a-b94cf2d25330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851288, "uuid": "ad78c4df-8234-4022-ad6c-de25554c8fa5", "value": "0f86f6afc92fd86f2f413c69fa603245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5644212-0c9b-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658809815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809815, "uuid": "17ef6309-ee66-4659-99fd-f2ab8576421b", "comment": "Malware payload (AgentTesla)", "value": "5b9f4e0377842eaea96b7bcf62c13229", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809815, "uuid": "e5d8fe8a-2e2f-424d-887b-9d2104d921ab", "comment": "Malware payload (AgentTesla)", "value": "f454566e4b723067d1660cd6291fd3d8a0603539fded016490780106182d8c31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809815, "uuid": "2699bbb1-4c4f-481c-a4fa-b2052851ac05", "comment": "Malware payload (AgentTesla)", "value": "8bdc38e6d16f185de6d84f6637d5ad371d02486a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658809815, "uuid": "3ec44a22-3044-45f7-bf8e-f51d39424a45", "comment": "Malware payload (AgentTesla)", "value": "f7413db70bb3943283abf4c41268f6fda3690e2456ff5deaaa0a2b7545ff7f4708a6f3730eb6ff8e8b7afaf6c5c90147", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809815, "uuid": "67eec853-27bc-4ee6-8f4d-69084be5e509", "value": "T1F7B4AE74B1F9E2CDC49AB839EC4BB8F45510EE25C6268D4F7C8A7E4A3438256F93015E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809815, "uuid": "3af3d84d-c670-4509-9ed5-47ec2329c830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809815, "uuid": "1b225555-5bba-4ec3-ba2d-6cd9eed83ed3", "value": "6144:CJDkJ9v4vqlfFoJ+e/iavnZ3ZXvB2Gv7Mbi73sL7j9xcNis:CJyv4Wfu4e/ic36ZGgj9xcNis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658809815, "uuid": "68233db2-540c-45cf-b2d9-cab4b97247ac", "value": 536280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658809815, "uuid": "d9944162-4afe-4155-80cb-73ce00e607e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658809815, "uuid": "d8a590b0-f64d-45e5-8d38-389b343fe4d1", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.4102.14597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251eb0f2-0cfd-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658851690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851690, "uuid": "a5e9645c-d622-4262-bbf7-9a10b4452481", "comment": "Malware payload (XFilesStealer)", "value": "d6f10f71c9cbbb9eeb2c6c6794dafd17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851690, "uuid": "41b8a29a-0019-445d-aebf-39cbbbc6f062", "comment": "Malware payload (XFilesStealer)", "value": "f45e57908a7d464f45087124783a19070fe54038c5b009637eca3e89d2bcc9b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851690, "uuid": "c6b5a315-8577-4e2a-b175-faab6d5cb993", "comment": "Malware payload (XFilesStealer)", "value": "8059287b71286ebdefa8dac00587fc2af20be188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851690, "uuid": "93788a43-7389-4ee1-b495-0fb5b333cafa", "comment": "Malware payload (XFilesStealer)", "value": "4e0a34cbe8f2f842d921a56775d01331fea71a590fcd8cb28e4f1b1ddec3957577fc5bbc37b69de496ef20c10fccf514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851690, "uuid": "a980ac52-16d9-4e42-8350-3cb14adb0ffe", "value": "T166B46C4063F8862BE1AF577AE871042597F4F407B2ABEF4F4A40A1F92D66706AD40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851690, "uuid": "db38a99b-2499-4abc-a15f-98254c6ca4cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851690, "uuid": "1eea38e5-d69a-4821-9118-bd8f42b2bd83", "value": "6144:RTEgdc0YrX7IxUpGREWXkYoQdTEDXKpDkQfocEPOb8F9XpfXfNLQcTR3x:RTEgdfYIxUIA+Dk/ptp3NLQcdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851690, "uuid": "456d1a45-8796-4677-bbed-a4a9618f04cc", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851690, "uuid": "6c99ef45-4f26-4584-b793-abb7055332bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851690, "uuid": "ec2dda67-7046-4b19-9035-24a1628c7234", "value": "d6f10f71c9cbbb9eeb2c6c6794dafd17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635394b4-0cf6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658848788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848788, "uuid": "483f242c-d6d0-46b2-93f5-8495197038f3", "comment": "Malware payload", "value": "513110ebfb0082d10532428c370d3b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848788, "uuid": "b4d8df91-e25a-41d3-97d8-4a66d8feeb57", "comment": "Malware payload", "value": "f548ec53e265211f8314341099521ed205b72ded9101b024674050c98e338b81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848788, "uuid": "867453ed-5867-4072-b5ca-dc6ae2d0e0d3", "comment": "Malware payload", "value": "a403f8683cdebeef06fa1b91a7533c09226d3b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658848788, "uuid": "3a2db6f7-4712-446a-8b4f-4fc3638d0985", "comment": "Malware payload", "value": "320615455f7051cc52edd3210290c1df1fd6718b03c1461cdd9f3ac8a66bd5efd4996ff5af18b57d8b0800c189bfeac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848788, "uuid": "52327d23-9657-4477-979c-997353b4f9e4", "value": "T15106029A614833ACC01AC4309533FD44F1F6121E1EE6C9AE77DBEED1776A8219606F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848788, "uuid": "0eefb299-a199-4e5e-b2f4-06e91dc5ebb0", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848788, "uuid": "ebabddd1-9cbd-4450-a4ca-a40bf8122b4d", "value": "98304:L+7UMGw7fRPY7osBwnkGOUIOkt4TC885O/z3kP4:y7UC7yosBwn1OvOkt4Tj8U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658848788, "uuid": "1aead0bc-ce4f-4d71-8d08-fca5100c931a", "value": 3908608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658848788, "uuid": "140ebc82-097d-4945-8776-7fe056078d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658848788, "uuid": "978ee3ad-447b-49fb-b1ef-6c519a4beb41", "value": "513110ebfb0082d10532428c370d3b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f497bd0-0d0f-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658859465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859465, "uuid": "51ae08a2-1a71-4f92-9565-75acd19d8e93", "comment": "Malware payload (SnakeKeylogger)", "value": "db785722b9adda6d58dc82c4770740be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859465, "uuid": "dc5b1edc-817e-4e5f-a8b8-70c19a60906f", "comment": "Malware payload (SnakeKeylogger)", "value": "f57a6464de1ba59e736dc0974482af7a58788adb5640b7242b86c8ae1a43615b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859465, "uuid": "1cb83987-238e-45ad-9a7c-c5026ef52863", "comment": "Malware payload (SnakeKeylogger)", "value": "eba6151a030252283b9fbb15e6d474af8e9227d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658859465, "uuid": "c3b00f2d-9226-4c76-ae3f-666561b4a4f0", "comment": "Malware payload (SnakeKeylogger)", "value": "95e7db1aea13af1a70afa57ffc838e961637c0323355ca9d01dced9447f3e6e27b4365993af8811499febb4042030727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658859465, "uuid": "8c3284a4-fc3a-4e59-9b0f-972952cf8b79", "value": "T11CE4E12223ECCA5DE5BF03F9F4344645437EE206E45BD78E5B90B4CE6A633A0D1552A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658859465, "uuid": "84ca8bb2-ffdc-481d-b395-c8a36c261b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658859465, "uuid": "7d0c5f90-fc6a-48c8-9804-67de192dab9c", "value": "12288:OtVvg202b2UVFdPBGjy958J8YmfbwsTas0ETD5vFo/cLeDgBnKd+L:UXGjq2BsT3dJa0ckL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658859465, "uuid": "6e5b0a66-73a9-4ff4-b8c0-bb19519a7232", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658859465, "uuid": "d6f3ab0a-3ad1-447c-ad0d-8617005ecc75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658859465, "uuid": "b5b94d97-56fb-4f34-ae92-99d7f412bd5d", "value": "u5U9DSjuqIyF6Q2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacfea25-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658818011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818011, "uuid": "4b0ebaf4-d948-42c3-b646-719afb15affd", "comment": "Malware payload (AgentTesla)", "value": "abaca5e695a47b621ea1dc30b63437e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818011, "uuid": "3c32d4d4-5642-4d4e-af7e-cad5ecc28131", "comment": "Malware payload (AgentTesla)", "value": "f6d85e93d9ea8ec363837b7fb8120e40ab3da722d671a0deabb7b48746567d1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818011, "uuid": "31f94f93-fb3b-43cd-a539-27322c8f999a", "comment": "Malware payload (AgentTesla)", "value": "e882999fea43275e38c49159a1eec1fd7e0ef07d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818011, "uuid": "9c623003-f364-4eec-a6b9-852c3647feef", "comment": "Malware payload (AgentTesla)", "value": "929c16b5f706702d7f4b35f02d8203c566a9901768bea59bc370ec7a586483fa15e285a40cd364bebc79b542c0d0c0e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818011, "uuid": "b4a69583-2a27-473d-8ef8-e3840b811ee8", "value": "T1B9B4236B70AF90733EE952017696595FA0ADCC4701C074E862A9BF339B800979D269FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818011, "uuid": "41b7d165-308a-4b98-a1c8-9649ff7f8ac6", "value": "12288:0oLxGegl/aujQnu7+NbZ0/NWW30MI47WBM40UlnQ8ETD:HAh/aLn/NdNWEMBlzUhQr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818011, "uuid": "e9e7a256-9814-4998-a849-c67b2f16345c", "value": 523528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818011, "uuid": "c74c466b-18ac-4baf-828b-a7ab0062cdaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818011, "uuid": "68a16f20-4228-4477-9662-54738b4bb1fb", "value": "Processed payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cba37e3-0cac-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658817048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817048, "uuid": "176bc107-0da0-431c-8233-18eff40c67cd", "comment": "Malware payload (AgentTesla)", "value": "b0c14b98a8c7032661a1fb859a81a930", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817048, "uuid": "599025e6-e592-4406-8a18-4751d7684073", "comment": "Malware payload (AgentTesla)", "value": "f7e71aaeb49bac127b5bdd44b2da161e9ecad17e8224da2242cadd08a92f0cad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817048, "uuid": "97ba6c19-f4d7-485e-8b8c-5d2e5a3b9785", "comment": "Malware payload (AgentTesla)", "value": "6170b1ebad02a0bd4be5f715a2ccbba0bef1c815", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658817048, "uuid": "25a96a0d-2696-44c4-92c0-4a6a14cf4b49", "comment": "Malware payload (AgentTesla)", "value": "98cf8cf6cea5b4df289b2d592565b36ce402022ecc662c547b90594d6f7c1990b7660713700419b1dfa1cdf24780294d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817048, "uuid": "3d074196-b7ed-40e0-b088-37ab0d95e403", "value": "T18DB4236B70AF90733EE952017796595FA0ADCC4701C074E862A9BF339B800979D269FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817048, "uuid": "d78fef8a-bf99-42d0-af21-5f25d0a4ea6c", "value": "12288:WoLxGegl/aujQnu7+NbZ0/NWW30MI47WBM40UlnQ8ETd:JAh/aLn/NdNWEMBlzUhQrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658817048, "uuid": "bd9b6fa8-c56b-46f4-9583-6aa23430961e", "value": 523536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658817048, "uuid": "2ffd1b40-9a77-4a27-966f-0d83f9cc3c6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658817048, "uuid": "b4d4a4f9-1632-4a9a-9b05-943218ff4ce5", "value": "REQUEST FOR QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ecd599-0cbe-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658824652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824652, "uuid": "1e7962df-cd7a-41ed-9b12-2be33b95af4f", "comment": "Malware payload (Formbook)", "value": "1d0a35d369294f477b177f3fefd71e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824652, "uuid": "ffbe0d6c-4e52-45ff-9391-0fa4446cb844", "comment": "Malware payload (Formbook)", "value": "f81a6b81b1105f6f054218defbc7abd72b3588b7cb088b754ced7e72e4f58428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824652, "uuid": "d8b41ffb-0c09-4bb7-9756-ae73afe2e83b", "comment": "Malware payload (Formbook)", "value": "15ac638958659b7ff814ab9ea23d59dd8ab8c038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658824652, "uuid": "71aa4df3-a37b-4c63-880e-8465a602acc9", "comment": "Malware payload (Formbook)", "value": "3c466b9cc5b1e4fbeb0976b481947c2d26fa26df8bb9f149fb63a8e4acfde60c9833763a43fd2261b9b5af21703386a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824652, "uuid": "dd864aa3-bb91-49ba-9ccb-81d56834cad8", "value": "T1C8A43C2C3A094AE3FC0FC13099030A94BBE20B876240B9975BDF95FA8B5F5656D55CBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824652, "uuid": "d080bd8f-e07a-4bd2-a2aa-7f465ea07e9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824652, "uuid": "81eb1779-e244-4c0c-99af-0eba34e2dc49", "value": "6144:jU2IZsrNcaHMe59v1BXFz62L7YEYb5Ff95Yt4Hg+7VBKWKK5Lx8:3Gs5caHV59hzX3YHb5uugyB5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658824652, "uuid": "60e0d06c-7226-49a6-8ede-cf7ba7580d7f", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658824652, "uuid": "43c33017-8b0b-46d1-927c-4cffc517681a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658824652, "uuid": "3f8e01cd-e2da-41c4-9a70-cea5527c3ec2", "value": "VESSEL DESC-MV TBN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a53956-0cae-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658818075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818075, "uuid": "1e913dfc-530f-44bc-956c-ad0e6326fd06", "comment": "Malware payload (Mirai)", "value": "0aeb2083f322617945328762fd050363", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818075, "uuid": "6c69d496-c6c4-43d6-9488-120926ff26dd", "comment": "Malware payload (Mirai)", "value": "f88774342100d08013a1f7694c8ffb28a9702a3b8394f9830603eef2f95b798c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818075, "uuid": "2cd12ed5-e34e-479e-89f9-33d159053517", "comment": "Malware payload (Mirai)", "value": "79c322999b85151ecf3991136434a8d493e8390e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658818075, "uuid": "5f10c930-f135-46d0-afcc-c5b3d92d9fdc", "comment": "Malware payload (Mirai)", "value": "6216875ecb949671971cb009d54d51a2b7263a57b1f7750e6655002fb5fe1530d7660c58471d52836e5e85b46c4b70fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818075, "uuid": "4f9a192d-84ec-4911-9c36-1bcf149c6b89", "value": "T18CB39D9BF6871160C86346F047CB4FDE3F2322815F5785E33D6A257A18BA1CB8A05F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818075, "uuid": "80414858-5c65-468b-9ab5-439b30613887", "value": "1536:/hgBxs3i9mSig7PGM0+mm8OEqblW/vJHgVKa10mJ/LWWc:/hsui9mBAuM0+mz1qblW/vJHgVfpqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658818075, "uuid": "993b8578-0fe3-486e-a3a1-aa510c3e83b8", "value": 109084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658818075, "uuid": "f764c28a-1037-48a3-9537-94fa3b116d3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658818075, "uuid": "fb74822e-a091-4bfd-af7d-bb2165e1ae21", "value": "0aeb2083f322617945328762fd050363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9264d1-0ce5-11ed-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1658841687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841687, "uuid": "c30182eb-100d-4182-a06c-8c489733ce78", "comment": "Malware payload (ModiLoader)", "value": "908bff634f743b4a6e6a9a07da4d73b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841687, "uuid": "d211a748-b7c9-4df3-882c-a5e93d06a4bf", "comment": "Malware payload (ModiLoader)", "value": "f9fc679cd72fd47ecd857ca86fffe2f0bbd1c880d5d5cad8c02ae9082b1239f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841687, "uuid": "ba13551f-e430-4855-8368-bfda67603e63", "comment": "Malware payload (ModiLoader)", "value": "3dec33ff0ad5e62fd87049197828c66e8b5d42b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658841687, "uuid": "ea5abd35-54d9-4efe-b884-c43e1d8d6be8", "comment": "Malware payload (ModiLoader)", "value": "72e1a9a3ece94ee9b6980aaca96a7de559fec2ef2b8be3ce57e05294296fd267155098ece5d722e0935dbf937db0f78a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841687, "uuid": "f823343c-f651-4911-8d44-c051fa404f2c", "value": "T193258D31F6D24433D073277C5D1B8665A92ABE003A78D88A2BED2D8C1FF968179352D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841687, "uuid": "e62a120e-8587-4938-ba6d-8cb78a921f57", "value": "205f6434858f3f8cc9e8b96d094507a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841687, "uuid": "e26210cb-47f4-4112-9003-d650338ba561", "value": "24576:5DA1mchKTwkH17WtMBhiUDxvHiMYStUtVSn52pAf2rDNtl2aCHX:5Dhc8ZPbVI5Sn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658841687, "uuid": "9fe511ba-9466-4c73-bc22-da94df487204", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658841687, "uuid": "7aa840c9-d179-4a2e-9a1f-c88644d81f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658841687, "uuid": "f5cf003a-dafa-4eca-9df6-049945735082", "value": "Purchase Order_Request for QUOTE Specs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec042e9-0cfc-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1658851492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851492, "uuid": "9a33e0fb-bbcf-43c5-a4fb-987b2b5e4b9e", "comment": "Malware payload (Stop)", "value": "803e3d466724c4f27bf23bc0a0a3259e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851492, "uuid": "8c2057a3-82db-4b34-b01d-c170dc68b27e", "comment": "Malware payload (Stop)", "value": "faf748cde56ca4cda7aa408df8cba4967c92a6fc7950ed9b1af06456183d8b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851492, "uuid": "4d7fa48b-cf4b-4857-8f2c-7c73034820a9", "comment": "Malware payload (Stop)", "value": "0a8e044da7a2357ae11a035115b056470d4bb63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851492, "uuid": "666953f6-8919-407c-a11f-0eca23e18209", "comment": "Malware payload (Stop)", "value": "22b297acd0d731a0776ba1863963f0a73ddbb473f2a53fbf9f19fa1fd8b1f097117584e653f41d9cea4c05767586fa05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851492, "uuid": "d4895453-7434-461c-a59c-07703c79f7bc", "value": "T1390502807650C03DE1B701F47E7AC65CB13ABDA05B2154CB72D23AEA5A356E0ECB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851492, "uuid": "9e82ddac-d578-4a67-a893-069e377d0b21", "value": "341ace376080222d26a7767debb6055b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851492, "uuid": "fff8488d-c5b2-4e92-8dd2-44def6d5d8ba", "value": "24576:k9pmsQd/2wI/duW3tUb6eS0zSLMPpFPMFQUXmj44jw:/dr8oOej+LypW2UXmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851492, "uuid": "fc935ad5-8b1e-493e-a395-e32458142527", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851492, "uuid": "eb74c7f6-9b5d-4904-b60a-a767220afc85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851492, "uuid": "7a411232-0707-4b59-af5e-5da2862ca236", "value": "SecuriteInfo.com.W32.AIDetect.malware1.2311.16387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef57359e-0cf1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Metasploit)", "timestamp": 1658846876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846876, "uuid": "dc22a85e-a895-45f9-90f9-20d3a54489e4", "comment": "Malware payload (Metasploit)", "value": "a737e670f7b03c09b4f789c50b9ac0f2", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846876, "uuid": "a5e0b7ad-8ade-4b7f-a5e7-5cc3d3ff911a", "comment": "Malware payload (Metasploit)", "value": "fafc19553e0eb01221c4c1a9bb65ce80d0a34213c121f55923b43f0795160829", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846876, "uuid": "8dd28733-16b3-4fb7-8ebd-5ad852e71306", "comment": "Malware payload (Metasploit)", "value": "8602c9c29af2e8bec1be9e3a84753d1052405074", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658846876, "uuid": "86b47b87-e818-4bd4-9378-a95e23a74e84", "comment": "Malware payload (Metasploit)", "value": "244d096a1aebed80292969a967f19f9fefbc81bc0a5d2244859a6e785117474c73595fc97e437dd8e38eb7cdd6e5279f", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846876, "uuid": "49510fb8-2df5-44c1-86e6-43c614caefee", "value": "T1662301DF0331589EF469A7FA823001595A7A3CE3F18EA12590AFF8639535D9096DC33E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846876, "uuid": "b25004b5-8867-4d92-a5ed-e5f8901ff3b9", "value": "1536:fTP1bp0y+mb3Eei37Qc3Krd06P0bMiLLb8SDZ:flpOSrm7xaZGbXL5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658846876, "uuid": "2b34b53e-7d84-4632-b3e7-733dc7e046bd", "value": 49712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658846876, "uuid": "5e4740eb-0544-43e8-a8db-a5941e02142c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658846876, "uuid": "9c916b24-2f76-4396-a7f1-78d9008cb666", "value": "remote.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe5c421-0cf7-11ed-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1658849393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849393, "uuid": "08ea05d1-7363-4d86-a1c6-36c1ccf3799c", "comment": "Malware payload (STRRAT)", "value": "f74e7f8f5dfe441147483995e0f70797", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849393, "uuid": "a577b38d-448a-4f36-b2f0-024e86b50d8c", "comment": "Malware payload (STRRAT)", "value": "fb65d28224f78818fceb66bab7468b4584b0c56c964c0ec83ad98e2afd680a0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849393, "uuid": "62b991de-4c70-44a1-9c66-b09b404e2c20", "comment": "Malware payload (STRRAT)", "value": "bc015d767c660b467a8ba9b3f21779a392ad2670", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658849393, "uuid": "9bdbf312-a161-4a07-add2-982f2db43b8c", "comment": "Malware payload (STRRAT)", "value": "aa29d8eba435b6f0037d6eea87f1c4d8d9a1825ad7f1756448e64e06b7b0cab1960b478878751e32f88e6758b7513958", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849393, "uuid": "47c5f514-ed15-49df-b88b-5d3d28c37714", "value": "T13504CEE44EC35B9CFA18A735D0E616274EFCEB4BD4082801469FAFC69F6A503B41786D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849393, "uuid": "9609c57f-a610-4dd1-9fcc-6ff3c61f6893", "value": "3072:Z4vps6L3X4BEfF8DJ1NyegZVJxIoNIEyyDQ9Njr+nsGgPlTolQOHZxZFDFMLG:Z+p3WE9f7VPHNbyys9NSsNS/3F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658849393, "uuid": "14348898-5002-4189-a451-e7be1cc76e97", "value": 189561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658849393, "uuid": "d84361b1-d200-4db9-a167-fdf2618467d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658849393, "uuid": "6f361c49-29de-4c4f-82d3-54555430b7fa", "value": "quotation spec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e816790-0cb6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658821319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821319, "uuid": "815b4325-ebc8-455c-811d-bf40597d8b70", "comment": "Malware payload", "value": "cf3c513de113542ca6647a9a3e7babbe", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821319, "uuid": "d5e46c81-4184-48fe-999b-226311fe481c", "comment": "Malware payload", "value": "fc78f2aef5905408e5fcee54803950971117b0ddd96115fff34c2a367e76f779", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821319, "uuid": "2b5935cf-af18-49be-8efe-a885d09125de", "comment": "Malware payload", "value": "afc35177679dd09a0fd89e9c8fa4f11180ec3da4", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658821319, "uuid": "90068f29-60b0-48dd-89ec-32fd1fb8daa1", "comment": "Malware payload", "value": "ae4fed16ccc9707625599c1b6161ec5076343bdd005d37a5bfe3d1274a710e3a1ae489211ab0ff308a9c020290656d36", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821319, "uuid": "12b6cb08-7907-4dd3-b16b-07d8adfb37bb", "value": "T1199423FD28C0D3B9C2950B3D5FA5EE26348BF1C59A404EF2A6E40011BD5FC60D6A5A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821319, "uuid": "6efc7042-24e8-405d-971a-22add2ebcd69", "value": "12288:iOPTPtDQyGH/8vzQg+qquCajv0dwRqevC1j:P7PtMO0q6oBRqPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658821319, "uuid": "b9f97446-2a9b-4cb4-90db-9fe21928bd96", "value": 414983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658821319, "uuid": "0844af45-2d9d-4b83-80ef-a9681a38c7b3", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658821319, "uuid": "15981013-c7b3-4c81-aad5-3bff068ee45a", "value": "fc78f2aef5905408e5fcee54803950971117b0ddd96115fff34c2a367e76f779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec3808c-0ca2-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658812730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658812730, "uuid": "3ea106c2-a0fb-4d3b-a057-a235d48254e1", "comment": "Malware payload (AgentTesla)", "value": "3f4fc32052cb51ac5fc68b4a75ef65e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658812730, "uuid": "8463edc7-f792-459a-8db7-b0d56b96d885", "comment": "Malware payload (AgentTesla)", "value": "fca4e2a91120791a27df8d8f7ba030e4d6836958ba097ffe2f0f440f6f8babea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658812730, "uuid": "b8b2ee7a-0419-448d-8be3-2a3fd88abfe9", "comment": "Malware payload (AgentTesla)", "value": "6670e9734e5853f375c2f472ada7c54dfea57479", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658812730, "uuid": "a30b4bdd-efdf-409e-a67e-2fc13569483d", "comment": "Malware payload (AgentTesla)", "value": "a8d8cc909ee83fcff5a6658540d3b6d80248ea64100a7dbd79e4d49a9a3da191fe1ff794d9485710eda5dac95ecd45e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658812730, "uuid": "35cf3f75-92fc-4879-be17-7e63da9a706f", "value": "T1A0C4E0103ADBF728EF22D6786BECD0658D75E913E90CA6B96C213339C775E714992032", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658812730, "uuid": "c596bf7d-db9b-4172-8cdf-76eb5f371017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658812730, "uuid": "dd8015bd-08c6-482c-a374-994a9c3c4d19", "value": "12288:IuG2iNDXR0ZNmaJp38IPxs0VWZ7bnuatLKZNTg8f:I1r6man5Zs0VQtClg8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658812730, "uuid": "01965f23-564e-4a4f-b5c0-efe29673c679", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658812730, "uuid": "b090fbba-e721-4a99-8e39-6ee9ddfebb9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658812730, "uuid": "59588ee8-cf59-4947-a82e-b4941f0a0c58", "value": "new order 00041221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c19fd3-0cfb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658851146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851146, "uuid": "7ad227c8-b62f-4448-a4b4-11c6225bd6bc", "comment": "Malware payload (NanoCore)", "value": "1acb9b6595cdb48535093287bd9403dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851146, "uuid": "2d2291da-0d2a-44cf-a8c6-1b156c827aad", "comment": "Malware payload (NanoCore)", "value": "fcdf39985da32de4575c36dff4d20b559f50d285227b8a5d7ba1a0d3604999b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851146, "uuid": "d3ce2c4e-107d-498e-ba95-2bfa2845c5ef", "comment": "Malware payload (NanoCore)", "value": "31f4bdbfbca43408efb3922ba711b876d0f4a274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658851146, "uuid": "7a510202-53d5-4980-aa1a-8e885e262770", "comment": "Malware payload (NanoCore)", "value": "9efb496fd15e83f0c5bd0be976f3e5bc0c9b28f1b8ead9ee015274245d82ff3b7bd46280f399ff214b7d096296024841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851146, "uuid": "ac4f1d56-7262-4f30-a102-bbe06213dfb7", "value": "T15E35AEAC351077DFC8A7D6B9CD64AD64AB103966930B9E07B01311D9AE4EB93DF014E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851146, "uuid": "acc03729-1932-4a38-8972-bdf8cb506687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851146, "uuid": "b21e4b3c-508c-4cb7-beaf-582c2e0fcb2a", "value": "24576:Fw4UZvybcv8vR1/EgRV4cQr+SS+axf5cO6Tc+JWfY+n22ux0rH:F6d8pagaQ+M5sTDqLnbrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658851146, "uuid": "091ef0bb-fa12-44dc-adfe-6207c67f0e89", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658851146, "uuid": "09c2a697-ec41-422c-a0bd-d4ba5d68e84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658851146, "uuid": "c21595b4-e53a-4616-8972-d88ecded5047", "value": "1acb9b6595cdb48535093287bd9403dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1553f5c-0ca7-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1658815069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815069, "uuid": "33ac21dc-90db-4e26-a823-7e0b6ff8977e", "comment": "Malware payload (DBatLoader)", "value": "6cb8ab34b6f72aec950be164f618bad0", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815069, "uuid": "4ea6cc70-b394-4174-ad22-8456f999d080", "comment": "Malware payload (DBatLoader)", "value": "fd245ae3b969aa8479f84cb552033384444b3de67f68525e72f38cb601410554", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815069, "uuid": "0d097fc6-3b07-43fb-b84b-4159e484136c", "comment": "Malware payload (DBatLoader)", "value": "8e0782d73c9ae6f9621bef1a814d169ac005e80b", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658815069, "uuid": "104071ff-8055-4f48-8ad6-083a80355a8e", "comment": "Malware payload (DBatLoader)", "value": "d4b7eab0a656c9e75cd6295f6b3e5a452bf95b1dd57d3e16b250734a9b561a6f19fb96a3b343c9ff6791dd883f1f359f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815069, "uuid": "641b749d-60b6-4f61-a2b5-a0b5260b809c", "value": "T1A4059E27E7608937D153193D8D0757A199357E103A28E8893AF92E4C9FF9B803A353E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815069, "uuid": "b3be3469-4f33-4ae0-861d-3437872269f4", "value": "781d4553e908b497b062e7e382c7936c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815069, "uuid": "16cc0b2b-5547-4dc6-a8cd-78f73ba7124e", "value": "24576:XWWH7k2z/m1uA7Zo4pdUtVSn52pAf2rDNtl2aCHXrO:XWrqMpd+Sn52KNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658815069, "uuid": "3118d7b5-7996-401e-8d79-91f0bd3e9f9d", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658815069, "uuid": "f1b05685-d2f4-424c-a557-6c18853ef314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658815069, "uuid": "8d9f3101-74c5-4863-a581-7c382662a2e4", "value": "PURCHASE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }