{ "Event": { "published": true, "date": "2023-11-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-15", "timestamp": 1700092981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "609bc629-c49c-4892-9f43-c19e93537562", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717a498f-83e7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700074055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074055, "uuid": "1078d2e4-adfb-4a85-b6b5-f687e5d9b8aa", "comment": "Malware payload (AgentTesla)", "value": "76e18b6761478a27d72769c2af683183", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074055, "uuid": "03354da0-9d89-490b-8b26-9dc0b6653687", "comment": "Malware payload (AgentTesla)", "value": "00e245b9a6266afb2eb6b81cf96520ca093b7242dd39b1b74daf4d5811ce35fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074055, "uuid": "8b530363-6e5a-4138-9ece-ad68aa59846c", "comment": "Malware payload (AgentTesla)", "value": "154472fe1ac359757442e1a94b0e6a6d2d4a7762", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074055, "uuid": "78355a67-1175-4ede-9673-50d304be8163", "comment": "Malware payload (AgentTesla)", "value": "82857b6f284b539ee700263b649f37812eec198e949b4f18fdf4a7a333deeecd37ed7a032bc1f28bf3d6a50b8cf2fc7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074055, "uuid": "709bf14d-b202-43d2-8348-21d066246442", "value": "T1DDF49BEA717B821EF0E8A6FCA495100C52A69C5D1D5EA62D0942A5B9D1FDF4C0F0FF32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074055, "uuid": "f5f352f2-2f3e-4250-bde0-ec4ddfb3fe8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074055, "uuid": "cbe51cf8-2e52-4d77-aa83-1b7c2ea86951", "value": "12288:WSNuPgGOyd6ynyGnWAueyPuT5E4+4v1i4KJ7I7rAM4UwPAfZ9iIR2:dYHOyd6YWAvfi4diHJ7I7UM4vRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700074055, "uuid": "03555fe6-7051-4018-9a89-b19536ec561c", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700074055, "uuid": "a8ec9c39-5275-43d0-adaf-9273f734f9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074055, "uuid": "7611aff0-6cc5-445c-8390-634947e1b358", "value": "INV#761538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35ac5d8-8398-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1700040289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040289, "uuid": "2a28f280-721e-465e-a876-ca0c7010c15b", "comment": "Malware payload (CoinMiner)", "value": "98e59f01a83322847f62e93811500f0b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040289, "uuid": "ab1537f0-3c63-4404-9775-afd336d52688", "comment": "Malware payload (CoinMiner)", "value": "0233e973071b55934eeafc66da12e02587c5b1604d3b300ccbc44f018c2b80cf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040289, "uuid": "daf1a899-4b17-416b-9c1e-26d039fb014d", "comment": "Malware payload (CoinMiner)", "value": "5a4200d85f2856ad5a422a5a83ad8cf07d9f2ef1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040289, "uuid": "e7dda113-77ec-4e58-bf05-15d96f044755", "comment": "Malware payload (CoinMiner)", "value": "2d52f4bd78bd3f7dfadb7f5f38e592c5860ff1530115a3799d0eef549a5068c1605740d75e4db33eb2aa2d130ee81ef6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040289, "uuid": "ac821d64-3ee4-483d-aa55-15d139679a0b", "value": "T13F6533374C858E171264BB3A413444538AF932DC5E58A1BC8C67DBA6A7CB31E7BF46E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040289, "uuid": "c9bafcd2-cae5-4544-bb1d-16d624ef4153", "value": "24576:CxEMpLF3kldhojVePmmNJNZBKIeiQl1jX7riP9xLCSoPu/xMCZm1xLLhAv:aHpdkldhoKdBKIeiQ7bHiPDeSB/qCZm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040289, "uuid": "c10dd4d6-27b7-4bc4-aea9-ff848938f950", "value": 1424964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040289, "uuid": "42e8bc72-2aeb-4a2a-be57-ae6d5c1e9bb6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040289, "uuid": "e0830be8-36e0-4521-b258-ddb0d9a00e06", "value": "0233e973071b55934eeafc66da12e02587c5b1604d3b300ccbc44f018c2b80cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430c6903-840c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700089869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700089869, "uuid": "a9480402-40b9-4498-95fe-fdf4313762e4", "comment": "Malware payload", "value": "84b60be3038fe7bc12e7bf3f647b5813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700089869, "uuid": "028b4bb7-7e13-4f0c-bcd3-692764fcb033", "comment": "Malware payload", "value": "02d956d1f2c9ecdc43ebcbfef06dc160cdd9e5e31f50c692bde9ed1dd9797040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700089869, "uuid": "d2682c75-ef7c-4bb2-bcf9-0cffa830bff0", "comment": "Malware payload", "value": "b1049b8dc704333503b786373288d9c3e074caf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700089869, "uuid": "bc135089-9d06-46ba-8f69-cfb7f60379ff", "comment": "Malware payload", "value": "3ddad216ad697cf790d713bcddb55bb12cf64aae31b53764cfc0e5cf92a744362c225b509bdc48ad35afb1806b2cf1bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700089869, "uuid": "f315388e-b014-4599-bb64-f17641db455c", "value": "T1C944296392D1BD54E926CA728E2FC1F8771DF9509E497B763228AF1F14B11B2D273220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700089869, "uuid": "6e709a6b-fe02-4388-b6d2-72133c6f56c2", "value": "f62af2e8b5dd9dbbfa6927c42dc35c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700089869, "uuid": "ca29c19a-1596-4837-b0f0-c4460bac6c5d", "value": "3072:CdDJ87KLdLVJZg27Tizxk4I39jEGmcbJIvROmvZyick9CRG:iXLdLVJZN7Tiz69zJXm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700089869, "uuid": "dd325c35-7560-4dcd-9467-b096bef68e9d", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700089869, "uuid": "bf658ee1-eb81-4a7b-96b7-5459c5cc5929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700089869, "uuid": "0cf578fa-3969-4020-ae1f-54317afa4ce2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4218a4b-83e3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700072503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072503, "uuid": "c8fd4333-268f-4140-a1b8-9bdb40230e6d", "comment": "Malware payload", "value": "0ee7fd20d77371a19b5f754032851472", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072503, "uuid": "37589dbb-dbf0-4f05-b07b-982bb9177e91", "comment": "Malware payload", "value": "02ee3096c2471e5645404518b3fefd9c72b473bcefbd7c2ee167256546cdd030", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072503, "uuid": "17f598a5-1925-4289-973c-3fc9539e4d2d", "comment": "Malware payload", "value": "148aa4d7fb7435ce0efa32b8360e2b61ff044c29", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072503, "uuid": "25992dd4-0949-429e-969f-fbb5c2ae4b1c", "comment": "Malware payload", "value": "cbaeded09354d2bdd70b7910020c7beef81f924bfc3eb5959748e7d7c51bec3addb6b9346614fc098856f01349dea034", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072503, "uuid": "a452fa1f-9200-4011-bf22-5624063a5c72", "value": "T18EB49F0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072503, "uuid": "4d29e278-660c-4884-ad77-58b4928aa2db", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072503, "uuid": "113f74bf-2363-43e0-a799-effbcdd15ed2", "value": "6144:sexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7rpUlLaEx:seZeWSpda70ADIgSoxgUW/zFun7OpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700072503, "uuid": "e583d1a1-3686-44f8-9a9b-6c940f1ee6a0", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700072503, "uuid": "7fbe0bc7-637d-4dc7-845a-b629c5eeb9f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072503, "uuid": "2c9d286c-b8da-4a7b-86bd-09e86c6fcf66", "value": "plHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56ee674-839d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700042387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042387, "uuid": "7e931613-ab1b-4251-abc7-a6c2625e8f6b", "comment": "Malware payload", "value": "1df8dbdfc9218ac5ff851255e0385e77", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042387, "uuid": "5e1ccd5e-1b6f-48c7-a71c-8e4b217354b8", "comment": "Malware payload", "value": "035243c99d29f9f785e7f76ac3e744c56c7386449ad51b1d7cce9c19380a487c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042387, "uuid": "70e7dc45-e155-4500-9333-5a47d43a728c", "comment": "Malware payload", "value": "890fee85ef162ddb8c23c919b726ee8a8e992891", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042387, "uuid": "642b3732-49ab-463e-a267-6a86da36cf15", "comment": "Malware payload", "value": "faf14e4a2b75a73c00a4ef0d9a575fda514b1a68cd65ba7c00b2db06f3ac973deb23f4c980521aaf859f0f1e12cedae4", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042387, "uuid": "a7226d30-b93d-4913-968a-3ef108bb3227", "value": "T16F04AF11759181BBDB9E223854FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042387, "uuid": "8d373ddb-5edf-49b9-852a-7207c897807d", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042387, "uuid": "9f1d644c-363b-478d-8164-ae74f56e1b1e", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlL0bVaKoXAxOPYe:I74elpowsxizqyStZlpel5wyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700042387, "uuid": "99179a4a-53c6-4159-a81a-2fc6e3135096", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700042387, "uuid": "1e24ef3a-f2b1-43d3-8320-2e0a690b571c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042387, "uuid": "2786ad43-be58-43e6-93ce-fed3457f1571", "value": "WCUtil_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9145a139-83d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700064660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700064660, "uuid": "ad979321-e1e2-4264-bc2c-11f63384dc8f", "comment": "Malware payload", "value": "ff28a5db6dd5a5a41fb628f1e64c6cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700064660, "uuid": "0c134fae-5701-4ad2-b923-8a0f616656af", "comment": "Malware payload", "value": "03c4bbba0969018b4e4e048b8f3c52ce0d99a3e37da9ed11a18997e8a836f28f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700064660, "uuid": "f498f424-9121-48df-a9bf-315f1d09c1cf", "comment": "Malware payload", "value": "108f237faea0728bc97174ddff475dfe789ee88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700064660, "uuid": "89daea2e-cc93-4c4b-8e76-635cd1f86b5c", "comment": "Malware payload", "value": "f0ca6f189f83fadad20f3fc7dd0d57cc97c66431247c20a27886bf7b29696459d150c147d3936f72654d20a84777dfcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700064660, "uuid": "e1c4c948-6e7f-409d-a739-a763729f4ba1", "value": "T15944392392E0BD55D926CA728E2FC6F8771DF9519E497B672228BF2F14B1072D273210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700064660, "uuid": "445ee699-60cd-470b-adc4-b5803e2d81b1", "value": "fb752e503b6d05b37aeae46cd3910859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700064660, "uuid": "19723d4e-6ac5-43e4-96ad-c39945a6ad38", "value": "3072:lN6RLi2HD+n0KYpiFu3Sek8EkhuLR2sVFCco9CR:HgLi2Hs0JpQns9EC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700064660, "uuid": "62ded3e9-a0a4-4be8-bd37-02c1a29e9caa", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700064660, "uuid": "49e143c2-77bb-49d4-b92f-f9b917fed275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700064660, "uuid": "502491ed-a480-481e-8d58-f1fb117feac5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c329cf2d-83b4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700052288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052288, "uuid": "fcd5db87-9d0f-4905-95cd-832997cf48cf", "comment": "Malware payload", "value": "cdc8937ed34f65af5b68afd00ab09c90", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052288, "uuid": "1d537bc9-bcc0-4c3c-a25d-30eacc451d03", "comment": "Malware payload", "value": "047c2fb47c8227863ce3f9e4fe5c1e8fee7e3172019d56a27734178bb20a718c", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052288, "uuid": "28f7e32e-d4e5-4282-bd40-01ea5d331df0", "comment": "Malware payload", "value": "ac5603cd97dbeff7ce0a6a5f126aa4450a74fdff", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052288, "uuid": "1d3b5940-4f6a-4f08-9a0b-17e434eb2fad", "comment": "Malware payload", "value": "ae68819592c572db5bebb6821a5e8faeebb7c38f9bec6a6179c56f0e4428d150b5df01734c8baee9ecdf3e03abbaada2", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052288, "uuid": "1c8d7e03-1f25-4113-83b3-06beae3580c5", "value": "T1B7C48E51BBAA84F1C659B6710E6AB3352D3289C54F16E6C33BD4CD2E18B31D1A06F39C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052288, "uuid": "a6a27fb6-e891-4d87-b21d-e6ae497365bf", "value": "f4784413719d0b1ddf50f2389f7dadcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052288, "uuid": "10ece23b-f4d1-4671-bdb4-df816be1f0ef", "value": "6144:v+EZZcrC6snWhyxC9TlZH1SShBzZ4NRhuvXOE6O75WRE8uLEX7NkUgcsm7:vEC6snWhyxg3hj75WRuEXeW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700052288, "uuid": "219b8f1a-63d3-43a8-8007-1a8c9b676e3e", "value": 564096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700052288, "uuid": "1726863a-199a-417d-85f5-349f5e5facd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052288, "uuid": "7cec6d5f-1010-4b7e-83e9-e7693359899a", "value": "Phoenix.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163158f2-8403-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700085928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700085928, "uuid": "a62ad83f-ce40-415a-9d61-97527956764d", "comment": "Malware payload", "value": "0b71ffddf43226d1dba49c564f343650", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700085928, "uuid": "81e8fafa-a7c8-4ce4-89e3-681805a70d54", "comment": "Malware payload", "value": "05baf0f739f1ea25f7656973a49f7a49d2d522b130d96ab1deaae5d1c7397700", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700085928, "uuid": "d1892687-08d8-4419-a9c9-81e1b3831e0f", "comment": "Malware payload", "value": "da1cb00fb0cb53981ba03f33ac136c754b82689b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700085928, "uuid": "2c74a7f5-e1e4-4bb5-9f18-da0233776701", "comment": "Malware payload", "value": "eba76e10de0c87b852fba2d8991e5035700812942613a26875839b15ae2b443abffa7f70c9219190ba5a1dae8617720d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700085928, "uuid": "ff88b7f9-0330-4c89-b67f-e68ce8a598df", "value": "T16D443960CAD6163D4E070BEEBF018541C4FD892D832681ADE69D077E622386CCB7FB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700085928, "uuid": "95e216c3-db26-49ee-86d1-4c718e97bfd5", "value": "6144:jb3IJnEsmvnATJiPP8ke0sgqBASDyWOswPBUamk:f3BnWUP8p05CNwPkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700085928, "uuid": "869d9c71-90be-440f-a378-0bede38b3e32", "value": 257561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700085928, "uuid": "01b23e71-663a-403e-b6ba-e56b78e93836", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700085928, "uuid": "30b6554a-990e-49c1-a8ee-fb34c2a57743", "value": "8400890302_9166971204\u00b7pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8c8330-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044739, "uuid": "1bbc4329-3a84-43ce-8f7e-cf39aab0a9d6", "comment": "Malware payload", "value": "22c32368121952f46dd769311c6893d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044739, "uuid": "b6da1bb0-95fc-4c45-8b29-c18971564d99", "comment": "Malware payload", "value": "0808202fc3bd5e570b2106a4f991de5beeee739960b1167a590da92727b813a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044739, "uuid": "50e04d29-33c4-415f-969b-3176a5d75ee9", "comment": "Malware payload", "value": "7eae3e7835178d323a9664bd75bda24b0d971be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044739, "uuid": "b2531cc0-3ce7-480e-a1d7-3d90ca77c986", "comment": "Malware payload", "value": "7ec93d979bc8032eedc254579245c89c4230af4e8bab2b5289d23722b94671622b62bf202f8631bc9d49f58099f7c89d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044739, "uuid": "e572eb6e-dc53-4c3a-aa61-153d39f6b4c7", "value": "T18EE39CC7B54A88B2C58D5BF6C4BB51021778D78EF2D7C38A789F532709033EA9A4590B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044739, "uuid": "ac006cae-5d07-458a-ab40-02a3528e9f59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044739, "uuid": "e10ce45c-d342-425d-acd4-d3e65f3872c0", "value": "3072:D/D3tB9jR+NDCOSp3CvdHOcJn+UAQBRKQ:LD3tB9ySpwlrJiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044739, "uuid": "de9acae0-2ba8-404c-bccf-beb931523593", "value": 144728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044739, "uuid": "8e9e5146-18f1-4cec-8bd7-105d24b12b43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044739, "uuid": "4c0c5952-ef95-46f5-b8a4-c22816d698e8", "value": "74.119.193.203 itselfprocess.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f385f48b-8370-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700023164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023164, "uuid": "056292ce-9c7e-4898-9234-62c7c1dc7745", "comment": "Malware payload", "value": "f8bfe07fe5e8fc97d1ef193b0ad0ec12", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023164, "uuid": "ff6b852e-1dbc-47b8-96fa-cfc89064a738", "comment": "Malware payload", "value": "080c2b0ebcaa675f7cc3087a62b458bd05829a5056b93b478b0c137140e613ed", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023164, "uuid": "f8b13bf4-54bf-4978-b632-c1357a215aa1", "comment": "Malware payload", "value": "239e81d53340594765700cc91b13948362647fae", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023164, "uuid": "f6c31410-e620-4a67-8765-ecfc6db8f69f", "comment": "Malware payload", "value": "496d415385e7ab7d13a819dc02734f195acfbcda6e6263a7fe58d9d588cd39065e855ef031d8007ecf73a93aa7ccafed", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023164, "uuid": "0cff0844-e7d0-4755-8ee4-6beae4b86154", "value": "T1BF04AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023164, "uuid": "c15447c3-4e10-4f3e-be95-387835d6c59a", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023164, "uuid": "b3833701-8384-40d2-8f64-fdced8751cbb", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLbbVaKoXAxOPYe:I74elpowsxizqyStZlpel53yAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700023164, "uuid": "95110b3b-1af4-4407-a5d7-6d8d07b9997a", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700023164, "uuid": "42e0b249-27ee-4248-b565-cdb413e4fe8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023164, "uuid": "937c4348-f937-4235-8826-a29c0816e349", "value": "WCUtil_2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531643dc-83a2-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700044369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044369, "uuid": "5770afc7-3203-47d8-80ae-bda486b818e7", "comment": "Malware payload (Formbook)", "value": "e6f57bd3f809eb318c69da95463fae6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044369, "uuid": "5211bb37-f4ea-4535-bafb-e6abca807470", "comment": "Malware payload (Formbook)", "value": "0838dcd24cf228707272c365f4a9552e4d3b69b43716cea36fd95f250f62a7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044369, "uuid": "26dc3c81-9990-49b6-93d6-5f67478e9f2d", "comment": "Malware payload (Formbook)", "value": "a616fadb71174341edde0a37fc6ef4f5eaf5bfa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044369, "uuid": "b325baa5-2f1f-4f31-8099-77319a5ee3aa", "comment": "Malware payload (Formbook)", "value": "6fdbef35ce2486bd40e94ead0d8db78088ad6d160c35de4f41565b728f00714b7b39ff7761f8b7b0fb7867b2993f7ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044369, "uuid": "e070dc76-8c6f-4046-9ecb-10902692e27b", "value": "T1DCF402163368542AE17D06F8B4A261D157B1EE136462E39C1CD77B9E2FF3B8087027A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044369, "uuid": "9620badc-6f70-44b9-8adb-5d72ef3821e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044369, "uuid": "d93f2082-9948-4aba-9e09-59290ba3135b", "value": "12288:4SiLlfWqBVypg0Axp8BdNxqFHRPnVWfhDZJ4SWC1L/qEhAxH7wjx:EhO/pgnxuZExvYFZJRWC1WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044369, "uuid": "e82d55c2-3519-4035-82f7-117aa8a3f3e2", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044369, "uuid": "12f26c66-1432-43fb-ab11-84ee0609480b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044369, "uuid": "608c0741-5cb7-4702-b6a9-86bffa4ada8a", "value": "Bank receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a741164b-840e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700090896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090896, "uuid": "51df2761-504f-4b8f-8b17-554a4fae9111", "comment": "Malware payload", "value": "d581e3785a1bcc8685401980d0f33e78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090896, "uuid": "560ae0e5-1db2-4b27-b5e3-d445590fd77a", "comment": "Malware payload", "value": "08cb1432c512df0370577dc50549ad06f729858143017fe00f79fcb218872d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090896, "uuid": "418938c1-61db-445a-b1e7-2d4da1d995c7", "comment": "Malware payload", "value": "dbc2eba33cf9a0657b898ed67e453ed491d593c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090896, "uuid": "42ab71c8-458b-4a10-a960-0b9482613ad2", "comment": "Malware payload", "value": "15bb316dbdfc0935c0b7de98ff56055de530ced7a6742520cfc72c86a491c3de02f923f4586a6a5ffdd7e19addb93967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090896, "uuid": "b19f3356-b683-4f71-8392-3c10d765e108", "value": "T16D564ACBB85180F5C0AAD77185669753A6307C885F2227D76A10BFB83F32BD45EB6324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090896, "uuid": "d848313f-eca3-4c4a-ac77-f74e9c3805b0", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090896, "uuid": "82994a50-087a-4505-bb91-5d0a5ac193da", "value": "49152:TdimqtaNNrZrb/T6vO90d7HjmAFd4A64nsfJznfelWN+hWYlm6M/NG4JDhXKk990:iaJfelWnhZgkLE0TilGab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700090896, "uuid": "f23afea1-4f98-49f1-914c-b5071788b0f6", "value": 6005248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700090896, "uuid": "13eefc3b-f5da-4b48-8905-14d0f9eaf497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090896, "uuid": "c8f044d4-cca1-460d-b252-38cd8fe1151d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a323fd9-83fd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700083385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700083385, "uuid": "c715ccdd-1ba1-4bcb-bdd7-770e5fd4b2ca", "comment": "Malware payload", "value": "250768df55696d183a5be860c7b9e8df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700083385, "uuid": "25bc0972-cea2-499b-97bd-814af14a2ef4", "comment": "Malware payload", "value": "0985988c4ec01ce89ab73cd68d1e4d3944c8eafc4b5a69d0cd451487e97ff6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700083385, "uuid": "c4d48fdd-833f-4788-9906-5419f715e57a", "comment": "Malware payload", "value": "b41eca650f246ef655b4ff28d0960977543c7381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700083385, "uuid": "7d9a7292-140c-4bc2-9cee-1798dbc8e7b7", "comment": "Malware payload", "value": "a154dd5a1019aa7b89ce891041852acacec846290e8cfff22444ea81717b3992fa0f95d33d32049858d2ab3475e2ba46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700083385, "uuid": "62da6a90-e6ac-4cfd-8a45-e01f7da91cf1", "value": "T1E5057B84EA944266ED4E9731B436C9304776BDAEA53AE21D2DCC3CA73FB735304015AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700083385, "uuid": "4d17be92-f4a2-4097-9d56-7b3c8d822c61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700083385, "uuid": "64dbefd6-4311-4ed5-8dd3-90ee6b5e9066", "value": "12288:C6K9k7CX9H6rM0pMq+dSwnpZs47YGg/4Pwuomn9QqLb7r9r/+ppppppppppppppK:JKCml6r/Sq2Swnpq4U3/Xu7nBLh00z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700083385, "uuid": "40da2f88-14bc-4488-bab2-9f60bd6f26d2", "value": 857672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700083385, "uuid": "bf99d2aa-50fa-4542-978f-348138f280af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700083385, "uuid": "9c0e3dff-9f45-41d3-8597-1a4bf1c2bac0", "value": "SecuriteInfo.com.Win32.RATX-gen.18266.16009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2650f88e-835d-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700014659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014659, "uuid": "0157e9fe-83bc-403b-b88f-502e0080a011", "comment": "Malware payload (Loki)", "value": "6290e8c6864aba9ef50803c9438c3276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014659, "uuid": "0f98398c-5bbc-43ce-854c-70097f47812d", "comment": "Malware payload (Loki)", "value": "0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014659, "uuid": "17832cfd-973f-440c-8449-b39d198e6e75", "comment": "Malware payload (Loki)", "value": "078739cb7a123491a2d32704af94a06a203a0bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014659, "uuid": "50403712-2821-4a15-919f-cf6a05433cbb", "comment": "Malware payload (Loki)", "value": "6e3738d1990d4415701887773805c8ce763c175bdabc4c550edd1edc10be3d3e64506544f9e9599412a3a63583034617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014659, "uuid": "0d60f9c9-3f63-4d72-ae0e-5902d55863a8", "value": "T165A41221516C4BF0DCAAB7F6352761440377811EA222C75BCF82A5EE2BB3B41452DBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014659, "uuid": "c266a1f6-159d-4d83-baaf-02f848791bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014659, "uuid": "aa0dbb40-58e2-4372-ac22-fa0c2594ebb6", "value": "12288:/m2iN8JJISlQPFup7ZpOdZO0XBnLrESkvUJGbJflnNOD:/m1uJOkBp7ZYjO0BLrFkpbJfln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700014659, "uuid": "d2248cbe-9a77-47e6-8b64-0a87a6bf4896", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700014659, "uuid": "6062c3fe-a416-497d-9cb0-efda6bc408c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014659, "uuid": "3a650e51-e56a-46af-9483-dc039dfb78e2", "value": "wkCJ2z5pJkZ1aY8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ba8602-83ae-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1700049469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700049469, "uuid": "492c1d64-fb56-44b4-b403-ca5d89a83bd1", "comment": "Malware payload (DarkGate)", "value": "1f70fb6ce081900dbf96b51204bd1ea3", "object_relation": "md5", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700049469, "uuid": "fc6129d1-21c4-400c-8a93-dc9b503f5fac", "comment": "Malware payload (DarkGate)", "value": "0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f", "object_relation": "sha256", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700049469, "uuid": "27b62515-6f2b-4293-a072-a1fac4e0e12b", "comment": "Malware payload (DarkGate)", "value": "56adfe7fe3715265f22e770cc3e555ef2f9f9c4d", "object_relation": "sha1", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700049469, "uuid": "b516e144-9ec2-44f6-88f3-c2fda3e2c509", "comment": "Malware payload (DarkGate)", "value": "5554408006fc756e392b55cc1359934f5ce675bdfccbe65eb279ee03ce32471ed15980aa0115f4ea0b3edd14c5b97fa8", "object_relation": "sha3-384", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700049469, "uuid": "7f542e2c-4c59-48a2-ab29-b290c1a37a5e", "value": "T12B6301A91F45ACD28BE8B0CC165A1E6A5CB48A5FDB706DBD0EB047E38BDC1174F83106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700049469, "uuid": "c7279c3c-c8ce-40ea-baff-c63f91179668", "value": "1536:P2LY/m7c+C2BWCrb1ckCms/Pw2qFUlNtOmascDhuHzRgbj9u5:OLYe7rfrb1cZmcPDvLascDhAOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700049469, "uuid": "c6a75951-5ea1-43c2-b1ae-2f6fcdc6b184", "value": 68964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700049469, "uuid": "612c5dcb-f660-4372-adde-7fbbb86a5812", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700049469, "uuid": "1359e476-d3a1-43b4-8a33-f8f74da299e0", "value": "WTUW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8483876a-8376-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700025554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025554, "uuid": "bdec1560-8ddd-413c-a95c-7f260a6d6bb7", "comment": "Malware payload (Mirai)", "value": "9b7b516e7b11aac42d810b0e8c0b5106", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025554, "uuid": "f5dce03d-8e27-4dac-bbd1-cea9ca784ad5", "comment": "Malware payload (Mirai)", "value": "0e9ec7fffe192bb53a79d9a71ba74884bc9493cc55c6e363e7ad952c53da25fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025554, "uuid": "29204489-af39-482c-b8a6-ef77c6e7a0cf", "comment": "Malware payload (Mirai)", "value": "14e02d34ec96740fe9d88cf23612f2e28ebc79bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025554, "uuid": "c5769db6-5e46-4923-8de6-62b7afc4c1d7", "comment": "Malware payload (Mirai)", "value": "66c79767246a2c37cd49100f359f5baaa7decfc2253af9fe2c0e139d40dad97e4f416fe20fa209a63ab0c1a8f9b6d860", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025554, "uuid": "f629d05e-af68-4f47-9376-efa7153f3eb7", "value": "T15C6302CD227519E3C6E318BFB734686F78961C595A274309B02B9704FD5220FAC8BEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025554, "uuid": "0f0d568c-3493-4265-acda-8afe125cea8b", "value": "1536:yET5O6qYP4phZuBkiZeGFMRpyd66nAePn5C2I9iiGIV:yGqoiMmaeGHfn5hL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700025554, "uuid": "006c5915-4f6c-4a35-b7d9-dec813b6b9aa", "value": 70328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700025554, "uuid": "d6bb35b1-140a-4304-a7d6-f2ffa6690218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025554, "uuid": "f95fd067-e911-4aa9-90cf-77de3e2649cb", "value": "arm7.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed02810-83c4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700059153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059153, "uuid": "8b821630-05d7-456e-9ee5-12cd84690dca", "comment": "Malware payload (AgentTesla)", "value": "a3886ffd539120ead48a0663fa7619e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059153, "uuid": "a882bd01-04dd-46c3-ae10-d4fd77429796", "comment": "Malware payload (AgentTesla)", "value": "0f6154350e73fcd971f98f7bf3fd43773edd1cca24c16d259a4c755958970332", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059153, "uuid": "c948c27b-075d-433f-b8e4-3ded31357047", "comment": "Malware payload (AgentTesla)", "value": "0bc168dfc163cad9e7c13ad62d7bd47c2457c95e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059153, "uuid": "653f42bc-560d-4150-a1b8-000a95a7af2f", "comment": "Malware payload (AgentTesla)", "value": "6ede86fdd6659e845beece776c82c5a53f324d40412ff979ab92ea0ed4dfcfbc78164d8c95321032db774819e5aef37e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059153, "uuid": "40cb03a3-d18c-4f3c-bea5-bca325b6680a", "value": "T16D25AD80F56459A2DF5997B05B32CD3872A23DA9A830D57C1AD93DAB3BFBFB20011513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059153, "uuid": "2af2648c-cd09-4a88-ab14-eb6bf0354706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059153, "uuid": "17f74b7d-4a14-4904-bb47-1874f4ea0264", "value": "24576:KbzGm1Qk6mORbXFEjnYZRHtxYqShCVp9fi1q:Kbj1Qk6XXFigNtCqShCVpFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059153, "uuid": "ca8e26f4-7a41-4ebb-97fb-b5ca577dc7e7", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059153, "uuid": "f3c7db50-db45-4555-9fc7-62eee2d31015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059153, "uuid": "7f4bb23b-4a10-4dab-a749-9376a2dd3f35", "value": "Bank slip rar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1e1a54-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700044817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044817, "uuid": "50c4808f-e763-4166-938d-a382f5681c85", "comment": "Malware payload (AgentTesla)", "value": "15cec6346d8f965efd9a28e2ef0a162a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044817, "uuid": "2f2f21c4-1fb0-424a-a5c8-3e0901f80b8e", "comment": "Malware payload (AgentTesla)", "value": "10f79a0bcff0aa1bd3c2ee942bb6894627ad897317413a354df70b50f4e0f56e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044817, "uuid": "4a7fd0bb-5d39-4cb9-8808-d049480653a3", "comment": "Malware payload (AgentTesla)", "value": "b13de5a2011320cecf37c7bc7963b5787199656d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044817, "uuid": "e79b9dc0-5297-497b-ac93-0819c33dc977", "comment": "Malware payload (AgentTesla)", "value": "e7781a91ef12cce354a3d67f22381abc9ea293352deed27e390405dcf4cf2602cc7ac56452c37df33cdb9e6e2a259011", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044817, "uuid": "c334fbc0-f4d6-4575-b7bf-da06a578cd25", "value": "T15E0501403AB5AE23CBA146F81B62219C77F47D1691A1DBF90FA270CE74F1F70460AA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044817, "uuid": "96d56251-0f9a-4bb3-abe7-a1b4fee604b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044817, "uuid": "abca01cb-3942-4266-8f93-652cf832787f", "value": "12288:tbHV1cYuPbcPyp2criEu3lxrFiJvh5zFojHfPbItActlnhx9WBy:5HEjQu2cu91xG4nbtcLNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044817, "uuid": "588dd978-619f-47c9-9524-31282f7ca806", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044817, "uuid": "8b96bdd0-5d1b-49bf-a1f6-028435efcaca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044817, "uuid": "ac0661c4-bf2e-4518-8c1c-46a949142ba9", "value": "SecuriteInfo.com.Win32.PWSX-gen.19646.32351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b544d26f-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700044963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044963, "uuid": "73b59f42-fa18-4659-ba23-32064824b94b", "comment": "Malware payload (Formbook)", "value": "7630a755b70921f9f22891035c3628e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044963, "uuid": "3a0b522d-4e85-4a11-9baf-d74224a1cfe1", "comment": "Malware payload (Formbook)", "value": "10f863afc82cd61fdc8a55bc67e2726401ac51c4e9647ddd19dbf1ea30df9e09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044963, "uuid": "5b7aa27d-5b58-4f37-917b-2440bf90c2a1", "comment": "Malware payload (Formbook)", "value": "6682d6dfd06b80e5968eb424c013505bbae66e8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044963, "uuid": "d332a093-36ee-4de5-a48f-d9469348adde", "comment": "Malware payload (Formbook)", "value": "bdb45204c48be59b2fb7f1ff0f2553b198de7525e86b42a8ca3265b43878465c0a155e70eb0112a94b65432330b83373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044963, "uuid": "c92fb860-ced4-4080-95a8-f4e179653ea6", "value": "T1C534138EE21A578DC0A2D6B23DFF35C0DD15E6DC4FC587D683609CA4763A4989B12E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044963, "uuid": "3b8780df-4ae3-4709-ae4f-fb017c6ad8e3", "value": "6144:ReoIZR781uLl43/1Mg2p7F1bhUlCMSrSJ6Igy9WaukV3Y709:RkvJ4nspglx3J6tykNk2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044963, "uuid": "d609c0c7-9757-4c3c-bd2e-5ec17842fe2e", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044963, "uuid": "ae297241-2764-41b6-ac44-f0a63d4e8243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044963, "uuid": "14a5ca2b-0dc0-4cfd-b8a0-0115970dd401", "value": "7630a755b70921f9f22891035c3628e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cab3f17-83e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700071390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700071390, "uuid": "c049b755-4ef7-49d0-908e-47f7a405f89c", "comment": "Malware payload", "value": "cbecbae02aeeeb013228f30c1d3129fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700071390, "uuid": "4dcc1f99-3d31-4b76-9aa1-3c99e38c50c2", "comment": "Malware payload", "value": "12e7cbc39bce880ee356a8946fe22b8dfe01a8a21b90c0291ec774d5bc640f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700071390, "uuid": "c2cc14a0-bf70-4d9b-b74d-e82761e477d0", "comment": "Malware payload", "value": "426c54711b5938e425bfcfb32cb9fc293669712d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700071390, "uuid": "06aa78c2-3f94-40a7-a4b7-b577eb3401f5", "comment": "Malware payload", "value": "1ce7c06cec6e2423832b6f48a2fb741fd043b9f43572a2912cc343012fecda40bc743526d8eb638f1942ad48485ca3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700071390, "uuid": "12f9001f-2d2a-436d-af11-6ce5f17f92ae", "value": "T10364E11A67E421A2E4B5577144F202875E31BCB15B7982FF12E4EA7E0E237C0A572F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700071390, "uuid": "98d53bce-165c-49fb-9ce6-0cf246278765", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700071390, "uuid": "b5dca3f3-001d-4707-aa0d-95ad8e1e161a", "value": "6144:dahOvp0yN90QEZULxO6GAWBDbuaVYB5Q4NDX:diry90/SO6GAwfTV664NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700071390, "uuid": "a6d9018a-7d07-4861-8660-53774354633c", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700071390, "uuid": "35ed8d1e-5131-40fd-bf39-421942dbc8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700071390, "uuid": "16c8fbec-34ff-485b-90cf-bbfbcca7c784", "value": "12e7cbc39bce880ee356a8946fe22b8dfe01a8a21b90c0291ec774d5bc640f44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae69eb-840d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700090226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090226, "uuid": "d08bb158-73f0-4b12-9b02-3adeb79989fb", "comment": "Malware payload", "value": "6290b812abc18144dc99f31c272b6bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090226, "uuid": "057a57b5-9469-4a17-b7df-33546aab2ffb", "comment": "Malware payload", "value": "14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090226, "uuid": "293225b4-1183-4614-a576-6dbd1e5839c9", "comment": "Malware payload", "value": "b3ae930cb63dbe02f8e5271dd228a7206ab10f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090226, "uuid": "f6f319ab-3fc4-44ac-b48f-bb87e414d6b3", "comment": "Malware payload", "value": "c876f1d8deec74f37fbf12863e33152bd092e0186e2c494d8d7b24383e40e03e25a5d4f380d56bff30294aa95ad30000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090226, "uuid": "003ca1f8-f631-437d-8f78-0862980d84df", "value": "T1178439F23BB66DA2C943F7758B626854103215276D2B784CB8B30A352533798FA19C7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090226, "uuid": "0a0f91c1-98dd-44fe-9d04-61c308f7809b", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090226, "uuid": "6c4293d4-6f6d-43c9-8cd7-6eff9da08ff8", "value": "6144:2PrtbKYQ9NK1hrg7lBOhRT0/dolaDANelB01Sj/zOV57SC8ozkzkrLrwav:2hmY2yzeLOV5zts+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700090226, "uuid": "58a80568-2c2a-4283-b8dd-0c6825694efd", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700090226, "uuid": "8e976021-dafd-44be-8209-388f204cf552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090226, "uuid": "155e9caf-9523-4bc4-938e-cea87590a329", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35059e7-8398-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1700040343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040343, "uuid": "7e2cac7c-fddd-48e7-b3a9-a2a521db012f", "comment": "Malware payload (CoinMiner)", "value": "4b789d648bfbe3107177c8d751e5a2d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040343, "uuid": "d52711f4-c270-426a-827f-9fe5aea438ea", "comment": "Malware payload (CoinMiner)", "value": "151df3364d6d3ff361ed45ea944386ad8b45fc8327929447de5f7a86bc19547b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040343, "uuid": "8692c78a-c096-4dd7-a0c1-5d72684e6ad0", "comment": "Malware payload (CoinMiner)", "value": "f05e2591488fcf6f96ca5764b370ba8c8aacac12", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040343, "uuid": "73a822b3-c7cb-42b0-aae9-c98d319b39e1", "comment": "Malware payload (CoinMiner)", "value": "bc6fd8010b89d0f33e90378ecd0ea9ef0852beec5b2ea123180d9acf6cb1e8e6fbaa2460e2de845da6741e1fa32bf801", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040343, "uuid": "ef1cc4e8-7cd8-48b9-9c4e-ef5b1f6d2aff", "value": "T1C1A5337214C64BD43312E6A0427A3F16137954F6A68410F37EA935CACCBE66D99FCACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040343, "uuid": "76075c0a-ae91-40a9-8e02-08085311b8ae", "value": "49152:Mx9++SLT9KMxDI3mVU0d9Rm9Jv726ITf3ZbA+xweSof1WXHaCw:w9FG4MxDnUmm9V2JOkNv1m6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040343, "uuid": "026724ef-f791-4e08-95fb-49294252aa9a", "value": 2080020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040343, "uuid": "2c33f271-4c37-4516-88c4-7cdad52a6964", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040343, "uuid": "32eee058-2f8e-48ed-9ad4-6f5425c4ed73", "value": "151df3364d6d3ff361ed45ea944386ad8b45fc8327929447de5f7a86bc19547b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112acda8-834d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700007751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007751, "uuid": "b1aded1c-cd60-40b8-9fa6-399ded019b23", "comment": "Malware payload (RedLineStealer)", "value": "f33d9ec874ed523976ff7812bbe6f63e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007751, "uuid": "1af0d356-eb2f-4715-ab21-61e8a396410b", "comment": "Malware payload (RedLineStealer)", "value": "154977c01029dd441484b65ac21a15ecd7f6144d48eccc5b2ecb67a56bf7cd90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007751, "uuid": "03ca4c0b-6a61-43ef-93ce-661b376db31a", "comment": "Malware payload (RedLineStealer)", "value": "f78c00837f82ef370573467f557d687403181491", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007751, "uuid": "3a2ffbb2-20bf-40da-bfc5-63b7b3636a63", "comment": "Malware payload (RedLineStealer)", "value": "63dda79d8bf28a98bd0cba904b2b350b7e228fe0ea6eeead5238b621c1280f9b26b05a42753ab30450bc395c917134eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007751, "uuid": "79443aef-58a5-4195-ab93-4c06f50b4c5f", "value": "T14B9428E12BB66DA2C043F7758B62685450321D676E3A700938B35E743733798FA89C7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007751, "uuid": "d6d09ea1-f403-4fa9-84a7-4a9fa2b3c889", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007751, "uuid": "2f1b6dde-126f-4d55-a29e-079d9521d374", "value": "6144:1Ey+dopiGdwemgItByRT0/dolaDA0ShlsZUIb37ScD4Akr7rwa3:dooH4DSEZU+3tcA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700007751, "uuid": "5c523341-d77f-42e9-b0e7-7a791948e4ab", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700007751, "uuid": "27908e90-ca55-497d-9f41-ef40da884ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007751, "uuid": "d09dba40-c7d4-4655-aef4-bd30be370ca2", "value": "f33d9ec874ed523976ff7812bbe6f63e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a348a2f3-8354-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700011003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011003, "uuid": "886eb3e5-6806-4f17-b42e-8b3eea38e562", "comment": "Malware payload", "value": "1acabbdb64ff7b6f8e7568589741b473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011003, "uuid": "55adc043-3326-4014-9cef-435a02056944", "comment": "Malware payload", "value": "1809dddc2ed1656288e8932cf69022e58b688310423dcb7159fc73b38ee5abb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011003, "uuid": "1fbdf268-4aea-4e42-92ca-53d69fba077c", "comment": "Malware payload", "value": "b48cda2391690a3c9eb7c5914269e6e056e60d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011003, "uuid": "f2a148a6-93ea-4b5b-868e-672cec0b9520", "comment": "Malware payload", "value": "d2d7ba30643d3704626c4bf06a3c9f84e20da40cc0ab03d93d9aca9c40a28a929a1a7a755223a93ae08daa5dd8f38afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011003, "uuid": "45c2b064-6859-4932-b282-866c8d9699b1", "value": "T142945B037291D1B3C1116076B1ACC97D1BFAA6318F497CFF12D83DAB16A13BCC9A6592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011003, "uuid": "03b20f00-ba7b-4d9a-acac-5e4946e3c6e7", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011003, "uuid": "c8a4d3e4-9dab-4097-b939-8fa65d29634e", "value": "6144:j05gUwlREXKMmn/P3dAOoX+07DObv/IepCJCdyW2Qfpx11OjClk+U9:ygUKRE6TdVCSzjT9fptQClk+U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700011003, "uuid": "29510bdf-ae05-4c2f-a5bd-7a0fc42dbd74", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700011003, "uuid": "87d918dd-9c94-40cd-b1eb-c58fb09f5c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011003, "uuid": "1c73cf31-458b-432c-b3b8-f1510767942a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9767.23617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbad1668-8392-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700037673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037673, "uuid": "7b037c98-da98-4880-b0fd-c9bca65c801a", "comment": "Malware payload", "value": "71b07b8ebd95e547a239d818e7641812", "object_relation": "md5", "Tag": [ { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037673, "uuid": "7ab8aebb-5b7f-44df-9c11-f486b2e2da9f", "comment": "Malware payload", "value": "1847e53f0b2d743d51ee222f85372eb4dd452877635ed83f962d76c7293ebd74", "object_relation": "sha256", "Tag": [ { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037673, "uuid": "53a5b9c4-350d-4531-b5b9-3a5d2b4fbe5f", "comment": "Malware payload", "value": "911c5addf965a51b5908a868ac013a4ed8ba5376", "object_relation": "sha1", "Tag": [ { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037673, "uuid": "3fb32b54-f1b0-49e8-bf70-1aab3c827943", "comment": "Malware payload", "value": "4cc0bad75d93b43790cfbe7c4bc58f8db9040cc85e06fb88715795f374d42c24e3af36f3692ea627678165475ae8158c", "object_relation": "sha3-384", "Tag": [ { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700037673, "uuid": "61c2b6a1-96ec-4be4-abda-6e7c12d84c73", "value": "T1088302C46AAC8AD8C965BE03D7464748AFD0D1C6C5CA777A39727EE81214DE2DF0E843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700037673, "uuid": "f799378a-3a12-4e7a-bf18-a1dd762c5ec7", "value": "1536:/5lurqqIvncJzb/X4saEHD/7fSPRSxlvICxhjhApKnyp9o452tanHAOnDwaMY4:/rurq9vncJzbf4XEHHSpOlvISApKIo4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700037673, "uuid": "2de81bd6-e86f-424c-984c-ef977dceb1ce", "value": 84314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700037673, "uuid": "47b3ef8e-ce8d-4731-b5c7-eb8da83eed58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700037673, "uuid": "fa29dfeb-789a-4c43-b366-878aef358bf1", "value": "e2823241477a32fc9f36ff27a429f47b4a7ef1b1999a6e80db4d279b5b73231c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e822ba-83a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700045209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045209, "uuid": "de295978-f159-4327-b322-fa8900a34aaf", "comment": "Malware payload", "value": "29896242635721bdaaf872238ec80502", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045209, "uuid": "6d24f162-e9c5-4191-8a92-4ec74986223f", "comment": "Malware payload", "value": "18b86ecb14d481c1b030c8057fbfb3f5285d50957979ec048ded4221d05f499b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045209, "uuid": "ed514900-8856-46a5-a7c2-5864ddde218a", "comment": "Malware payload", "value": "f20b084cc26e84f969d67e02594f8f415cf16487", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045209, "uuid": "46bb8cd7-ebc0-46a0-aaa2-f7a9e04ce0e7", "comment": "Malware payload", "value": "01b514685e7f5795d6acab360e57e36292084efa9aef06afb33be8c7c0a6fa2a1e75d267650858ac8883c218fba01dc8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045209, "uuid": "f35fd9fd-c836-478e-ae1b-d7648ae8f28a", "value": "T119173396F31CA01FDE7798338FBA526211950D854683AF637915B22C5AF3A848F5EFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045209, "uuid": "8aff438d-f5cb-41a9-b525-199697cadcce", "value": "393216:bM2zxgE4nJwqYax8IEZCMr5gR4DFMh2RCSl+hwqBZ9UW+lh:FgEwJw2gIMe4H1l+nBZ2WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700045209, "uuid": "5875252b-ba02-411f-8a18-371f7cb3c906", "value": 18665424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700045209, "uuid": "2d5b68ef-3dc7-404a-abff-5a1ac4df82ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045209, "uuid": "dbf60480-d668-4c1f-8a2f-deba33c79335", "value": "com.glovie.plus.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f80e77-834a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700006744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700006744, "uuid": "8bc6120f-a467-4dd2-bd71-22887852f610", "comment": "Malware payload (Stealc)", "value": "6e5a15978c2d736e20136b161c457157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700006744, "uuid": "42d65ac6-12cf-467f-9c3a-8fb795d175e0", "comment": "Malware payload (Stealc)", "value": "18db81d906e97ea89314ddaa87811b43e349e08a2af276dcfe21f3031131e69f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700006744, "uuid": "f1ff09f2-f003-484f-b212-44d818a79c8c", "comment": "Malware payload (Stealc)", "value": "3a42fa5e61f90cf57e658ea8e15179537200ab3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700006744, "uuid": "4a3dbbd3-aa97-4dac-b508-79c2e33e6240", "comment": "Malware payload (Stealc)", "value": "cedbb82ea9c3bbe16d5c608600bf422251cb664eda5e54d85433350df921fb54cdeebef5289449799e964173dfe38454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700006744, "uuid": "f7589003-03c5-4104-a5dc-25851d7ecab2", "value": "T14A14BF2273F5C072F12745344AB2C6B56A37BCA25B72D9CF27C51A6E4E312C2CA79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700006744, "uuid": "4d206f90-2b98-494d-8cbd-cbe41afe6967", "value": "ef98bcf16f97cf526bada512d7dd8302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700006744, "uuid": "f2bf9808-3d59-4d2c-afe3-491bae9d1929", "value": "3072:J8h50DXv8jQh5BOTUrcWAVoG6+SeIf0gdkEWGlC+qRkS/nN53:a4Dhh50TCWo9epPG4Ze2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700006744, "uuid": "ada5a7a4-951c-474c-9a44-eaac21c60a91", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700006744, "uuid": "f34087ba-4581-4c28-abac-5fafa5592c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700006744, "uuid": "605ff2c2-0757-4beb-b79d-32ed2e79d926", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161c10f7-839a-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1700040831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040831, "uuid": "30338547-7753-4c62-8082-257400c0d45b", "comment": "Malware payload (CoinMiner)", "value": "a51ee5d812325ff8ee4a634bdd94ac49", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040831, "uuid": "ec65f33c-21e6-466f-8b39-3a33b7ade797", "comment": "Malware payload (CoinMiner)", "value": "199c01b177aa7c4bb01dae876012c696e4e30aada4cf1c7edf7936eee0d7876e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040831, "uuid": "e0f77223-6b9b-4ad7-9f42-79c989894121", "comment": "Malware payload (CoinMiner)", "value": "ad69476dce83cf8a665f921a81c4c9168e68398f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040831, "uuid": "50dba1de-0bb4-4c7d-a42a-d725949572e2", "comment": "Malware payload (CoinMiner)", "value": "b6d0f1fdc48a769abcab1adf4fe27038f6f8b07ce9a25ab9d1b37fbe44fdc29db098989c182104e182f54cf894d442bf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040831, "uuid": "fa2aa4da-418a-460d-900f-6fde455ffe62", "value": "T19075333DAA37EBC5A55B197B1D0A218100CB11196AEE4E7E31FE197CF110E1E39FB852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040831, "uuid": "49a7850f-445c-488a-b37d-6db781e14a16", "value": "24576:ZN4dPGCBNmf31l49JZnuCP85WkskkitgrmHKgzeZ6mCIc6hmtemhSOebMCpR:ZN4hhBNmjsJZOsksQtgrmqIg6Tew3AMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040831, "uuid": "18aecabc-2e27-4b72-9548-67d95ee24b36", "value": 1591996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040831, "uuid": "92cf70e0-15c0-4854-b74c-beb85982dde0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040831, "uuid": "429a30d9-a515-4488-84c5-c5912686d21b", "value": "199c01b177aa7c4bb01dae876012c696e4e30aada4cf1c7edf7936eee0d7876e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f89ff5-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044674, "uuid": "223012b7-9ecc-4a0a-b4f8-23d505c3d278", "comment": "Malware payload", "value": "98f05f2bc022a154560ceed76b78c40d", "object_relation": "md5", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044674, "uuid": "7088cd29-a28a-4432-bbcc-a5468012647d", "comment": "Malware payload", "value": "19b739c72921a6b24a4c9ae99f3371f2f25e4d6a7bab90c256a8c44e924f8e85", "object_relation": "sha256", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044674, "uuid": "59a534a7-c256-41c6-92e7-6fffb1834b10", "comment": "Malware payload", "value": "47ce38d825866eda49043c5eae2d5c1e66e85842", "object_relation": "sha1", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044674, "uuid": "cc0a181a-d7fc-4f2e-91ac-85a41b453ba7", "comment": "Malware payload", "value": "842503590e89b2121f97e88e9b2ab0b7db5475877b0c57943bbaf435736646af1ab8829719406bd505acffbe29b57ab3", "object_relation": "sha3-384", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044674, "uuid": "0dc75762-1df8-4bbe-bc09-52a0b1efbc2d", "value": "T1A666335A6B800DDE8FC4B2FE9B1BDB552E0352458F36215C3AF598F0AAED3983D56C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044674, "uuid": "ac378e5d-828b-4faa-a950-ac10e0b07677", "value": "98304:V+HylBn5UqKj5xCqCeIntFlyz6pglPNTdhrFABwSa9hMWRahb3bhvvkbJzY/h3a:V+sicJeItFldgNFAK9rREb31HGJzY53a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044674, "uuid": "4bb2b439-bed7-43a2-9b90-8c3b27e856be", "value": 6576564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044674, "uuid": "8e7874be-a004-4c8f-afd8-42a07213eca1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044674, "uuid": "b538a7c2-2544-449c-9933-4beaeefaf842", "value": "continuedeveloperpro.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2685fb-83c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058422, "uuid": "603b2c69-76f7-45f5-a401-b85c8c4dd641", "comment": "Malware payload", "value": "3c89cce332d5a44e03483d774c9a9fc7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058422, "uuid": "3adaebd0-9bac-4976-9148-3affa3bacfbe", "comment": "Malware payload", "value": "1c5682f07fcc6d16f137dc06f714388e040eb5a3209152bfff09563b545ff4ee", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058422, "uuid": "be221d23-f1c3-41b2-916d-1fc60cf227a7", "comment": "Malware payload", "value": "1b74a5424bc3a0f411d984b6f2b6cbbdc196c67d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058422, "uuid": "8aab4a39-2b16-45b8-bfdb-a5b5f2154778", "comment": "Malware payload", "value": "50f7ec41512721fb8fcd2c2ab243e1b99c992c9cd45b6afd650845efe059df830500cad728e142bb97821080024e4f70", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058422, "uuid": "fc1e356d-c6cd-496a-8234-484cc0d0e393", "value": "T183B4AF0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058422, "uuid": "8adf2451-0d6a-49de-86bf-761b80054e20", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058422, "uuid": "6f351e39-66f9-4273-b284-ec5f57118319", "value": "6144:rexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7bpUlLaEx:reZeWSpda70ADIgSoxgUW/zFun7OxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058422, "uuid": "70fdfa27-755e-4617-8210-8b95120bac39", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058422, "uuid": "24dca84d-2473-4a25-afd1-03b6500d52ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058422, "uuid": "e48180d6-b257-4084-9f18-5d137055a557", "value": "Installpluginv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bed8d0f-8387-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700032841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032841, "uuid": "706ae328-e5ab-40bd-bc74-ccae3a88b70e", "comment": "Malware payload", "value": "ceb7d26b446857d4bf63b9d2f5d26758", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032841, "uuid": "4d7bbd0a-8de5-4305-82aa-d06b64baa755", "comment": "Malware payload", "value": "1f0dd88879a0facb7ad1cec668a9c65bcf06ac1d69945989770f04740e1117a7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032841, "uuid": "81225ebc-41fe-46f4-af3b-1ec38db0a178", "comment": "Malware payload", "value": "e5740538e67f1984f2dc63956ca8569b6bc42789", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032841, "uuid": "1091a901-a555-45b1-9180-0b47770f764a", "comment": "Malware payload", "value": "7a14c8d8ff32c52f170da1685c091c57ea6f88b9379309be2a2c32c31d311ac249bfc0394c1eb01c55feda72e7df98fc", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032841, "uuid": "03e73261-b596-420c-82c1-699fd4d282a7", "value": "T19A04AF11759181BBDB9E223454FE6F3AABBDA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032841, "uuid": "895194dd-e234-40b4-84ec-0e928f4f9a66", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032841, "uuid": "9d7e0aa2-4133-4ba5-96a8-ab9ab110f74f", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLhbVaKoXAxOPYe:I74elpowsxizqyStZlpel5tyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700032841, "uuid": "7982237e-c7ca-4986-9aa0-a120e2d41968", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700032841, "uuid": "29dd09d2-3c64-4b4f-a74e-c42990bd3444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032841, "uuid": "14a3d767-5652-497f-a144-85a9040c746b", "value": "WCUtil_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3b0abc-8365-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700018182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018182, "uuid": "e3f2ba5e-0b44-4f29-9ec7-77c86fea2906", "comment": "Malware payload (AgentTesla)", "value": "78300c0411583559ba0f96be3a78e09c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018182, "uuid": "6cdcbcf0-a9b5-4304-8440-9c8a3fd5f65f", "comment": "Malware payload (AgentTesla)", "value": "22e6002a6d91fa1b1776f6b2e1cea01312a95ba504643bead0deaa0b90e193eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018182, "uuid": "9543fa91-fe66-4567-81b9-2ae510fe9861", "comment": "Malware payload (AgentTesla)", "value": "de10133176c262d4f9a4c16f0c94932e45e93bf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018182, "uuid": "600c6783-3843-47ba-b404-8643aa4ddd82", "comment": "Malware payload (AgentTesla)", "value": "1fa7982e2770c4731298c0e20cc929575a2300cf94d452d21e7377e43b5346be72a9faf86cc355e775aa86278b10cb42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018182, "uuid": "dfd6d5be-f3d1-49e9-af0d-9c67da993350", "value": "T1EAF4F8BF7B8C113384B9D697C3A3E066F27BC8A7723A5E2524D3DA910687A0774C521D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018182, "uuid": "92224f69-786d-483c-b523-7f9ebcdf2285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018182, "uuid": "29ee75bd-faca-4332-bf58-1a91476dced1", "value": "6144:DStvZ/Nt1sYTOakE5OKPiQSWBs24Hqnmk/syCO+b+mQHJj/MLpKqJPeCG4wN/qRo:W7ldj5iQSI/4Knu32WtK9WwJu9JE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700018182, "uuid": "5b7e11fb-91e6-4d23-84b6-1319d02c94f2", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700018182, "uuid": "8b2dcdc0-6d4a-4c92-9363-1ea345ca2707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018182, "uuid": "08a841e4-3c61-469c-8cb4-61e37e164635", "value": "SecuriteInfo.com.Win32.RATX-gen.10863.32284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7560bbd5-83b4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700052158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052158, "uuid": "e2988ffe-291c-490d-8c1c-3c27a23bf234", "comment": "Malware payload", "value": "37e03565553f6bf193e860b981d36b7b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052158, "uuid": "d7213b77-90d4-40f2-b0e5-b08a330ff780", "comment": "Malware payload", "value": "233f985caa469952abfc3c60a10228dd6e0e25614778fe99bb8ecb74b6c1e265", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052158, "uuid": "3ff8b907-7d36-4a98-b78d-f790bf206d5b", "comment": "Malware payload", "value": "dd08a73cfee4c87a46fea6c1ab2f995126e76701", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052158, "uuid": "42bb27d5-bd81-4fa7-8c35-6122d071e0a1", "comment": "Malware payload", "value": "00201168e3922352bb6d1820a5a7502d486a81e09a64dc4386948968127d36bb399e9e14de7e5f82749ca2df2ec9e2d5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052158, "uuid": "5617046c-98dc-47ac-b0a1-9eea31e18edc", "value": "T1A4B173CC72E2F06647B771B5103FA10BF13A4569381D8450A269E4F9BCB0A6E8177E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052158, "uuid": "cdfae473-c51e-4766-a7f4-3aec7fd0282a", "value": "96:/BrfYW54nW0IUEbTAaYW2ikbzjzQweXTxLASymB8wMqjX:/BrT539wvbPzZeDpl8wME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700052158, "uuid": "ab000d91-cb22-4649-9de5-6c5a77fb846d", "value": 5543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700052158, "uuid": "70e12824-a68f-443e-a84e-9f22e3f656a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052158, "uuid": "84107e18-8c33-43ac-b531-b88720ad9401", "value": "NEAS.jquery-3.3.1.min.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae26044-8365-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700018183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018183, "uuid": "f0969f34-3aa7-4cdf-8cfe-aa1c1c33484e", "comment": "Malware payload", "value": "20c52a24d9e665f29eeeda191a8e47ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018183, "uuid": "228aad49-5594-4e1d-b922-3e188f6f9c7f", "comment": "Malware payload", "value": "235f5430842be63a9bca58fb148480b6d6a1f0a0631ace17e78bf8430c5f98e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018183, "uuid": "e3f0a0ff-4774-4d0c-bf51-29856e5609f1", "comment": "Malware payload", "value": "794c6e0516433a5caae0de868a9db54743b09525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018183, "uuid": "d8115669-e2f2-4846-bf93-b832aa787e16", "comment": "Malware payload", "value": "c85524ae5baab5fd1724825dcdb16214cf7446d18d9dafaf888d26d4c3bbb9a65a27565ba565938345bea2530ebae522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018183, "uuid": "89a59f77-7d57-48cd-98ec-da88e8f3a17c", "value": "T1A4146B0075808031E4B302B78EFE9A39A67DBD610B6569D7B7C84F0E4B75AE17B31762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018183, "uuid": "e8225705-a1e1-4e1d-b4e5-cb8d07b61c5e", "value": "8bafd71683d27c4e3c4ba0d0ddd1e237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018183, "uuid": "b27429bc-54fb-4063-8d83-29ad2c219fad", "value": "3072:cg3lQcYDAB88t1/4YZG9N/VNWIclco+Hm9/4jXA++9HCMVZnG:cJLUB88v4YYVNiIHYgXAMEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700018183, "uuid": "144dbdd3-d78b-4bb1-bc66-8a51265d10ad", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700018183, "uuid": "68fb4776-2669-49ca-8eae-d522ff0bbef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018183, "uuid": "de4160fb-22f7-469d-ba22-e354563e5f6a", "value": "SecuriteInfo.com.Win32.MalwareX-gen.22606.12305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5b1350-83ea-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700075366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700075366, "uuid": "93fe75f8-482f-428f-a959-828e60e7dbb5", "comment": "Malware payload", "value": "f8908d7cd258ac0957dc03bff17694b9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700075366, "uuid": "547aaba2-0afb-4bf7-822a-fa7452eab902", "comment": "Malware payload", "value": "23c1510d3d22c30ed9ef184edf9f2e078906915b5e37e67b023230b8cd60403f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700075366, "uuid": "26890343-cb2f-4f0f-8680-7fc9205ea860", "comment": "Malware payload", "value": "4364cc1bb8e89f82da7b0ed8ff12459822d60223", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700075366, "uuid": "4d127724-7ab5-4e56-81d8-21a69ec88b4c", "comment": "Malware payload", "value": "d0359917b5f1cc8c037756da971c0e7c96cf22267f14138d640a7b6b4f1e13e6cecb3c0622b8818751227076340a75bd", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700075366, "uuid": "1ccfa7fc-c2f2-4ec3-a757-c747cfd3f5ad", "value": "T1A3A5334DCA2EA3A49EE3E5EE565F14C74E78ADC7100B04CF3137D9E09C29AFA2B11558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700075366, "uuid": "2c874c89-f3f9-412f-8b01-e99397e9cc8a", "value": "49152:oxBi7n1D75XS0sbZZKZCho6USo3pJtIkMPM/qIaZiIKdlPaA:ki7n15i0sbZ1o3dIkMPM/qFZilZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700075366, "uuid": "5cd1c7f6-6665-471b-b699-1e5825af4336", "value": 2234634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700075366, "uuid": "6e1d46c7-91bf-4f02-9ff9-21b1e90692c9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700075366, "uuid": "fe0d9a22-751d-4373-8c3e-f7cf269186d9", "value": "winrar-x64.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420c1147-839f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700043052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043052, "uuid": "88655450-f24c-41ad-bb70-c812099ba449", "comment": "Malware payload", "value": "0526d0ee958e37ba2cdab8a216ac75d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043052, "uuid": "ffff788f-e395-4ef5-b2e2-e80d5f69a138", "comment": "Malware payload", "value": "24c0f541525bb734bd6ee6ce4328b752fba618092cbad8131e7418341da99134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043052, "uuid": "59257484-e040-4a30-a3e3-1779a5ffb97a", "comment": "Malware payload", "value": "19378380af8cc7ba2e2110dd318327fae7c8e99d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043052, "uuid": "508fb813-4b2d-48dd-8c33-fa01d91316f6", "comment": "Malware payload", "value": "b073892cbd6e313e7c26639431c67d413fe862368b7487ea534c51126a5b64773d135f9ca05c4802164daa180c8f83cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043052, "uuid": "2910ebc2-586e-4656-bca2-9b301f396790", "value": "T177F733317386C52BC07606B0296CD7BA51297FA15B7580C793E4AE6F78B18C35B31EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043052, "uuid": "cd3c7685-8f72-4cbf-917d-076e6f0e6e91", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043052, "uuid": "7b5a7d45-d088-45f8-97c2-b63e5c7659ac", "value": "1572864:O8lqhpZDukekSjofjyjsUSnSTt2mjN6LIFTtAmriZnc:blqzpAkSjobmsUQC0mjN6Qbsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700043052, "uuid": "01441761-9f56-49eb-aa87-62757017d668", "value": 70832504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700043052, "uuid": "b316668d-e794-4804-b92a-73bb44042be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043052, "uuid": "8c6a6fb7-94d2-4d76-9e78-e878a7b805d5", "value": "Armored Core VI T\u00fcrk\u00e7e Yama Kurulum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2826ec-838c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700034910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034910, "uuid": "54e2cf0a-b157-47f2-b7d9-45c26ba19925", "comment": "Malware payload (AgentTesla)", "value": "45f385fe92fabe33d538da60b9a44861", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034910, "uuid": "96f49a57-6f19-4cdc-9649-101334429c90", "comment": "Malware payload (AgentTesla)", "value": "259e6fc89c741d8f3a240402ffb767e833317bea4e190ba44e516adf63cd5b82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034910, "uuid": "78dfac05-26da-43b4-a6b4-9fe41f22daf4", "comment": "Malware payload (AgentTesla)", "value": "a90609fa5662dc3b8ea223f159faeba92407da81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034910, "uuid": "13b16b9d-e751-4f47-93f4-915af4e75175", "comment": "Malware payload (AgentTesla)", "value": "f65b7c781f0eb4f8ae9a294d6116cc52b4d96f3dd54c41914ffda236f085883a3557c11c3963a89a319ded4a0b11f9f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034910, "uuid": "9af5516a-eecc-4efa-9f8b-db94c2b8b274", "value": "T11DE4E09C765071EFC817DD76DAA82C24EA21647B531BD203A05326EDDA0EACBCF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034910, "uuid": "3cac8ea4-1d00-4dae-aace-3febcc3fc274", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034910, "uuid": "81b1ea4c-08f1-4ce2-8b55-ff8f7d590903", "value": "12288:mCrSXtAihbVj4uAeZ0moWvlE1qnagEuPbaDe07v5d4XLuRONEAZMBp7Qgu5okDXN:dQtNbjQg0R1QEuPbS9dkLu8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700034910, "uuid": "14e337a8-23f9-434b-aa1a-40fcbf0281ec", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700034910, "uuid": "336168df-cd05-433b-9ed2-ff5d4d648c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034910, "uuid": "c0836161-d44f-4666-8504-3f468a39ac06", "value": "SOA PAYMENT OCTOBER 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecd2654-836f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700022458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022458, "uuid": "2003c004-6007-4f79-ab70-01564ee87a44", "comment": "Malware payload", "value": "e65f95b666e0d52937953f1950f889b0", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022458, "uuid": "66432ef5-f453-43ba-af78-7b9a2e96a87c", "comment": "Malware payload", "value": "28dc1b057af09d247f9bdede84202dd18aa81b30a6583a152a101d1b2d91f26b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022458, "uuid": "2fea8d32-c8af-4e4b-9197-2e66ce49974e", "comment": "Malware payload", "value": "2c08e22ceb52155aafad2fefde6ae6a3f2ff4b00", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022458, "uuid": "9c4d7e87-2264-4d2a-8701-3a65161d7138", "comment": "Malware payload", "value": "56789aa669b278da4733ea2e1a0f6ebac95e5a36cc4dabc111d71fac15a47d594f0d97ffc51248138e6bcee7ccf7ae19", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022458, "uuid": "797a0566-5ed4-4a43-ba09-8b2e976c93c8", "value": "T1DFB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022458, "uuid": "3cf94b91-4f2c-4fb0-9b1c-5e0d9228f009", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022458, "uuid": "ea4ffcd7-c953-4a1a-8df1-e15ae960149e", "value": "6144:UexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7ipUlLaEx:UeZeWSpda70ADIgSoxgUW/zFun7O+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700022458, "uuid": "3f3346c5-8bec-411f-a089-2c3d02d273fa", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700022458, "uuid": "570e371b-0f2b-4e07-a6d4-1e55ab507cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022458, "uuid": "b06c7efa-6e2d-46e9-9685-b90d20f3168b", "value": "progetto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6d351a-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044816, "uuid": "af582120-270c-40d4-aa3f-78e263a4bc49", "comment": "Malware payload", "value": "36f89ce76d6f80c48689ff1531a90929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044816, "uuid": "f9accfce-6a6d-4058-8fbd-6b186b650f41", "comment": "Malware payload", "value": "296a2dbc2d3de1c05763952fb82b7cdd2d5f6deccad03c9617da144761993413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044816, "uuid": "b0267ae3-7be1-498b-b328-8ba8512824a1", "comment": "Malware payload", "value": "bd616eae6ad2ede72301219c3fb292ab1c238f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044816, "uuid": "ecc746b8-c22a-4219-ae76-4873844f53cf", "comment": "Malware payload", "value": "db6af84b53d15f84d51ce9d347847a3464358a307e29b9c18818ab365c861a5d4bcfd4cc43bfae8c694b6f0bde21ec7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044816, "uuid": "b4698097-c51e-4ba9-8892-03dad7392ddd", "value": "T16DE5BF51F3F66369D5DA8E328DA1F6F4317224177E32E299CC18E760786C3D38AC449A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044816, "uuid": "e2511b0e-379e-4838-8ded-1d1147933c43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044816, "uuid": "cee74f28-f50f-4d1e-8535-943de049d48b", "value": "49152:qQAmhsb2dKDfpIR5xgIMznelC1EOPcwfKQd3bwDSxuUrbEFr:qQAmhsb2dJg3tJKQd3Txuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044816, "uuid": "171c23bb-a40c-46aa-aa52-611262cc462b", "value": 3181568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044816, "uuid": "f93fe57d-ebc0-4dd1-8973-524143168718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044816, "uuid": "20fe7afa-b291-4b7b-9bd0-bb5fb01e43a1", "value": "SecuriteInfo.com.Win32.TrojanX-gen.24405.26677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa99dfff-839d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700042503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042503, "uuid": "cf5ff6e6-0029-4890-b2df-b85283c9bf1a", "comment": "Malware payload", "value": "8988de2646239e3d882f8679bc377324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042503, "uuid": "730d46e3-42a2-4869-b500-f2098bfb0b6e", "comment": "Malware payload", "value": "29c63521ac9ec647a95c3330a23aced7ce53f1101c23a71f2d30350bfcaa7b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042503, "uuid": "73709b71-c832-499d-9374-4d93a6216779", "comment": "Malware payload", "value": "bae9dbafb2204a1dcf17d8a38c385c0943d5a4bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042503, "uuid": "38ee760d-f9a2-4e16-8b91-4b0c53959833", "comment": "Malware payload", "value": "9f9a3bc7d5efce47e575b4cec66202ca32c9bcc95895f3cf0bf6baedfb8888fd3fbe523683adfe89a186ac8c64286645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042503, "uuid": "3524e6c7-1f2e-4d64-90a6-39d30e36965b", "value": "T1619429E23BB66DA2C943F7758B626844103215276D3B784CB8B30E252533798FA19D7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042503, "uuid": "d6295200-0935-440c-bad3-786b05d0eac2", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042503, "uuid": "7af22dff-cc0e-4181-be86-15eb4d9bd584", "value": "6144:YltoPf9NK1hrg7lBOhRT0/dolaDANelB01Sj/zOV57SC8ozkzkrLrwaf:YzoPnyzeLOV5zts+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700042503, "uuid": "5fa0e4f4-52a0-4163-a62d-4af15e82fc65", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700042503, "uuid": "2d0e58a3-6fea-4f22-bedb-af26f7a917a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042503, "uuid": "3ebb173f-8408-450a-8409-d6d1299ee61b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e6f1b1-83ef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700077678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700077678, "uuid": "a514dd10-f683-4b66-8ed2-9af5df1c4e6e", "comment": "Malware payload", "value": "99f650c09dff951283ced3229b76fb48", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700077678, "uuid": "0fdfaca0-5fab-4e21-8b96-e4e4cd17b5e2", "comment": "Malware payload", "value": "2a8f9fa9e3d05c509f9858cae27a530a1cd6284c9bd4b77e12c811c28b9dadb7", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700077678, "uuid": "ba7353ce-639b-4018-9ca6-b84c8cd87a9a", "comment": "Malware payload", "value": "425b986004b5bd45a6b76b54070087623c7a0840", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700077678, "uuid": "0b9f025e-97e5-489a-9e53-ef9f18424dac", "comment": "Malware payload", "value": "e8a3e81dca7942fa84904406e7501bd2b234c3f53770b8e650ec13b61ef9f71d824709e8646b6477fbc71b6bd1de49ac", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700077678, "uuid": "5aea9679-20d6-41b7-ab64-d9be8e2c3162", "value": "T10431786B4153303BB5F350D997C5650BB6A9908EA81CBB00A7C4A11FC48166643ABF52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700077678, "uuid": "0a50a7c9-8b5c-4205-8f28-b22b584df434", "value": "48:4cSUsxjSvb29XY2CQpScoQ+JwpAikSE09TZOU:qYT29XfScx+mpAhL05ZOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700077678, "uuid": "8382563d-8da9-41fe-8944-3705045d8b48", "value": 1588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700077678, "uuid": "29066e57-c4ca-4c02-94dd-d56bec571d90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700077678, "uuid": "7a3707d9-5fa7-414c-b8de-a769a7ef6f18", "value": "ffpcCgQz.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240e0722-83e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700074355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074355, "uuid": "bc3c5eed-cc69-4b3d-9ba3-10b0c7170018", "comment": "Malware payload", "value": "cde989a6827ce732459b6d4d77488532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074355, "uuid": "638e8880-b158-46ea-a6e0-04bab41bb963", "comment": "Malware payload", "value": "2aaa4c723b5868576aa1be98426763d3c75b1255aa639516c46d5867d2e970a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074355, "uuid": "6e0ccaa9-e37d-4766-8ef9-8a203b76f874", "comment": "Malware payload", "value": "59ca4788e45c59cc940a8833fcc1a5c4a393abf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074355, "uuid": "17e51662-b09b-4e49-ba93-f3ab8b6cd3ac", "comment": "Malware payload", "value": "088c84cb44ade4a1935084346ffe21501d64dff2efaf9f089eaaf73113795d4f5c94e7c5a81d20ce339fc8539a73ebd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074355, "uuid": "c0560f6c-6451-4f96-96b3-34acbab2eda4", "value": "T1D0E55A40E2F1A20DE1EB8675AE70A2F4927378627B22D749CC58F119742E6D78EC1773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074355, "uuid": "6efe6661-bd4c-48c0-8b69-ce36b221d7e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074355, "uuid": "3e75039c-07d8-4fee-8efd-3c286e962df1", "value": "49152:dpszXGAAvkJDLvNrKwSTJZVaKLN46xtccDAoo5mJm/4:diyvkJ3vNuwyJZ/LN/xFDAooMJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700074355, "uuid": "ca5a267f-63dd-4efb-bdd0-6f5918096060", "value": 3088256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700074355, "uuid": "08b3dc21-3e8e-451c-a021-6fa853af8bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074355, "uuid": "96adcd7f-381d-4bbb-9c62-f8bc9d36d7e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665d1274-8372-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700023786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023786, "uuid": "208c7b2b-9603-421a-9934-1c0885e57c7f", "comment": "Malware payload (RemcosRAT)", "value": "94f9224f30f5080928a73a302dc30de9", "object_relation": "md5", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023786, "uuid": "b0ec37d2-664a-4940-8610-d3ad7ee24bf6", "comment": "Malware payload (RemcosRAT)", "value": "2abba169b2f3be758c20b3d23dd9fac351a2c6aed1caa97e32ccbbb888e83c80", "object_relation": "sha256", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023786, "uuid": "f2c0717c-db3e-4b5e-a6a6-c268ab2d6979", "comment": "Malware payload (RemcosRAT)", "value": "dcca43415da2be54b6ff1faaa3462456c7c6b2fc", "object_relation": "sha1", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023786, "uuid": "5920f508-7c76-417e-9639-6422895e81fb", "comment": "Malware payload (RemcosRAT)", "value": "b32e5e1cff0ed5510be33545cd91051604c1a1cdd8aeee60901ec4abb2aad3dd56fbdb6fe246ed8e83042a062924b0b2", "object_relation": "sha3-384", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023786, "uuid": "b8d2d2a7-fc29-440f-815c-baeb2c56ae96", "value": "T1969402057680AC23E2D63671C82B9A614796EE081575B30F2F70FD9E7F7D1C78A493A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023786, "uuid": "055560f0-4071-4cef-bb28-95917afebaa3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023786, "uuid": "d18ab5b1-6fc1-4564-aee8-9ee97f20d110", "value": "12288:co8lc0k61us5dYJttIeX4qOr7LQ5w9SaoLWMzX:co8a0BugYfCeX4qc7E5sOzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700023786, "uuid": "c840308d-3222-45b7-84dd-aa93a09937d9", "value": 410555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700023786, "uuid": "842948ec-aad9-48af-825b-aec51d7db9d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023786, "uuid": "cbdcc7e0-6a49-4ea3-90cb-6e5c3327e6e3", "value": "bk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2916790a-8368-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700019388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019388, "uuid": "bf9e9587-7aaa-4277-8ddb-555a46ed1e03", "comment": "Malware payload (Gafgyt)", "value": "de0af917db760efcb7730589c423554d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019388, "uuid": "a830f25e-45e8-48e5-84a2-3cd72e87f641", "comment": "Malware payload (Gafgyt)", "value": "2b2ec22f0dd019563b5ca08f2956b78a72fe009c86dd581885b11a8feedf5bc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019388, "uuid": "6b7ef643-e37c-4766-8324-cb36f5dadd1b", "comment": "Malware payload (Gafgyt)", "value": "1fb789f891bba8441188db9d658ad0a9424dc60a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019388, "uuid": "5eef3fad-f3c8-4e88-9bf0-4e7fa5c7a96a", "comment": "Malware payload (Gafgyt)", "value": "e7447c56462ce3fba5720d8d444b1e7f054050cc865617c5c020fe91e548f272b69ade429d82ebe5b58ed04d13436ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019388, "uuid": "df7b1bde-9f53-4fd2-bcb0-3345e4ec262a", "value": "T114934923ED125F0AD20BA4F061F59F351F22B8FA89975AD9E065DAE06543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019388, "uuid": "05b0cdd4-fdb0-45b1-a289-731353165bc2", "value": "1536:ZEZLXqXF+XBbwKYdo6nZz2ak0+Cvuy0/+ym5hV1qqpRm:ILqV+XBbXYdz2ak0+/yIm5hjqqpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700019388, "uuid": "b477b56b-dd3a-43f9-9427-97bb38148bb4", "value": 92164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700019388, "uuid": "6abbc99b-66cd-42fa-9d8e-cee8aee067a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019388, "uuid": "b2ca795f-7dee-41e3-8be1-3d516b320815", "value": "de0af917db760efcb7730589c423554d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68c84b5-837e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700029155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029155, "uuid": "2724090c-676a-47f4-9f3e-275dc1e4f15c", "comment": "Malware payload (AgentTesla)", "value": "8c40f84675de67fae86c52e10a934795", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029155, "uuid": "c7c65982-191f-4a9b-b4e0-e7857435dcdc", "comment": "Malware payload (AgentTesla)", "value": "2d63c7065f4924e91461a07ccefafbddc4d7944cc5cbf0ad543a7c7f8103d36e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029155, "uuid": "7aeee081-0d0d-4fa1-a9c1-2442a386c3d5", "comment": "Malware payload (AgentTesla)", "value": "2a2bc66b2b67506ffea6df556a58867048d8bdec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029155, "uuid": "ddb9e312-e5eb-4102-95cc-594f97a6d061", "comment": "Malware payload (AgentTesla)", "value": "07b5b97da384fa5c42e185332d7036454ba19f4b59e5aebde43bc5e9a15ac901804aea41468315023828c150fb34183a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029155, "uuid": "1520a2bb-7efd-4ecd-b4b8-b448a60f73c6", "value": "T16DF4F7BF7B8C213381B9D693C3A3E066F27BC8A7713A5E2524D3DA914647A0774C522D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029155, "uuid": "410ccb62-e1bd-446d-a4bb-44be58d4438c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029155, "uuid": "267f23c7-6489-41ee-b4aa-b38c58a519a5", "value": "12288:SmR83xrqRhBwI1sn+hvOFLH8IYt+0DwLHh:SmuBrqRhBb6LHOD6Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700029155, "uuid": "6f2bd748-1920-4cb4-a5d1-f28661c6a1cb", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700029155, "uuid": "8ba4b089-8c2c-41a7-a61c-d2eb69322f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029155, "uuid": "7cb14b7e-29ac-4677-ace6-90dc58b3f027", "value": "SecuriteInfo.com.Trojan.Inject4.59820.17795.29704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c14f464-83c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058423, "uuid": "3481e3a4-62f9-437d-a7cb-2dff25eb471a", "comment": "Malware payload", "value": "73c26c71144c03fda48eca01ad8b7f1d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058423, "uuid": "f711a0fb-08a7-4b3a-bc86-2a646c11912c", "comment": "Malware payload", "value": "2d779ca15bff11fdaeaaead808f4887d4bbd30b441ce9d4ef6dfb28b748e8769", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058423, "uuid": "e5adcc5c-3be0-44df-b973-7f66011a94ea", "comment": "Malware payload", "value": "80b3663844d42d92f7ccdecb6d3bc35007686ae7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058423, "uuid": "380032d4-abd6-468e-abdc-86ab04b70326", "comment": "Malware payload", "value": "5000ce1aafb9c08f04b43f3f7c3a840e2d43d328df34fcbf28fc4e75302a130abf8e48d314e1b53f3967fae3280591b2", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058423, "uuid": "a198fdec-d1c1-48b0-bd90-64d0429700cf", "value": "T1D4B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058423, "uuid": "3b67062f-89ab-4bd8-96ef-9a1d9f81cb6b", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058423, "uuid": "e1886285-a030-47b0-af8a-e49d5a610ce6", "value": "6144:nexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O73pUlLaEx:neZeWSpda70ADIgSoxgUW/zFun7OFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058423, "uuid": "b7e3236e-1313-4ca4-bc2d-91753c3c1d5d", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058423, "uuid": "069d6c2d-9367-4dbc-842a-9baf7d4097aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058423, "uuid": "f67a5b45-e44a-4909-84ca-0797ad5802b9", "value": "syncchannel_alpha_v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce108d6-839f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700043205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043205, "uuid": "c4fb14c7-7e0a-43d8-af31-54d675cfcc9a", "comment": "Malware payload", "value": "833de83d9255cbf8460b1c5847de8d4b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043205, "uuid": "d324ee59-b2db-48ce-b22a-98f72fac4b82", "comment": "Malware payload", "value": "2e3b753447ccd7d4a766dce1392d884fc6a3632d858f77ad19465a6504708ae6", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043205, "uuid": "f58bb06b-fac3-4960-8c68-1ee32d1859b8", "comment": "Malware payload", "value": "b31ec31d0663802b21ea2aeed37377460025a6da", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043205, "uuid": "c8d68040-a225-483b-b92d-f195782703ee", "comment": "Malware payload", "value": "30d4f561de298e3cad0c981e77797d3f55c238fbf046ec2c99f558f13a33f4fd9a66f4fab838285ba699ea7b56242469", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043205, "uuid": "f0c39f66-0d00-4549-b863-92c1ee4eb2af", "value": "T1A2760173F0DA1471F8731A36B8A25432393E089CE08729A929B49BD3F972D4D9F47791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043205, "uuid": "93fd2d4c-035b-4db1-944c-5b6167ac1b6e", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043205, "uuid": "362cd9da-359b-4084-b477-05e19a6c7019", "value": "98304:8iKKwZccnGtg57ET+AjfN7TBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRRn:8RZccQFZ9TVHJack+YlGlSRRbCvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700043205, "uuid": "0a068008-46a4-4f95-a6ae-7a46222ef0da", "value": 7756378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700043205, "uuid": "ed1b8111-30df-42cb-be54-fac3c5b870ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043205, "uuid": "0288c213-697f-4bf7-9516-e2a504bcf717", "value": "WebModuleBrowser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69590b0e-83e7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700074042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074042, "uuid": "9f90e3a8-3998-4af7-8604-3015d3c0538a", "comment": "Malware payload", "value": "eab44b2328f9db484cc042970b19a2be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074042, "uuid": "e11b350b-c7cb-412a-bb84-98c4f56abb23", "comment": "Malware payload", "value": "36464f131691f5a812e22d4255377f79a475700185352606586f671b9ab63b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074042, "uuid": "67cf0e1c-be37-4193-9611-d45d0a4fab1f", "comment": "Malware payload", "value": "c38c69f8a7597a06a4b12cd06309aa23af0ce496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074042, "uuid": "43fa1acf-577f-481b-8d22-72f0a9677b63", "comment": "Malware payload", "value": "c595e653f0fd458dde5215398c2f0ef6343bf9328545cc63fe5f1087e6c388e0ccb152c78bd24029cb88cbcdbeae8d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074042, "uuid": "7fbe9c1c-e8ff-4e0a-a575-f72dd0dbb7c1", "value": "T1074401016620852BE4E202309A366FF9DAE79D556A91DF070F953E0F3D763B1902FB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074042, "uuid": "5da8d7e2-347d-4d34-932e-fe14ab872003", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074042, "uuid": "fe0f0397-fecc-4b68-bed3-a2c69afa341b", "value": "6144:9T4Dth1R6LFzFktPQnmzpE7HBCKRx69ChHjZ9zh9Amq8:9Ti1btIIpELBCKRx6eHjZ93AmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700074042, "uuid": "f35f068e-0be1-4512-9a1b-b492617fde5d", "value": 269976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700074042, "uuid": "0fc549e4-5ac9-4803-859a-98a3d33664b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074042, "uuid": "de1edb8c-bde1-4427-b9b1-319ed47e5021", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4eb4ea3-83c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058734, "uuid": "c000b16e-0ef3-4ef8-a9ca-6e874eea0f17", "comment": "Malware payload", "value": "7e865e246549ba7046e5356fe23ff7bd", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058734, "uuid": "8535e059-6e8c-47cd-8a89-d005ca4147ac", "comment": "Malware payload", "value": "379e01a20f66afe32b7792eab0bc3d97179ee0fcca919e4604769d6a6fc3c2e1", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058734, "uuid": "eca82b2d-d7d7-4bc6-b643-e72eb01a6d3a", "comment": "Malware payload", "value": "7554c039179688db1f69589dd2f66b9f3213205c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058734, "uuid": "57403c89-77ac-4782-8eb1-85e8a6880efc", "comment": "Malware payload", "value": "f923d0ca8147b7eb4cafdbd057fc8a544b7404a51fc0e6488dee968336a40ae82ab74b729241f2ac5b0c42b74949338b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058734, "uuid": "982a16d8-945c-41aa-a7de-5a379549e96b", "value": "T1F904AF11759181BBDB9E223854FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058734, "uuid": "d2b8a776-55ca-4f2b-9b87-12ab989053ea", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058734, "uuid": "1e3511b0-3ef2-4d28-a7ed-c6039be2b346", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLtbVaKoXAxOPYe:I74elpowsxizqyStZlpel5JyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058734, "uuid": "7fbc8087-87af-429e-aa70-fd1de8fcf0e1", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058734, "uuid": "2aa0ffd4-bcd4-4c8e-9b58-254307176ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058734, "uuid": "b8795d92-887f-4894-bdfa-43efa49cec48", "value": "WCUtil.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f7b43a-839c-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700041795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041795, "uuid": "2328e176-60c6-4120-91ee-851625bf21b1", "comment": "Malware payload (RemcosRAT)", "value": "9bdc4f2991ae680e12e95ad5b1e2551c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041795, "uuid": "d13d8509-6c57-4a5f-9a32-9a59e9bda60b", "comment": "Malware payload (RemcosRAT)", "value": "39c906f25a69d675d9636c3dcfd78c18cae6a9b7a49697c23a08d54004b4c6ee", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041795, "uuid": "9e5684c6-4bcc-403d-96c0-0e7e5c2eb009", "comment": "Malware payload (RemcosRAT)", "value": "11828910010e518501b0e4fd212bdf152d2748ff", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041795, "uuid": "42d6d490-de33-4e26-9d6d-250df1ce22ff", "comment": "Malware payload (RemcosRAT)", "value": "82ce21f682de33e0a94bd973c3c8dcf7384804854ab98998dd1492ef159d2c60152e5a01ded6d2449e6505df2af39890", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041795, "uuid": "613b8517-e3e7-4d02-8360-8220098a7662", "value": "T13CB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041795, "uuid": "eb293bfe-2cd6-4608-ad0a-a2744eea98bf", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041795, "uuid": "8a80166b-aa5d-48c6-aa45-a2bede82f9bb", "value": "6144:cexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7dpUlLaEx:ceZeWSpda70ADIgSoxgUW/zFun7OHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700041795, "uuid": "274fe21e-221d-4a0c-aa6a-78096d5a49c7", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700041795, "uuid": "b2894b52-03cb-4372-a27b-3cc0a5d7cb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041795, "uuid": "e39b8135-9e6a-4f69-b6bb-9a51cb0dca6e", "value": "tipol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36090259-8400-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700084693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084693, "uuid": "6ae3e54e-0723-427a-94fc-f20534622ad2", "comment": "Malware payload", "value": "e1d59430a388f456d21bf47159e88d76", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084693, "uuid": "da7dc77c-4dbc-4072-a85a-d9ee0536bf9d", "comment": "Malware payload", "value": "3a43116d507d58f3c9717f2cb0a3d06d0c5a7dc29f601e9c2b976ee6d9c8713f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084693, "uuid": "36de18b8-5241-4c07-9a88-e722f14ed408", "comment": "Malware payload", "value": "8605f8f5ac9d417f456d14aaa0e1289e4d6e3c8b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084693, "uuid": "6848fec3-1815-404d-9ceb-59d4cf027f15", "comment": "Malware payload", "value": "a0603de24740293840fcea17aa42f4d8cab0bb090d0ab5709877589216b47e3671da7982e3eeba08b4e3d564f91c9b8a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084693, "uuid": "3e7441c1-fece-4c96-90c8-d1155b06622c", "value": "T1E0B533ED22897B6644199E3CFB3DAFC3EF517CD691D84141BA7EC21B86B70E16B00066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084693, "uuid": "21673bc8-8127-4580-913b-efa7b1c2c8bc", "value": "49152:YApZDxjoiDQCHC96P/iEGP1pCgApgQlSAwgo5ioHNtf86rM25pEG9STq3:tTV5DQxRP9QIAWv/Xr3pR9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700084693, "uuid": "01778b5e-7172-4c3f-9d4e-4e327449fcca", "value": 2385132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700084693, "uuid": "1e55c6f7-b835-4fd1-8791-1765bacc465f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084693, "uuid": "5008fc3c-2061-483e-8bd1-aa5073a54da4", "value": "e1d59430a388f456d21bf47159e88d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0b9caf-83c4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700059146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059146, "uuid": "1937dff7-8f10-4d6d-9a06-f74b70376999", "comment": "Malware payload", "value": "d0256fa105e5efb3be92980c37bec56a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059146, "uuid": "52c55f82-68e6-4fa4-ab51-665b05183ea0", "comment": "Malware payload", "value": "3afd0ec9ff87802fecb70c64bf0c0b86081bd909b9b649f902931964d585632a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059146, "uuid": "27550bdb-88ee-416e-80bc-bae3c7ea9065", "comment": "Malware payload", "value": "94a483168ded4bd365e5d895eeaf6617eceb15aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059146, "uuid": "36130c26-0c6c-4684-bdd2-a842b02ee5c3", "comment": "Malware payload", "value": "baff20fe4c0f45a211da27655d0ad45eb6824c9fd8295820523e1135e2dc5e755bc6bf3712908ca17f19fa2b0ea222ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059146, "uuid": "9ab7d2ac-6c86-4fed-a24d-53cfb624f53c", "value": "T10865E145F7C08DA3F527133649E7872213B9E7105723C79BEE18A93DAE23BD01A86E45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059146, "uuid": "03a34b28-ead8-42d4-ae9c-ad3c1bac8b1b", "value": "be2a53a57be90b97c83c373f6187ce99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059146, "uuid": "73d7f437-2484-4bbd-89a8-d64000e49cc7", "value": "24576:RSK7rGFAMXNQi2h3ErhPirNiX60lpYA/58c8thHBALNu4hOx3jMG:veFPdqNiK9AkBiXEjMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059146, "uuid": "671f6282-5074-4ccd-978f-f23e04d42312", "value": 1520000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059146, "uuid": "fc4c0f46-1bc5-4c2a-b50a-bd1885bf4bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059146, "uuid": "1bcdad51-cabc-4b85-9727-7febae386191", "value": "belatingMuscat.conf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f5f6c6-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044958, "uuid": "e4d6a92a-afca-494f-8fe1-aca6e923bd96", "comment": "Malware payload", "value": "318e2272187798dbd04f0b228e2ca756", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044958, "uuid": "b6c190a5-10c4-498f-ba64-a5494d173865", "comment": "Malware payload", "value": "3bad32b4a4a4a24f88120c59519a942f29c71bbc638fda3c0b06655c29742c43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044958, "uuid": "20e18033-3758-493b-8b38-339c80a295a0", "comment": "Malware payload", "value": "6f6466d6c49af972984773ec0346d8b1d276b80e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044958, "uuid": "4a2eeb04-6385-4915-971d-29c9843f74b7", "comment": "Malware payload", "value": "ba3ae9f25321b8f9f3d21d292b24aae3d3f0ac06dcc7b9d3733d77c62c394c252b6eca502354534a8159fd0e69b8d063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044958, "uuid": "ab8eb6e0-b25b-4cef-aba6-38cb1fcca62e", "value": "T1CDB50252A2B58437D0333A785C26A715A839BF203D58304A67F57F3A5D782D2392E2F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044958, "uuid": "52dae523-9427-4996-85e1-af7456290d45", "value": "dac05be5895af545d739c2ac6cb2defd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044958, "uuid": "e3e4d355-a58d-4baa-b000-af59b016b004", "value": "49152:OPNfbGYGU/DDjqvOS6iy3iWOY+YLqaLOlTYrbs69V/z:OFfqq3cy3im3L6Ks69x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044958, "uuid": "50b6f8d7-6243-4e38-b95e-06e7eff646df", "value": 2427904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044958, "uuid": "0d476ab7-3be9-472d-bf13-3f537443f502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044958, "uuid": "9077df57-a709-4d75-965b-407f8d39edc2", "value": "318e2272187798dbd04f0b228e2ca756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622b41d9-8398-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700040100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040100, "uuid": "a872084c-64f5-4ee0-9924-5e601b1e6f00", "comment": "Malware payload (RemcosRAT)", "value": "cc507bb5e5c78964fea686d422d29c86", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040100, "uuid": "a566eca2-d64f-4a17-9752-aa03fd3b5fea", "comment": "Malware payload (RemcosRAT)", "value": "3f631c04c084cad9373730dad3b838b4c4f4d079e825ccffdab3b09d12b027c2", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040100, "uuid": "9dadab73-4780-41c0-9793-d70ced2b7dd0", "comment": "Malware payload (RemcosRAT)", "value": "9b6adbaa8112fe54021375d2fceaeedc65fd2b60", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040100, "uuid": "2851955e-1253-4123-9a46-e9bf97b8c867", "comment": "Malware payload (RemcosRAT)", "value": "765c2639d2c17672d6b7ce6918a8f73d614712e080d1d401e4884c9157cd0422c5959e7808bce59fb730ef66d4992c95", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040100, "uuid": "73b60f46-6da2-4eb9-940f-8b80e5eeec9f", "value": "T1A7B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040100, "uuid": "5783cf42-ee19-4e18-9ff8-6c47c06f56c9", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040100, "uuid": "22e16d3f-cee9-421b-8ad8-aee8b5497cb7", "value": "6144:FexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O77pUlLaEx:FeZeWSpda70ADIgSoxgUW/zFun7OpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040100, "uuid": "20a494db-9c3e-422b-9ad9-b57447fa4f56", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040100, "uuid": "f07f7f21-44a8-4e82-92a1-9addeaeb455b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040100, "uuid": "eb8ac93b-f9e2-4b19-84c6-3bea42596bb3", "value": "avviso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc8d0f1-83ba-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700054722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700054722, "uuid": "4e93076c-c229-45ec-a045-87614bdf408b", "comment": "Malware payload", "value": "fba38e2dd51355045c3ecba9d9a37af3", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700054722, "uuid": "44173fd2-f30d-45c0-b7b9-a35f76dc22ab", "comment": "Malware payload", "value": "404c3ce096f6991834caeae8a5969f52b73b796c5ac7896875f069b708f8032b", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700054722, "uuid": "031ffb89-f2fa-44c9-bcdf-3e172b290e82", "comment": "Malware payload", "value": "d8ae826a2a6835603051cc7c53c91ab90dbfff95", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700054722, "uuid": "385fc489-f70a-40b4-90d3-db137c3b8523", "comment": "Malware payload", "value": "8889e2a5529f3fcf07ef000c4a279c9364592799a5b5abfda642ebd48687f493d4ce43d58d120173e7fd562701ed0b80", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700054722, "uuid": "5107560e-9036-46ba-bf67-41b2777839a1", "value": "T1A1618F932151B8EA414287BF3A4A6AF7807FC224954A7044F78C5F9DF9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700054722, "uuid": "65cc4a13-480a-41aa-973a-92b7d5ee0830", "value": "96:lGtIqqluSnWFN+CfBZL0H1mAiBrVMerFdv:sVLFWH1mAiBrVZrFdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700054722, "uuid": "40ff1ac3-1c8a-4023-ac65-7b435d87c058", "value": 3207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700054722, "uuid": "3c63694a-faa2-49b2-b69a-3f3d842604f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700054722, "uuid": "0fb23925-b891-4315-9e64-4129875fb03f", "value": "iWjwAmvh.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224ee52b-8368-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700019377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019377, "uuid": "d9c6e9b3-afc4-4330-a67e-ef0ec8442a10", "comment": "Malware payload (Gafgyt)", "value": "1b0d6f0ca5582ff12f3586912aacf723", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019377, "uuid": "9502f430-9b6b-4a73-9282-6e62a900b714", "comment": "Malware payload (Gafgyt)", "value": "41382ba72b27d90f0c8e72293cccce520751d1b87a841e72be95f558b0bea002", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019377, "uuid": "8b76b4d6-c600-4fb8-aebf-76b8b04ca401", "comment": "Malware payload (Gafgyt)", "value": "805b59457f91e1d4b7d1afee84a8c7813b4843aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019377, "uuid": "eb8e9084-338c-428d-980b-bdd070a91ab9", "comment": "Malware payload (Gafgyt)", "value": "dd42fc401d41ead6d4225578784f6d947d4c5ba032f9629086023a297c657291682eaa746db64a14349774d6b7d9a2c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019377, "uuid": "7c48f400-d555-458c-a6bd-a6ea2f589b98", "value": "T148B33956BD018F53C2C315B3FB9F47887B2667F8D2EF3203D925AFA1278A4D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019377, "uuid": "8461708d-77e6-4daa-9ed3-2f36bd71f8a5", "value": "1536:VFL4kum3i9NwayEEW47XGF2r4aYBCmerwO0J23+ZbvRdQr19xvT5hOpRXq:VF0QS9SbTGQkameT073AXT5hOpRXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700019377, "uuid": "79dbda4a-0742-4c32-bdc8-fae4cb6a2f31", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700019377, "uuid": "6f1326cc-aa38-4d37-bdb1-aabc39478d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019377, "uuid": "7c37afd3-5e06-498b-9ead-708a7cb839af", "value": "1b0d6f0ca5582ff12f3586912aacf723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74990024-83f4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700079644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079644, "uuid": "e7204c9d-4024-4cf2-9901-b96800b92570", "comment": "Malware payload", "value": "a2bb76f69192f8d5e0c9c3b15b4463df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079644, "uuid": "ce8f3a07-7059-4d01-9828-eb93dd2039c4", "comment": "Malware payload", "value": "41b8a012d8dd2aa525aa05e5d296e13d4994110cefa41068adfb80eec0e3efe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079644, "uuid": "5a950537-eef6-423e-9c3d-98eeb959edda", "comment": "Malware payload", "value": "b56d534cc381e903c00b72b51303750e06438d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079644, "uuid": "7c826b8b-0b4a-44a1-9a97-fc62f2745cb3", "comment": "Malware payload", "value": "ac5476d0ce6b4f5f9b9d899b6a73ef265fa9d31869a85e829552502d590d9d80d6351145d7e0a754f108e29999433ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079644, "uuid": "576bff2b-75a4-4aca-9924-3ce57beaa84c", "value": "T172544C0C7FB8923BF4CE9775F4654231A3F8E09AA21BE79E9D456CE41D6330748016AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079644, "uuid": "2352dbb7-ca6a-4ee3-b390-1c35be297680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079644, "uuid": "fbb3527f-fd77-4e0e-bd53-ad476679de05", "value": "3072:PeZVtkIrHcDjxjPDAf9wfBeO4ezEivjvG/tCC9/JMEu5b/pT+5PQt/stbd8Jb8Ji:iEzNfBe5oF5bhiPr8gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700079644, "uuid": "f4c6a446-ee19-4d1f-b495-7b262f707640", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700079644, "uuid": "e6624c15-5e58-44d4-a917-a4465ca50b12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079644, "uuid": "fa311c44-ac2a-4962-be35-18f1fd2587eb", "value": "SecuriteInfo.com.Win32.DropperX-gen.24037.31354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e231f3d-83b4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700052146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052146, "uuid": "2d66eb33-4886-4ffe-ae39-8cea79de8a5e", "comment": "Malware payload", "value": "e119451618b194faeeb3248b079d2362", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052146, "uuid": "f3965c5c-f146-467a-ac00-4d75c37206dc", "comment": "Malware payload", "value": "432b677ba091ee74a5d1d08f9ff609464c83355dba75bebdf978ab3f24c4cf76", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052146, "uuid": "3788177c-8298-4096-9649-6cdfab9b2d2c", "comment": "Malware payload", "value": "97bd160dd860c3768467600915466b52c16ecfcf", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052146, "uuid": "2075dfb1-2973-4bed-90c2-fdab2190f9fd", "comment": "Malware payload", "value": "a95b81c344e09a343a9bf671055c46f42ae8e4dfab072ff9e73095925a7fd7e594e44821a9bad8faef05fd6fa8dbcc09", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052146, "uuid": "630009d5-4c64-4747-9ff1-32a9d3e84a8c", "value": "T1CB138DB5DE904CA3479FC67B9739E7B0F8728242D5C1B78B52B9F5850A9AB53C01EC80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052146, "uuid": "5570cafd-6f82-435f-9ab6-509de9854006", "value": "768:CJupdW9yab+3WSE87IGXx2bCltHaDv1/eWIhz++EUqupdW9yab+3WSE87IGXx2bS:C4pdWsb7pj6DvwWIhz++BLpdWsb7pj60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700052146, "uuid": "1ba4936c-494c-48cb-8dd4-a56eabf0bdcc", "value": 45402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700052146, "uuid": "ddbcad53-bc7a-48c6-be89-52977b4c4456", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052146, "uuid": "5795b035-9c04-4c84-9ba0-e5fa2f103ab7", "value": "NEAS.null_SAT.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3266870e-839d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700042167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042167, "uuid": "c5a405b0-55e2-45e5-8684-9b81c7d53a5c", "comment": "Malware payload", "value": "b761afb0c67b4f94f5d3e47f59040d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042167, "uuid": "47553dcd-412e-4a36-aeef-e7882878a6fe", "comment": "Malware payload", "value": "444ed0d8b62bdd8da294c6a49e47a7f8a15fcec43409780ea00997a0bf53ffe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042167, "uuid": "e5523eaa-240d-4c00-816d-c50be34706de", "comment": "Malware payload", "value": "cedddd5443bfae50cf38dbc119c7d034dfdedd1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042167, "uuid": "416a95cc-e591-4153-b5ac-da6d1d9a0a82", "comment": "Malware payload", "value": "d2d27b154d26c307b1450f73551979c0fa2e793214b074a9920f56be705bf3c735f4759fb9b1c0720d4de2c6ee57c6c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042167, "uuid": "c492f251-6077-4587-8f1f-b2219f8dd294", "value": "T194D5120263E21636F5F76E3469B206244D37BDA469F8E10C1D79D25E0EB2E808DB5B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042167, "uuid": "314ce047-436b-45fd-b9df-0a499dac7957", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042167, "uuid": "0507ff18-1ba5-4940-8a12-f4876dd8a134", "value": "49152:p4RiswcUZcimQaB++5As+ryqWqoBll0jL7cgyTURSQzaNxLR:pxXqimQab5r+WUaT0jHVyARSQzaHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700042167, "uuid": "5c89170f-2e22-4bde-9a6f-94a33b67371c", "value": 2795680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700042167, "uuid": "f525ed77-c87a-46fa-876d-0dafb5e03408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042167, "uuid": "e5de5f16-dd96-4544-b0a0-6b7b2db459d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70646fb2-838b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700034540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034540, "uuid": "9fdf1f28-a129-49a0-9190-624ea2ea9a27", "comment": "Malware payload", "value": "f388a99a7399acd9a9bdc49faf44d4c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034540, "uuid": "b9daec7d-2cc9-4340-bcee-367f407e5b5c", "comment": "Malware payload", "value": "44b2f311eaba2e49b175ac9126fdcee092b1bfce3f7d5581a615c80afcfd0d1a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034540, "uuid": "02ceb147-28e3-4632-8dd8-7be4c197a777", "comment": "Malware payload", "value": "cc49fd6dbb1c6be5db648ccd476ed3c81c6e519c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034540, "uuid": "491637b7-0e9b-47b0-9419-493ebed700cb", "comment": "Malware payload", "value": "5d33937f1b8bc90994c1619a173198f3b3739b45bd400c99057803dd73756555c7c85e419a8773cfa9d1429875284484", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034540, "uuid": "d5c4fc29-cb39-4128-8907-d498d0b4b83a", "value": "T1E1C36041E76B1E25D12C1C74C0B303DD8E79AD7F4E16E216399C7D3C7B740A4BA2AA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034540, "uuid": "4df26795-b119-44c6-938a-68c30805443e", "value": "1536:fWtgXHmVoDLfccaisk0j+a97nxDNCO6jpDR3:uaH6oDLfc5T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700034540, "uuid": "848b443a-92f3-451b-aa2b-2c41e72a3dbb", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700034540, "uuid": "fe8f0995-85f5-4767-9e66-780103b81e26", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034540, "uuid": "a063a551-cd6b-4040-92cd-5fdff0d9c56a", "value": "Dilip_Nukala_Resume.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe64748-839a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700040955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040955, "uuid": "0b674aa0-e1c0-4282-86ad-2b772dedc474", "comment": "Malware payload", "value": "0dfa7355423441b0620fa9f6e99dec3d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040955, "uuid": "3a792662-79d1-40d1-8a1e-f218a1a615af", "comment": "Malware payload", "value": "46a95f00106f48d7ecf75c41fac059e5f5766f7cefec73e2638d9dfbe27e7f10", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040955, "uuid": "b9e8d286-2b4c-4263-bec7-274eb83de137", "comment": "Malware payload", "value": "31f3aae67064440e71366579f25bea639f56a106", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040955, "uuid": "447e80e4-2548-4a68-9313-be563c5281b2", "comment": "Malware payload", "value": "dd53a39fe5e16e5f3a17b0b00586ec7b1973682f50a20257038ba4b0754ebd80e00f18ec182212eff668b7dede136e05", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040955, "uuid": "9d233a88-7b52-4a8e-a67b-522c078aef6c", "value": "T1CBB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040955, "uuid": "dd8fc1ad-acc8-4983-9c0a-32e50c75be7a", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040955, "uuid": "13fc5f7b-5a20-491e-9d71-c81d1ea42f95", "value": "6144:5exbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7CpUlLaEx:5eZeWSpda70ADIgSoxgUW/zFun7OeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040955, "uuid": "413207d1-2f2f-41d5-a77d-04853380b5b7", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040955, "uuid": "39cab254-8435-4c60-baec-61fbc315f9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040955, "uuid": "3a26c428-4c76-4654-8192-8009326402d4", "value": "contribut.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d04a75-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044964, "uuid": "08ed20bf-cb9c-42a2-94d4-8106c9abd53a", "comment": "Malware payload", "value": "8cf675130d01d0b2680b127be7aff84e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044964, "uuid": "81bea298-6a2f-44e6-826a-f4ae0643e1a2", "comment": "Malware payload", "value": "470cf66bec58f48d4290d8440bef7c00fcfbd0f334504c5d2ac6739b8929ea7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044964, "uuid": "aa9c72b0-735d-4929-bac7-781cb65da1f4", "comment": "Malware payload", "value": "e20c4a4c148358419df8993e647db9ccb1861f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044964, "uuid": "2801a5be-e181-4809-836c-8692103c6e41", "comment": "Malware payload", "value": "bd21343062a10fb646faccf919e87deb19ba2cb2d37d1cd2e6fe8ac3ddd5f9e930ca485cf89191ea2b154c518ad4a53f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044964, "uuid": "1bee5a92-1dbc-4011-a457-548ce3f9472e", "value": "T1D8849EC3A290BD54E9258773CE1EDEE8B21DF9508E49B7662228AF5F14F11F2D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044964, "uuid": "e287b423-ba90-4a7f-a9ff-e8424794852a", "value": "0a046e791e3122b7d021f9aaf3ba90b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044964, "uuid": "bc0b9725-ae52-4fd3-8979-0ab109c3c834", "value": "6144:UrLDaUttTBwJXar1KCjLA/6rLC0dGVRQ/zAVir:Urva8tTBtScWKzAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044964, "uuid": "8b008643-0d58-4b11-9cdb-405a6c6629a2", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044964, "uuid": "09e7b00b-ac6a-41be-bc17-61c3486d5035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044964, "uuid": "b2ce72f7-62eb-40e1-a8e0-04ee3dab49b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6b9533-8352-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1700009918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700009918, "uuid": "d6f40162-c4d2-4f74-aff9-a0d7e9994d35", "comment": "Malware payload (MarsStealer)", "value": "11c081eb40de799674ca32c5e4bc8ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700009918, "uuid": "58c9a2a7-6b1b-4433-9aa3-300f4cb1df0d", "comment": "Malware payload (MarsStealer)", "value": "487ca2266b9ddac43dde09ad484b1b73ca38071698bfda25d419dcf6c5ed3a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700009918, "uuid": "45497108-b46f-47fc-97a1-58dddcf2fb7d", "comment": "Malware payload (MarsStealer)", "value": "062a73463cfbf9f4c059cfafd0f9b6b6b6fb8058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700009918, "uuid": "29729007-457b-462e-8574-164f3827b02d", "comment": "Malware payload (MarsStealer)", "value": "6ba102348d5edb104edc08392d05c3c8c191803374de2605af918cb9364aa8605bde5b7e67a2b196236688f828005523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700009918, "uuid": "3b70eedc-29cb-4856-bdb7-7326f8da9683", "value": "T18D14BE2236E1C072F1634A3449A2E6759A37FCA25BB2C9CF17C01A7E4E316D1DB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700009918, "uuid": "56529072-32e1-4829-953e-8c8be79dbaee", "value": "6d9345bf08688119d85e339b601df9ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700009918, "uuid": "9f54bedf-d725-4adf-ac35-dde83fa7bc87", "value": "3072:fqcVkys4oK5JJAFpqgpTUhJVqRrR9PsflsXbU:8ygK5DAnqgdUTUZR9POW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700009918, "uuid": "0adf8ea3-aaae-4f3c-8ca5-b23b65ad5bc2", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700009918, "uuid": "b57ed5df-e920-4f73-9138-8737e23f18e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700009918, "uuid": "1df776b9-a2cd-4567-b0d4-a1a1894c5aed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1aae0c-838a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700033939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033939, "uuid": "0bc2ca15-74ed-4f83-b135-a13c4c47dc6e", "comment": "Malware payload (Formbook)", "value": "54931739285550801a5dfb08b1aa5413", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033939, "uuid": "21999217-84f9-4d7b-a759-94e337c19e01", "comment": "Malware payload (Formbook)", "value": "4b0088a5ea5b554b183064229db63803bac5538cd7cb9f5f1092e50dce0d4ade", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033939, "uuid": "d2e8345b-5f1f-434e-9f24-590a887b4c98", "comment": "Malware payload (Formbook)", "value": "3de5553bebc2c85e47f312a6ef4f41f01df80643", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033939, "uuid": "f0508587-566f-40ab-8a81-370f44fb6518", "comment": "Malware payload (Formbook)", "value": "183f8ec7307e99c0c8d2c63829c9cd8cdddd7d6d97b42a98d6e484fbd2bf3cafb2151f44eb79071830f3a02fda4a40c4", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700033939, "uuid": "86b463f2-a8eb-4776-a30a-77fb794db744", "value": "T12A6423C17AD73EE0831D978E3B25B1885B7C8825258F838B14EAB6527563396F2904FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700033939, "uuid": "d1250460-5a8b-4b15-8c3c-6083d940a876", "value": "6144:K6HOemc3tLHRRCPEqwavMDfGCNyxoNcwZLOIZ3ihfmLpMvQuMLulT:xbmCLxksqwavMzhyxQf8IpsmLGvKqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700033939, "uuid": "1d3672ef-a92c-409c-a869-ce0c0113fbc0", "value": 307129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700033939, "uuid": "d5f2bfc2-fab0-4893-a265-f58971f8595c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700033939, "uuid": "47f3b1f3-fa23-4fce-a415-6629ad09eb76", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a850955a-838b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700034634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034634, "uuid": "65276eee-d0c7-4b8a-b010-854c68d8ebd1", "comment": "Malware payload (AgentTesla)", "value": "620699d73bda9499bbbe9b0557951659", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034634, "uuid": "38cc5a76-6ede-4fac-9808-1701d3988e10", "comment": "Malware payload (AgentTesla)", "value": "4bc3218865e598320faef41090da4ab23101fff8531ffebcaf6523a0217ea898", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034634, "uuid": "faf99013-2e93-4607-9679-6165454d543d", "comment": "Malware payload (AgentTesla)", "value": "fc913e1f30bdf4248aa109ef4274551fbe50b889", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034634, "uuid": "b5222136-a5f6-4451-8327-7feb43d21b20", "comment": "Malware payload (AgentTesla)", "value": "7864d272891a48012a2cda7cb536208951e29b46a6c1d71af2ebdf3f1d4f99f716302e2ff78a0a60e944f022174452b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034634, "uuid": "b610bca9-cfeb-4c51-8005-2862f202a3a6", "value": "T126C423D61903A712115096F87E3C359EF08AD53A1B431E0EE8E774679AD06BE3239D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034634, "uuid": "b21e5220-30da-48ab-aa00-0fcba8749f03", "value": "12288:cdiHJcJCGojnQy5jhCXFM7wUKEOFra3Ma/+srlD1aYmp5o5h1e/+bbAkBEXT:3HeJVocyZhpbKEOs3MMFnEu1eebJEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700034634, "uuid": "74fcc1cd-b1a2-4e4f-a5f9-5aa0ab1454df", "value": 575037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700034634, "uuid": "e2519d4e-4b72-4b8a-9244-cdfa243aa5c1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034634, "uuid": "4c70fda6-0272-4e66-b92c-1e6e7ed52b62", "value": "SOA.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3ccbb4-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044975, "uuid": "24f50615-5d6d-4450-bf63-955dd2bf5ad0", "comment": "Malware payload", "value": "20475c809f00840b49f662de6c9216ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044975, "uuid": "eba7b49f-4cda-4145-958f-c000e715dbfa", "comment": "Malware payload", "value": "4be5f0cbc0f19546855afc9e8af0eafea9f10fb751ec9c1dea7ab88fb4543c21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044975, "uuid": "70e14b00-e7a1-4619-bcb2-cb775ab86583", "comment": "Malware payload", "value": "ba1ed69b849f0d4a96b395d137276adb34970e76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044975, "uuid": "80d95e7b-389e-4cf4-9d02-df48789a69f8", "comment": "Malware payload", "value": "1f64b0cc47952a5bd2ed175c75b23521f790a14e5a29afdcbb3a681afd7aa9bef78426e978bb411c182f7d3f459f32a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044975, "uuid": "43f9b1f1-3ec8-4426-bd90-eac45142e74e", "value": "T1EFE533B732B27E82DC5733F2A85C59624CF1095FCC482D2876CF968A157A6CC5BE7482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044975, "uuid": "3bb5e1a3-d2c1-4ccb-8ecb-ae876630bbfc", "value": "4fc7d580c9c9e24e3cf5a2b5a1a4d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044975, "uuid": "f3a4fa43-b259-4573-9bc6-e06497a0b3e6", "value": "49152:6yOj97Sf/eW0mKCvJXRdvnkh2U+zTDZm7iDnrWWQfZVq0Xd0mjY/kQbF1Bdtv:6a/nxJXHvnkh2ncifWWQ6m0/ZHBd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044975, "uuid": "e54cdc60-928f-4cd6-95e0-40321f097f15", "value": 3147408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044975, "uuid": "11fba537-c820-4439-9d23-d141c244086a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044975, "uuid": "dbbaa2c3-323d-48ce-8ba0-56ce949f9e79", "value": "20475c809f00840b49f662de6c9216ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421c49ef-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044770, "uuid": "5ce67038-6000-46d0-8c99-e249a0d91d87", "comment": "Malware payload", "value": "53fd6daae11a037422f2c66d32ea5456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044770, "uuid": "0ae30f69-eb1a-4fda-afaf-d3d93a80506a", "comment": "Malware payload", "value": "4dafdfbf52d678a0138311e426f4b5681b0adfcbf63eacf941040be1a1b62508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044770, "uuid": "a2d7980c-c49b-4bca-a2d4-3d203dbfb023", "comment": "Malware payload", "value": "629a6d2b7803359bf7d1b690e7667a6aa7df1d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044770, "uuid": "4ffe72b4-de56-4d2b-ad4f-e07d0972c17c", "comment": "Malware payload", "value": "e38a893d5ef16f0030c8652920244a4eb2f19d0239b622ec84a386621cc6f3dd1e9e9f41c9fead325f596828f0435228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044770, "uuid": "b2ae8d07-ade0-44d0-8d69-7f086ff8eed9", "value": "T1F9663329F7D4D09FDE6687B981D2D583F030FA29696082FF9760407A873B53C84B875A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044770, "uuid": "0924910b-c97a-4f83-b6ba-1f9a8b71a355", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044770, "uuid": "ae309072-5e6a-4147-812c-2d9fe3cd6bde", "value": "196608:PS1GQssKEXq5Spg/sxYkXZU9Tt7hg8VCPv89g7o:PSevEXe/sHZEng377", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044770, "uuid": "3b528e50-656e-4e60-8677-6b486572c438", "value": 6492160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044770, "uuid": "c50c1a4e-8258-49de-a16d-556eea4b738c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044770, "uuid": "7dc5a2b4-7cd5-4b90-ad9b-6b5c1a006af5", "value": "respondintegratepro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af05c776-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700044953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044953, "uuid": "2991f219-f996-4fdd-83a3-745e84c3095c", "comment": "Malware payload (AgentTesla)", "value": "16252016f9922916b06ba87604aaaa29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044953, "uuid": "860617f8-dd73-456f-b297-967b9dc6605a", "comment": "Malware payload (AgentTesla)", "value": "4dc4ade4ae2d4abc759ac2fd298eeca6a88f1669fb1f3e761c46d134b5620a0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044953, "uuid": "27da6007-2710-4336-9f3d-e5fcaca4a024", "comment": "Malware payload (AgentTesla)", "value": "b62f3c2dd5a988e0759b5a370e2a9e834ec9455f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044953, "uuid": "ab963651-1a3a-49ba-886d-731d7a23f8e8", "comment": "Malware payload (AgentTesla)", "value": "20442425836ae2cee7e3e2e3842aca284ca39cba1b30ea7dea4bb0532f24ac7751545937e0ea9e1dd936ab4d3772ca4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044953, "uuid": "5f703916-64dc-48dc-be08-ec19b9b4f72c", "value": "T1CD151703B5C7BDB6D74B673AC79704501B7DE8CAA613D78F2A8A23A928037776C01617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044953, "uuid": "bc0c1be5-297d-4018-a9ac-b3aa1a514e65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044953, "uuid": "8c8394b5-06f3-4ea1-a719-c075baaee4b5", "value": "24576:qvj9GdNMoG2EldfQ3qF30k7bMccUsV7cIC:xhG2E03Q0k7bEU87cIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044953, "uuid": "40ffec0e-978f-45a1-84b8-037920174e7a", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044953, "uuid": "9c2c7337-2a8c-4b91-bf26-ddd5c34e1e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044953, "uuid": "c8c29bf8-85c3-4b23-82d3-f9793e60cc71", "value": "16252016f9922916b06ba87604aaaa29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3df69d7-83c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058732, "uuid": "3d4e2208-4a01-46fd-acb0-88f35ba743ab", "comment": "Malware payload", "value": "7187e45130aad4086f2bc0ea5f0e7632", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058732, "uuid": "3fc4a94c-f888-4039-ad5c-01e2949c3b3d", "comment": "Malware payload", "value": "506bc39774eea82a02c20bce1ef02b751133eee9e512747c250d972124fef76b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058732, "uuid": "1adf1935-ff9e-4c80-ac97-e8c9ce671583", "comment": "Malware payload", "value": "e1c522ed3df2e57286c21f93ce514d763205c58e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058732, "uuid": "1f865413-60f4-4325-9f31-90c5aaa7a700", "comment": "Malware payload", "value": "c3d63b76d53d70367549b12cbdca0b50374bb32b270dd21491dacc9e985119b1fb5e7cc00acc71aa14105e4948022ffd", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058732, "uuid": "376439a5-4e6e-4166-a9a2-a0e7858d6248", "value": "T1FE04AF11759181BBDB9E223854FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058732, "uuid": "d7a0ca41-b527-42ab-8184-36dad3833383", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058732, "uuid": "e15a65bc-6a07-4cb8-967b-f85f4ad0ee77", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlL+bVaKoXAxOPYe:I74elpowsxizqyStZlpel5KyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058732, "uuid": "73a0a29f-6b7d-4103-9f84-abd5ccc3e8c7", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058732, "uuid": "45e0c60a-3ee8-4ea2-a06b-511fae57e068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058732, "uuid": "34dda26e-ff2d-441d-8fe8-a6293991e286", "value": "WCUtil_2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dbb188-8399-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1700040396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040396, "uuid": "4181bf2d-fb0e-4354-b531-b30c3ca3ae43", "comment": "Malware payload (CoinMiner)", "value": "353c5eea90146df6a9b9da98eee061c1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040396, "uuid": "a12a75f0-8b05-4b13-9d57-e96354e80b8b", "comment": "Malware payload (CoinMiner)", "value": "5082ed106ffd1f4f71e016e49b88c0e61d3ffd00f7860ebc4fa1406735cd84da", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040396, "uuid": "59de138e-76c6-4908-bc68-3c7e2bde38ca", "comment": "Malware payload (CoinMiner)", "value": "3d56349ebbf5bfa5a905390ed875c2662ef96784", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040396, "uuid": "51774d07-b050-43c8-9c98-9675b2acb81b", "comment": "Malware payload (CoinMiner)", "value": "b06116cc08f5ff5958cff633259f867710f968f7fed46fff12a9957cefb0bd1605e447e0a0f48fd8e3107c3e47b50d16", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040396, "uuid": "50b94611-8c90-4f02-af4b-ebf0d2a83f1d", "value": "T1BF9533DB102A78B0D2C055AFEF0E635AFC207179140BD65D6BCA0E9B4D9B94ADEF9304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040396, "uuid": "9410b76f-1d1d-4148-a60c-4ea6e60b9062", "value": "49152:ThIYq6jT4emAn8PKts8LQ6KErtTL6AMicF:GY3T4en20bLQ6KErt/6Xi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040396, "uuid": "8af3769a-92a2-4706-a2ae-9027116a3e2c", "value": 1912688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040396, "uuid": "ba59a988-458e-4145-b28f-6ca875dbd1f5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040396, "uuid": "ddec052a-53d1-4192-9c2c-7274a0040439", "value": "5082ed106ffd1f4f71e016e49b88c0e61d3ffd00f7860ebc4fa1406735cd84da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca797fc9-83f9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700081936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081936, "uuid": "a5a00783-09ca-4a9b-bd88-5f965b2b354f", "comment": "Malware payload (LummaStealer)", "value": "5f14285c9ddd66df2f9916727b6ea7ef", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081936, "uuid": "65cee375-aaff-4c0d-a54c-edd5f6941209", "comment": "Malware payload (LummaStealer)", "value": "55158d21359fab879f9154e3f999aa3c003e88895f89b2cdcb740070d250b7d1", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081936, "uuid": "c597e91d-776a-4b66-8a5c-ea9aee46af50", "comment": "Malware payload (LummaStealer)", "value": "8fb92ea1c023758ca6ebc5c89b0df3b0a7ecfb7a", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081936, "uuid": "a2ba2286-b91d-42e8-b43f-1056cc3fa4f6", "comment": "Malware payload (LummaStealer)", "value": "98618daf484e4e70a391d09029874909ab80e8936729fbe7bd51c3d7b0133dcf309b5a06e02a400322568944ba9104dd", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700081936, "uuid": "a644833b-68ac-4159-a292-95cf4c876df4", "value": "T1227633A8CE326C80551FF9D6CEE188F92CF28845781B0D871EED3767862B7947C6E524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700081936, "uuid": "23924d67-afe4-45f7-8d3c-c0b99842f9fa", "value": "196608:rTh0AU5oe0dbr1JwtFZpj2HCw3KRzO28pit5GPhNz:Z70oewbCFX1IKk28C5Grz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700081936, "uuid": "73eeb25c-fd8c-46e6-8b99-c1ec408baf04", "value": 7631138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700081936, "uuid": "696b1b00-c4d0-42e8-872f-42e6f7c24d5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700081936, "uuid": "d5214522-7b66-48c9-adfa-70acc8790109", "value": "5f14285c9ddd66df2f9916727b6ea7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a87176-8386-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700032232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032232, "uuid": "1417c870-9209-4908-98f9-b248f86a4f5a", "comment": "Malware payload", "value": "add560152155683fcda43f184dd2a5cd", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032232, "uuid": "0a9e9d3f-31f8-4595-87d8-f76a36a89159", "comment": "Malware payload", "value": "557e98b9d9d27da718e9ea7e20535535f3b0f796fe85a636eb14c418cc28c21a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032232, "uuid": "03a27928-6d85-40c2-a553-4f5daa286eb7", "comment": "Malware payload", "value": "67a51d06ec2e083afeabe6fb544876f7860bf078", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032232, "uuid": "e1587096-3136-4c32-a9e8-5d2398bb98d6", "comment": "Malware payload", "value": "42788f5fe6bb4f30c610aa9a372be413e527edaf7a36393bef0985302f590816973b2f57dc25f9c4ae508371a5e72d02", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032232, "uuid": "3b893661-4853-410d-a952-dd96bf2bee66", "value": "T1ECB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032232, "uuid": "37634ba5-44cd-4a3d-9cd5-666c6cb3454b", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032232, "uuid": "de5d1ce0-a0a1-413f-82b0-ba4de6e801a1", "value": "6144:aexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7IpUlLaEx:aeZeWSpda70ADIgSoxgUW/zFun7O4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700032232, "uuid": "8bf69cbb-bc48-49e2-83a7-95430283bd90", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700032232, "uuid": "b6eccada-31cb-4229-b7d9-92afa7028180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032232, "uuid": "60b2388c-4f75-41d4-a1b5-6dd295a04e2c", "value": "ricevuta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df95b6e-8400-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700084706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084706, "uuid": "460a4520-72af-4add-8f42-1d5f91d46c8f", "comment": "Malware payload (LummaStealer)", "value": "c51233a3b0cc2f9cbbeff772ee068238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084706, "uuid": "a8da6c71-bccd-4c9c-bb7f-08d9f4fd3d9e", "comment": "Malware payload (LummaStealer)", "value": "56f2f2548297d7b72af40b7898d1dabe2dcb8090388985b218f4452d1a9c6ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084706, "uuid": "c457ee4a-0a07-454f-a185-a652ed9bfe18", "comment": "Malware payload (LummaStealer)", "value": "c4762734094f38f2032edad4df4817363f7df304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084706, "uuid": "28a4a67c-d36f-4e97-9f68-b71c61e62917", "comment": "Malware payload (LummaStealer)", "value": "b39cc92181ec1ed4b05d6a3726636fd4fe8197eca3df50051e51cdc73c8802d088d33414a9c87085e3b31568ce01774a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084706, "uuid": "9cfa8fb6-9cea-4cf8-be9f-a31ccb6dbf7f", "value": "T1C467E021724AC12AD56A4DB0192C9BFBD12CAE657B7104CBB3DC3A2A5B747C31332E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084706, "uuid": "4c48d226-cbd2-4b52-9717-488aa4fd735e", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084706, "uuid": "3c6ce5eb-fa13-43ce-b336-20857dd6bb8e", "value": "786432:cfd+0AfrbXCStGd0ZiL+ew/k7mAonhybq3j:ed+0WrbDlZi6e1EEW3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700084706, "uuid": "b312d7d8-ed38-4c68-ac11-43c41b24271b", "value": 32573744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700084706, "uuid": "ea09100f-f518-4711-b26e-166d0181dd10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084706, "uuid": "1a94ce71-4fa2-458a-880b-795374497a8d", "value": "56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c36e78-83d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700065263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065263, "uuid": "69c80aa6-5b10-483a-b934-3c0560aa2f49", "comment": "Malware payload", "value": "440b5682f53ed3a554305b15e0e14579", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065263, "uuid": "14d93aa0-31d0-4ebb-85df-e7d5cc6d4848", "comment": "Malware payload", "value": "576f6ca3dae804a4f50f29d5e46731890f23998b77dd4bd0a5ef92ee58809bdb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065263, "uuid": "bc4fd8b7-06fd-47d4-8db6-cdbc90afda76", "comment": "Malware payload", "value": "3cf4a70c9f6110f462d56a866de8a5da4de872d1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065263, "uuid": "3a6e7c2d-7fa5-470d-a2b9-6f676367cd9f", "comment": "Malware payload", "value": "dbb4052c1024f2bab700a8e1d22133db84a902aaec6feed20d4f5b55c38fec29c5a7f1675a4a12a9dfbe24fc4d7cbad9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065263, "uuid": "332ee4e0-ffe3-48f9-85d2-531336a3fb77", "value": "T192E523353AB481C5CF7018B37A868B4BDF2559EAC2131B1A9B36B9ED8DD34803C651DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065263, "uuid": "112f96bf-e41c-4e5a-a1e9-ca63a7fceef5", "value": "49152:T7dBkp8ZJ7P+5xFV+X6jhjctT32I1+AC1NTGWWu23oK6OrzL8YoGQkrdlItlfOZj:vTkp8ZJj+L+KQhRcp1VGWnQrUYoG/rdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700065263, "uuid": "2ab315e3-3d09-4182-9350-470d4eeb060c", "value": 3107495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700065263, "uuid": "2f3cd092-030c-44c2-b324-79a7f620b5ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065263, "uuid": "5579088a-5600-43bc-aac9-8671e029c313", "value": "UAMXFAC356364431320.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0907f3d6-83f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700080323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700080323, "uuid": "9e43092a-ad21-4fd3-b227-b9ec8705e3f5", "comment": "Malware payload", "value": "693a1c35dd117816f92fc4acb491024c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700080323, "uuid": "226b5f35-f05f-4100-ab66-51b62e24911d", "comment": "Malware payload", "value": "5772ac53f3ea00ee06f592ea27fe7f119f2027de5dcf72005a35a4302eb2d524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700080323, "uuid": "b4f72ffc-4ba8-4ceb-b735-4f2350a6ad33", "comment": "Malware payload", "value": "604ad5b85fda7a52050fb07cb84225cd05d10fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700080323, "uuid": "5f03a13e-f795-40a4-9f48-44d2b13afac6", "comment": "Malware payload", "value": "53e15173df43e97076aa7653866239c40c0cca5e620b2d3179eb92a6a13fd4cf7980b5d4f439763fca8e68400b181a8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700080323, "uuid": "d79bc333-080b-45f3-bc42-9804d59f97a0", "value": "T13C763305A3A458EAF851853EC6CAC61AD6333A5623F0E58B079847B70F171AE4C3BF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700080323, "uuid": "cd2d3ce5-60cf-454b-936d-8a82101b9150", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700080323, "uuid": "eb9bf4fe-a915-484e-a6e2-d99355c49f35", "value": "98304:gxeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbVv9JTSPhlVtQo1fQ:gMYmOshoKMuIkhVastRL5Di3tKdSPJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700080323, "uuid": "2f6ae24d-1899-46e2-a466-7c32d85df275", "value": 7797231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700080323, "uuid": "1de6ed9a-7402-4339-bab0-203edf2e6250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700080323, "uuid": "bdce574e-56f5-412e-8697-e9a932011eb9", "value": "Built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69414129-838a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700034098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034098, "uuid": "1f6e69eb-c501-48ec-85c6-163566d62953", "comment": "Malware payload (AgentTesla)", "value": "dcd0c22da884579dc34ddf3579730bba", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034098, "uuid": "b692d933-cd01-4232-8676-6cff0d4b5275", "comment": "Malware payload (AgentTesla)", "value": "5841001fb1a91673e31a012d599cbad0e47c93c37beba3426e7fda17dcca5cd4", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034098, "uuid": "888b81d6-8faf-400d-9405-b425f9d5a7fb", "comment": "Malware payload (AgentTesla)", "value": "8950a02e997f7c93dc8105a5824d3be50eeeccb7", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034098, "uuid": "a675bdba-4868-488b-a62f-726d10d039df", "comment": "Malware payload (AgentTesla)", "value": "5ac57fb0dcb928203a643cdee8c349556575f2c468af0935188ea849ad83525badecd8eb8371cb42ae367ca2d4aacc04", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034098, "uuid": "9fb0a853-2e06-463c-976b-1d604f807fd2", "value": "T1A0B423E9193D48B50939DCDBCD86E7237A00DA8E665556978E066D4E300FCFB8FC8B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034098, "uuid": "8e710e84-c10b-4cdd-a92e-cc73e7614dbf", "value": "12288:hWa8ubCxBIft90fWxti4ohzpS1JBhIW7LHF3zcxcD:ga8H8n0fyiXfSLBhd3JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700034098, "uuid": "71397d6a-fdcf-4fb5-be7c-b4f88a8aee14", "value": 506908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700034098, "uuid": "5e0d026f-1f3b-4f68-ab7d-a425dfbfc833", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034098, "uuid": "d0622eda-5da5-43d8-a7c7-5ee4738febdb", "value": "REVISED INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743a4124-83c0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700057310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057310, "uuid": "7517a190-df88-4180-b780-8e27b6dec8e5", "comment": "Malware payload", "value": "3d7724d6a39457d93e448eaed03664f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057310, "uuid": "5367e0e8-7f6a-44fb-8323-93e40fe818cb", "comment": "Malware payload", "value": "588f49a1ba2f244d08911daaf351bc36ac8bffa5802eefe73a0ef1b7c4fc2a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057310, "uuid": "d789a342-6b23-4b31-9096-95eb3916e3a4", "comment": "Malware payload", "value": "d7cf00b272937fb06627ec742fd7e807dc826f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057310, "uuid": "64e7ae09-3414-49d3-97e2-008ea972e215", "comment": "Malware payload", "value": "38a83649e80cc89e43e4545d1f0cb889bc77d752efaea5a7af76a2935d4fa16e2c7a39038d9980b5acd54177967b9f8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057310, "uuid": "f55a8113-1a15-49b2-8052-93a5df3bffd8", "value": "T198443B8392D1BD50D91A8B73CE1ECEF8B61DF9508E497B662228AF6F14711F2D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057310, "uuid": "a1fc5edc-080c-4cb0-bc2a-7c6a51c7aed2", "value": "840e4842bc97c9779b45301f8bbeab2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057310, "uuid": "af2f189a-ee9c-4c78-8259-70a917d9a82a", "value": "3072:0rTRd31WYPLF8pG1L2ZEQaDDa+/u1TZ0Pb8RuZZ59:e3LF8pGnQqaV1TIb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700057310, "uuid": "7815b62b-7216-416a-a518-6e5abc3aa617", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700057310, "uuid": "9fdc4bb6-2033-4de2-a9a0-87840181ee57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057310, "uuid": "22560c1f-9ef2-499f-9502-fc97bbda8294", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bea5e6a-8399-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700040599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040599, "uuid": "25ba5bed-ed22-4163-94af-a5d95d22040a", "comment": "Malware payload", "value": "d7dc681fe6d716d435a7bf296ce80a74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040599, "uuid": "d0f4a164-6051-494a-b21f-dae976a8b2cd", "comment": "Malware payload", "value": "592f4ee0f178de6162247010bf85d4eaccfa123d8a26a9db120bea1e13a830cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040599, "uuid": "f90aa070-b8bb-449e-a20b-ec58029a147e", "comment": "Malware payload", "value": "788465757d7f7f0b3d07055668fb4f14c731173e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040599, "uuid": "41c037bc-0f61-4e91-b061-66ea90428d9f", "comment": "Malware payload", "value": "5a67190a99ebc095d09aba1fd4c9cced01598f510236f51b9a763a31eb882ba095608d1dba2eeffd7f39718ec6e1d4e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040599, "uuid": "699523ce-319a-49c5-a7ae-a0c73ae6ba72", "value": "T101D3121E6DA1E21E99083AB645FC8CEC9A4DACF35E334063733599D072505406BEA6FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040599, "uuid": "0d12b1fc-d896-49c8-b804-539139f93081", "value": "3072:4vPrtTWGIEnLp8MBfJoR2w+ROInk54QkC5RES3x9E2mSY2iwg1:WPJSlELp8MkR9+RhkeQtRB9oz2iL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040599, "uuid": "c1522e90-fb32-481a-8e3e-ba480a36d238", "value": 132566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040599, "uuid": "e5ff2672-fc0d-4c57-8a68-1b9715b28db3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040599, "uuid": "92ade883-b877-40b5-9042-a4b13a90e870", "value": "OM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268e246d-8368-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700019384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019384, "uuid": "4ee97725-f886-4690-9b63-20ab13daa46c", "comment": "Malware payload (Gafgyt)", "value": "3c596fe907f6b7a93f1b332eeb02b4f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019384, "uuid": "75fde7fe-a5d8-4153-8550-54f755ed9dee", "comment": "Malware payload (Gafgyt)", "value": "5ae7b28dbd86a21f6686e0db77f06536e9a090569e78b0d60e9c924dacc3b7e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019384, "uuid": "3b17eb16-fac6-4392-bf3b-35d5d7ad1313", "comment": "Malware payload (Gafgyt)", "value": "8420183601ee6a0fb7cd6ee6c1588c5825e69749", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019384, "uuid": "b9126c02-2515-470b-a7b3-b32e611d21ed", "comment": "Malware payload (Gafgyt)", "value": "dcbed81dd05f6484890cedcaf366e8f45074e1dd48d6cc61de7a795126048aa54efe3074f735275903b1dd526ab0b500", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019384, "uuid": "271c6a52-6d67-4a51-8a15-df5b3cde1e2d", "value": "T1F7B32A17B9528B12C1C215B6FB4E564976136BFCE3EF3212C9249F603B874EB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019384, "uuid": "05203ee5-81b8-4464-b415-a449ccc2a2d9", "value": "1536:yLnB+R4uILdnu8HUULQh+O3a/1T/TIpPtMbiXfM6RJZf6jRS5yYL5hFp4Bvr:ohu43GatTmfM6RJZf6jwQa5hFp4lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700019384, "uuid": "3bb6ebe5-bca1-4257-82b7-a0786aec8aea", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700019384, "uuid": "e65cd350-ac2a-4e35-9fe4-ef2ffa47ac82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019384, "uuid": "1054b8cd-e54d-4ad4-953a-1959a3206a63", "value": "3c596fe907f6b7a93f1b332eeb02b4f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3f0e4e-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044952, "uuid": "9b1c3467-42a0-4732-b851-036a51bbbc7f", "comment": "Malware payload", "value": "2ade9b0e5326edf615e5ac1afb13e014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044952, "uuid": "f4b1e6c0-fe99-4e58-89e8-542269c5f04f", "comment": "Malware payload", "value": "5bba406a5a9d3739ec90e3d6d5e619c849807e6e8d50d80ff80f7a34bb4b30a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044952, "uuid": "4e833b5f-2a22-49a8-854f-a532ec2befda", "comment": "Malware payload", "value": "b8e14f94c3d4af5c5c91082a2d0fada0ad44382a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044952, "uuid": "c86ae4ac-3a53-47d5-ae5a-e804846882e0", "comment": "Malware payload", "value": "1da437993f400eedff8ef543035e534e1a62eafe86af05a48bcac20a9b7d7671d827138c2865da5fac0db05fde0149ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044952, "uuid": "17b67e38-ae27-4796-bf6a-924b0f436eda", "value": "T144F73331728AC13BD5AA05B02A6CDBAF5138BEB10F7540D7A3D85E6E18B59C25731F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044952, "uuid": "acf43c9e-4c95-413d-ab4a-b3badcaf6344", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044952, "uuid": "e35eba9b-c38d-4576-8d74-d5ce33b4d336", "value": "1572864:9rlqhpZD0kekSjofjyjsUSnSTt2mjN6LIFTtAmriZnO:JlqzpykSjobmsUQC0mjN6QbsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044952, "uuid": "3e20b435-7dc8-45c3-9ec0-3e2074392c87", "value": 70564740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044952, "uuid": "6470abb0-c5f4-4232-9e24-5e6706e9a2ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044952, "uuid": "9a14ac3c-f635-4da8-826d-6b772e0a73fe", "value": "BleakFaithForsaken_TRYamaKurulum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f16526a-838b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700034457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034457, "uuid": "92b35966-3369-4a1e-824e-92aef424ec29", "comment": "Malware payload", "value": "c60d5f6981d35d08ae507afc05ad69ac", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034457, "uuid": "32431304-4511-44e6-8150-11874a691ab6", "comment": "Malware payload", "value": "5c0648b12fb91cec066bacc899059921f9044f06c5c161b3e16274f3c9228ac1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034457, "uuid": "0f6a0a7b-b443-4a29-9666-538ba0f21252", "comment": "Malware payload", "value": "6dd0fa3d0433cc3f7fcdd1100398d5aa04f012e7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034457, "uuid": "1e296913-f4d5-44e7-b893-65bd90dbb8f3", "comment": "Malware payload", "value": "bbe229e0ede58243c21ad8291da8f4db89b36a2b89c435946a3c0842ba013400270b3f2d2b881d38cb7e7d39b87a361c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034457, "uuid": "6fbc6691-9bc5-499e-9ad8-fde38cd11b5b", "value": "T1F2C4232C33B82C453CCA93680B1D1E5DABB75E1D2C85B263268DE23F3C6F3791961246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034457, "uuid": "5fb1e9e9-4dda-41bf-ba13-b39138c11c3f", "value": "12288:sfkI8v2EBYYE/E4ZYQt/M2MrI4UgHohgQtnGjbgL:x2zj/1Nq84UgHoN+UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700034457, "uuid": "4158fb19-4086-4094-987c-bbba39775aa0", "value": 546710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700034457, "uuid": "cce1c3d6-5108-4588-b9bd-01d5aa45ce16", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034457, "uuid": "7de75ec5-7746-4102-865d-310095b0d2c0", "value": "Confirm.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78fdfef-839d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700042390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042390, "uuid": "4fc5d8ad-a5eb-4554-b335-83de24c04ba0", "comment": "Malware payload", "value": "650bbc84da16652d3ffcd7230a34bd5b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042390, "uuid": "7aa0be7e-9188-4534-8bc2-b9d2f6f70f9e", "comment": "Malware payload", "value": "5cc6b31669023b1f74191cc76d25924fb652a19c92eb3bef80d176304b0cee1a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042390, "uuid": "ae8c7c03-8bc8-4436-bb66-e7e409e23ed1", "comment": "Malware payload", "value": "02b101e1fe0e7ab6683959c5e60892ec839bfdc5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042390, "uuid": "cffb8abf-7155-424b-b127-6312cc974bcf", "comment": "Malware payload", "value": "93f53134f35aeb517c71b7df72da3d6c3006df6e954b1321331dee6ae98e9741f0e1b893995f1c552e1e48f3944b95d4", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042390, "uuid": "90f2713c-0bcf-4cf5-889c-69051b8d065f", "value": "T1B204AF11759181BBDB9E223454FE6F3AABBDA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042390, "uuid": "83a4b100-0b55-4f73-9dd1-63b64dd095e9", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042390, "uuid": "3c472bb2-46c0-49a1-bb66-8039a26e8ccb", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLQbVaKoXAxOPYe:I74elpowsxizqyStZlpel58yAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700042390, "uuid": "bb05e70d-d836-414c-9582-1ba888eaa7d1", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700042390, "uuid": "dcb4479f-dd02-4127-a907-37b3cf425c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042390, "uuid": "8d882c9d-0753-4b78-beca-b5441c9c10a2", "value": "WCUtil.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde4853f-8397-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700039851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039851, "uuid": "a93e7b0c-75a8-4dc5-9328-373c93132e58", "comment": "Malware payload (AgentTesla)", "value": "4d990706b21eba76212f69892348f5b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039851, "uuid": "3383f0da-8868-48e9-a0f4-c8061157ea8d", "comment": "Malware payload (AgentTesla)", "value": "5e32a7b5320ee9b3277092e547033be4d247629a4cfe396c19ed326bc2063210", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039851, "uuid": "d13c71f5-52af-4a6b-9f92-4cd88757d99f", "comment": "Malware payload (AgentTesla)", "value": "0eb6970c848fb25f1f19695cf92f7066c0ec3b4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039851, "uuid": "3e3c7bb5-5f66-413f-9ff1-3706334694ee", "comment": "Malware payload (AgentTesla)", "value": "2a01666d8307aa29e4a26ec64abad6edc55996ec4424fc5bb35d7bb7b7043cb1455139134ec0a41c9d78bc1ca7f6f70b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039851, "uuid": "92e8d4b9-856b-4e00-b987-182cef2950cc", "value": "T146F4F0003A74AE13CBE146F81B6624AC77F03D5691A2CBF91FA2B18E74F1F305649697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039851, "uuid": "3c1be4e3-43e5-4b8b-a835-d38829432a8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039851, "uuid": "fb405d1e-a448-468d-bd65-99117e3a360f", "value": "12288:wDPVSeYuPTEs1h90TjJeaYOfUCzNRJOcttiVYWVT70PY0j9WB:EPdjTtUx0jCB7xtiVYW5hE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700039851, "uuid": "07a98c98-7a44-4e94-b3e7-2a8207ca7d9e", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700039851, "uuid": "85babce3-2d9d-4dfb-b3b1-5a0160c7f84c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039851, "uuid": "fca242c8-0a6d-454a-84f7-8c1ec1e0b7fa", "value": "SecuriteInfo.com.Win32.PWSX-gen.21245.4967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26f0eca-835a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700013605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013605, "uuid": "7ceefb8d-15ff-4ddd-903c-16f749dee760", "comment": "Malware payload (RedLineStealer)", "value": "5827c59b768fa67664dc3134054ae481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013605, "uuid": "dc199760-fbb9-4630-a347-3edd35ebc59a", "comment": "Malware payload (RedLineStealer)", "value": "5f718ca24fcd480d7daad2d100dd55b7491c8704765b1fefc09884b3e1f31ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013605, "uuid": "e3fc08a1-147f-46c0-8c1e-ff4dbc12bcbe", "comment": "Malware payload (RedLineStealer)", "value": "ad1c633f1cee7dd9b729a227f15dfd95d820dc0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013605, "uuid": "67d31d07-dffd-4491-9941-5f48dfaf20ae", "comment": "Malware payload (RedLineStealer)", "value": "e64bb37204e0ef4cdf54fc0baaca75ddd75ea4a10ef70b5365d45607cefaa29a3a46706bf9c4f75edea97af474d432e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013605, "uuid": "fe8fa456-49a2-45bf-adce-86b44f3f51fd", "value": "T17C152347B6D49172DD7A5F700CFE13831A397DA24EB482EB2344286E1CB3694E939727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013605, "uuid": "2db0e21e-c4fa-40b0-b590-d1e742b20d0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013605, "uuid": "a89a976b-274b-48cc-ae7f-feaf7647caa7", "value": "12288:8MrDy90hOZ2s5Ze9aJLpOE0gVN7qPYFYg7PArEEowgM5NF7d34WThbPzIPSms1Z:Xydo+8kJtB4raPAr1gM5NtVVbP8AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700013605, "uuid": "e12c2bb5-1d0c-499e-a895-89563d707ed0", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700013605, "uuid": "d6f329e4-df19-4637-8f93-95e51ab8e57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013605, "uuid": "50775502-eb36-4ac5-9bc3-b28a13001cdf", "value": "5827c59b768fa67664dc3134054ae481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c4f461-839e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700042760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042760, "uuid": "37285f98-e324-49a0-a708-f602e212349a", "comment": "Malware payload", "value": "3c56490b2df39d138ca1ca9a4d45e19c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042760, "uuid": "c44970d8-bc1f-4d7c-a629-730a90f11341", "comment": "Malware payload", "value": "6006d9cff2c3f472eeb4ca93ecf66a5e77014079508b6b0e75e1d58a0335ff62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042760, "uuid": "056b0777-c1ec-4695-9702-61a9a608b50d", "comment": "Malware payload", "value": "68bf0574b96a7df8f4423b7202ba8a334e87d3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042760, "uuid": "1965edc3-62a4-41ca-aebc-08b78dea850b", "comment": "Malware payload", "value": "5a2720ea1f7cae3c891a61230f806860b3897bd8a77ecc451ee985a135177927b90a410c0a818578837b0284b98e1c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042760, "uuid": "c143ca8e-2f4b-4335-b66b-acd2862da952", "value": "T1E1F73331B387C53BD5AA05B02A2CDB9F5129BEB10B7180D7A3D85E6E18B59C25731F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042760, "uuid": "9a52f377-1187-4381-b8b0-3272fe501a40", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042760, "uuid": "b21811b5-88e8-4856-ba08-bf125723a5a6", "value": "1572864:eilqhpZDzkekSjofjyjsUSnSTt2mjN6LIFTtAmriZnX:Rlqzp7kSjobmsUQC0mjN6QbsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700042760, "uuid": "5c1f5210-6f99-49b4-923c-d92cc5f3846e", "value": 70543738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700042760, "uuid": "fbd8c34a-d642-49cf-a82a-b650aab8edeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042760, "uuid": "5daf93bf-e761-4fc8-813f-2b7b33b688d9", "value": "AgeofWonders4 T\u00fcrk\u00e7e Yama Kurulumu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e11948f-83a2-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700044361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044361, "uuid": "7cdc0b0e-26ff-4339-8034-cacc4f50d8b6", "comment": "Malware payload (Formbook)", "value": "70e945a96fc82397818d4e4000cba994", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044361, "uuid": "43ae8eb9-ac80-4f80-93a3-f6d574a5473c", "comment": "Malware payload (Formbook)", "value": "60fe320605a391dfcf6d163eb7bdd40764ce436855d9f23250cf7e80966679f6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044361, "uuid": "1f2b1ca9-c396-4341-b1c0-4841a028b8ea", "comment": "Malware payload (Formbook)", "value": "67652511223e720824752014067c115b57eff0ee", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044361, "uuid": "081f21fc-a00b-4ef2-80bd-b878b8b54454", "comment": "Malware payload (Formbook)", "value": "1e52adcc06fc849301b8ccf01531a9b311f24da225fd8ce0492cbd9249a55dc6d389a7b0a5a29697a93b1b444780d80e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044361, "uuid": "348a13a2-d810-4644-abb5-6d31dad1bdd6", "value": "T1C75533A0CBD1F05C0A6707684C5BDFA1C7892E8E272582955F5CAAC6E35EBF111EB433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044361, "uuid": "0b5bff24-98b5-43df-b9f2-1de054dddfa8", "value": "24576:+7Y00NX5ct5Y9vyG2QsP0L2PuAwk6zVVBw27CJv9Mu9eZuBxFPCBF1Y3/UwPFcT:+7n0NX5gtG+CyOk6zVVBzOJvWuHBKB4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044361, "uuid": "e2ae7883-6c1c-4cb1-8cdd-4a29ab81bcf0", "value": 1385072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044361, "uuid": "082dcf59-094b-42de-a651-70e904675aec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044361, "uuid": "2fc9ee3d-5a1b-4f78-b883-604417bda15f", "value": "Bank Receipt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c7fa70-8387-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700032677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032677, "uuid": "48a64ab7-dab0-4cba-8c42-2d60585a45f4", "comment": "Malware payload (Formbook)", "value": "ded48ea6682f8f29cb3486111e54279b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032677, "uuid": "ddb5ecb8-481e-4c47-8d33-ed351bb1c586", "comment": "Malware payload (Formbook)", "value": "6282a84266a87aa1e62b1304913bfdc8ce4c122f59f5731503f78655beaaa27e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032677, "uuid": "c0760cb2-5ce3-4a84-8770-cd5eeca476e0", "comment": "Malware payload (Formbook)", "value": "a9209dceca3d007846f487bce01fa02de0e0b4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032677, "uuid": "482edcd7-beed-4ef9-af97-1f83bee02791", "comment": "Malware payload (Formbook)", "value": "2c374fb86b301b095e0d58831066d73900bbbac34a3dd14c68945897dc506fb53608e19294c682d055fdaf59431933c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032677, "uuid": "5fce9a1f-60f1-4b1e-a307-0084a05876fb", "value": "T15984E041FE9CAF12D87587F698E6601217F269893176D88E3DCA24EBD035B0319C2F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032677, "uuid": "08b9f4ce-d078-44f1-91aa-23536df3cc33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032677, "uuid": "3d9a0a88-3b9f-42fe-a6ee-5bb97c407d02", "value": "6144:5Dmad57XeKl33j30xq6L4gWTWv/cbq3iR6HzTaFh++zXDDcHd8QQw1Jw1g3:5KD5L4gaWvkbqSRGWsIadoW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700032677, "uuid": "1e59a0ba-1afc-49e7-8cf9-4792305ba1ae", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700032677, "uuid": "4910de1b-8712-40d1-be77-6efba841b377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032677, "uuid": "c6ab06b9-d3fb-4c58-9d1a-1110198fed19", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.62.14069.25378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703f68c5-83c4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700059021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059021, "uuid": "0056df85-2d4c-48ed-8a4e-c32046962020", "comment": "Malware payload (AgentTesla)", "value": "f1f4e44db60a703626fbec7f85cc134e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059021, "uuid": "31e7fae9-c85f-46bd-bb44-f9ad3140d507", "comment": "Malware payload (AgentTesla)", "value": "6398b922ae61c54c8ccc93725d584c8e3f0c3005716cd21fd63fb79e3bc78836", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059021, "uuid": "a8987221-f82b-4e17-998d-acbfba7abeb8", "comment": "Malware payload (AgentTesla)", "value": "33aec5ec1bdfdf55b4b0f53eed4633322a155e07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059021, "uuid": "33d76f28-047d-4ab6-a685-d02a1829eb50", "comment": "Malware payload (AgentTesla)", "value": "5c6e71aa3a9fc374b0b28b575e92b351c7d3a3e7548b4243e513e8eda69c453f13567f34319abe05bb2029200a0192fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059021, "uuid": "5a7bb3d8-3d2d-4a20-a2d5-89e7838a34ee", "value": "T1CE454ABF6A881123C4B9D7B383B3A422F17B8CA7753A9E2D24D6F5910773A4234C561D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059021, "uuid": "85cd7eed-1a6a-4d3c-b3d5-8ef05ab5cdd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059021, "uuid": "7161d45c-dfcd-4c83-ac68-2c4774434a78", "value": "24576:e0/2xXHPeR1C4PcEJ902Ai+ShpP8rnI4zPE60:qxXHPeR15cEJbTvsnI4f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059021, "uuid": "9cc6dac0-0116-46a7-b2e1-4deecb8b1356", "value": 1251328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059021, "uuid": "ba55c60a-add7-4bea-a6a8-e2e0264d2a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059021, "uuid": "17509e0e-455c-4cc5-9cfa-27dab8303403", "value": "ATTACHED INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a6d541-83b7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700053626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053626, "uuid": "b70784ad-fdc4-474e-bffa-6668a166c92f", "comment": "Malware payload (AgentTesla)", "value": "73bf50ef38ecadff4e120a31ad00c747", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053626, "uuid": "3e863ada-62da-433a-b342-f637ae97ee66", "comment": "Malware payload (AgentTesla)", "value": "64cf760478ae702e8157d46821cfdb8fad6ac6bf640b511ca736d7315db70632", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053626, "uuid": "d9b72a08-a6b8-42b3-aa04-21e4efd85073", "comment": "Malware payload (AgentTesla)", "value": "295d4c63e6e06f332abc9bcd63fdc791a28106f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053626, "uuid": "06058cc1-b45f-44a9-abf6-c106ab5d9acf", "comment": "Malware payload (AgentTesla)", "value": "bd354e08b8a230e1db9c6893c44b68c3a5d15e35c1c7355a1283b34acf9ff243979b273e8966f208d0e785c77d0ad21b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700053626, "uuid": "c7de7e7c-795d-4109-9524-275ae4aabedc", "value": "T11EF5493DBD818976DEBD19F285EF442879D9D4432310E64A369981CF920CFE2A24D3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700053626, "uuid": "d88dacfb-c42d-4981-a1d2-359ee7734473", "value": "49152:srtlvkg7SLN0vG1YThBRon856UwdeOJe+x0FkCJY7gmpYRt77M9oRSAS/t0IcZID:sr6VChQV+FYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700053626, "uuid": "6fc42819-12ac-4481-909c-3e432acf9e02", "value": 3419136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700053626, "uuid": "40db4b32-5ae4-4728-a2b6-63202952c379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700053626, "uuid": "06975789-45ef-4689-9d82-7985d1099e3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead3a601-8395-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700039040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039040, "uuid": "1fd5e958-b5ca-405d-a7d8-83fae1aadb95", "comment": "Malware payload", "value": "4c274edd504d87e4e76cf31e1105ec18", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039040, "uuid": "784088ae-0952-4ed5-a398-6e7bc21b85a7", "comment": "Malware payload", "value": "65cf59b3533759dd226925d14d2923b4ff5e6077518af382552cc01c6d98bafe", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039040, "uuid": "799d00b9-68ca-40eb-8152-286ac09fa0e9", "comment": "Malware payload", "value": "7ee937735f0c5e253b559cb7f9efa8a212c735a5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039040, "uuid": "07561521-275a-4bb0-a56b-400829f621f9", "comment": "Malware payload", "value": "88c844f2cd55c06bb0265e6e4b630d0eee70f3df2d946ca8208da46ee89375740bcba1e007f966dd226b9883f1fcb07d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039040, "uuid": "c7a2650d-e53f-4c6d-9582-7219985c7e1f", "value": "T115E02B375234154AF5E3C9F414C313607B61478A0D503A4FC8F65C590FD67987AD46A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039040, "uuid": "b4dc05ae-42d0-48dd-96e4-62fa42aa50ec", "value": "6:5juSa+wqmUBr5V+2C7Ue6sacgs2hoOS93xHX7+NrtmSodpn7t+lL:5j5POG5RC7lzIs7OO30Nnozn7taL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700039040, "uuid": "a39127b7-f11c-4c79-9bf5-874d2fb9885c", "value": 327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700039040, "uuid": "37f50746-05ed-465a-aa00-400fa9e67e0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039040, "uuid": "1a87f497-d7ef-483e-ab1e-a9910a64afe2", "value": "Direzione.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0287599-83b4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700052256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052256, "uuid": "ddc1d472-a8b2-4964-b5ad-bf2c515e5374", "comment": "Malware payload", "value": "566f32b6efa38db0387c3d7ddc79dcf0", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052256, "uuid": "f2c500fc-f45a-42ea-a80a-46a96659ace3", "comment": "Malware payload", "value": "686d46dc014ea066ed05b568eacffa901ab77f09ea65773ecd7ce8daed8b6b14", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052256, "uuid": "d8366ba1-3e77-4cc2-8532-a460189ebd94", "comment": "Malware payload", "value": "e88094d036bb8785eb231a55f9edae715f95150e", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700052256, "uuid": "405eda28-28c6-4d1a-a6f6-dc9210561ee9", "comment": "Malware payload", "value": "bf0a54fd10504b1ec96f2e807032188b149f0e95ffb10f0de38d78ff6c7804208ecc07431522daaa2b91c4e4f064772c", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052256, "uuid": "a8844a70-e473-4eb3-9734-9bae55f7e4ba", "value": "T12C552AD077DB3094E1BBD53996B26A06D6B978420B30C5DF82E44F7A3A1A7E14A37313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052256, "uuid": "e80ccb66-a022-49f3-943d-31652c1c38e5", "value": "328b4ac4d1afb89d758e47d97f88032f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052256, "uuid": "b6eb0d91-747e-4b0c-a6d8-b419d5a75fe2", "value": "12288:HMrhNeSmH9L93yGSpFFsewE9sYKGBKbVjDdXz/NYn9BCqBEkyDoi4XmeLdKBD6E:unmH9L9JSpFFseFgl5zqn9BCqexDdiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700052256, "uuid": "86185f49-36c0-462a-81d6-bc76ab0c9101", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700052256, "uuid": "8ec83bdc-5c36-4cb5-85f3-32246514afa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700052256, "uuid": "b37324d6-eaed-45d8-ab53-bed5ed396b21", "value": "nViewMain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1905084-8396-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700039347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039347, "uuid": "e33c1292-1fd0-4963-82a6-5a2d7d26d74e", "comment": "Malware payload", "value": "6c74434be600f6ee9562ee6ba3b3243a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039347, "uuid": "7879200c-d31e-4747-872d-ff3134c91701", "comment": "Malware payload", "value": "6927a9e73bf55a3401c967648cfc9f0d1d6cbf7cf452dd483620992d7d8b34e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039347, "uuid": "616d3522-bb74-456c-b7bf-cf4e3dc39b36", "comment": "Malware payload", "value": "4b7c6ef7a99237c4790fd0d7ba9caaf09068ae31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039347, "uuid": "1ce8ca5f-d7bc-4f8b-928d-2b60532598ea", "comment": "Malware payload", "value": "90299e1a4c9c1fc892f04463118fec6dda0e22a50e0a717810ea5bd8e0a048221d0cca7b3edf28e7409f960771e5b434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039347, "uuid": "db9b54ed-348f-48ae-9c50-dcd248019007", "value": "T11F45C413BB46AAA6C1682737D7A6040D9370D9C92313DB0B798B3B6F489B3F6DD05607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039347, "uuid": "bb3a0ff9-6896-4125-b474-0a86684d063e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039347, "uuid": "e53c7aca-4c06-498b-a5e4-7e6fdc1d0494", "value": "24576:bFlHhi23uAT7U2eL36rJiaacsxwT2UwPiKaam22wRKNn+kfG3M6EYmVtQ7aTUnly:bFlHhi23uAT7U2S36rAaacsxwT2UwPij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700039347, "uuid": "151e1fb4-8d63-4a22-a995-5b8fd78e60bc", "value": 1276408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700039347, "uuid": "fdc0cdfe-d137-4248-9c09-76664d6bd9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039347, "uuid": "0d037e0a-50eb-454d-864e-a5bd5e3d8f9f", "value": "Doc04807910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c75aa9-83b0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700050553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050553, "uuid": "6add6411-3a77-41b7-b122-27c7e594bd0d", "comment": "Malware payload", "value": "b08e10c0b362d383c81558358b1debf1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050553, "uuid": "553bcc2d-4768-4ca8-86c3-fd4449f92465", "comment": "Malware payload", "value": "694b86530d202beb35223e351fe7cf8d5221b8b61b9326571039451a76272564", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050553, "uuid": "6df20ab3-103f-49fc-8caa-26e415ef0cbe", "comment": "Malware payload", "value": "11217cd6dab81ed8368ea1b05479c5dd322e1265", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050553, "uuid": "3ccf116e-9905-4ba0-81ac-c115077169bc", "comment": "Malware payload", "value": "8548bcd6604a4b3b194ebbc430eb12da75d91d27b14f70d94120c274c924bea867178abafc51107d7415b94a12cc1161", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050553, "uuid": "128a0824-7f4e-4374-9ea4-8977e9713dda", "value": "T13DB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050553, "uuid": "c7885958-df6e-435d-ac13-762d210b0d37", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050553, "uuid": "8b079bf8-c160-4870-9cbf-355e7197107a", "value": "6144:HexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7UpUlLaEx:HeZeWSpda70ADIgSoxgUW/zFun7OMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700050553, "uuid": "ca428851-8e3f-41d6-a416-2d8cb5a15413", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700050553, "uuid": "f5aa1185-2774-4570-a03d-5cf2a72f0b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050553, "uuid": "a6134841-702d-40a9-8b61-ef7655a09202", "value": "interess.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d270a89-838a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700034105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034105, "uuid": "695561c7-263a-4a35-b1ee-9db9ebad0947", "comment": "Malware payload (AgentTesla)", "value": "f7909654bec25f9a549014a7e6dc7503", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034105, "uuid": "97f8a9f2-1d53-4d81-9bdf-15b6e6e5089e", "comment": "Malware payload (AgentTesla)", "value": "69e82246e2a2444321ad9c8c84a445b8ec6b18702c2407565cae60e07b3823ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034105, "uuid": "cf3d1ccc-b305-4a6d-a246-c4abceb5156a", "comment": "Malware payload (AgentTesla)", "value": "0e380dd8adc77adc4e28c3da23e8e067d00ac06e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034105, "uuid": "72f758b9-c7ef-46d1-bf68-41ef0a8413de", "comment": "Malware payload (AgentTesla)", "value": "de9d20934d03bb9c37a58980ba450751317b91fe4f9db72b585a21d9467a1cb37e1eb5107b89ff1c8652de28771636b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034105, "uuid": "22aaeb2c-b281-4156-99e6-e95bfd97872a", "value": "T179E4D6BF3B8C213784B9D697C7A3E062F27BC8A7713A5E2524D3DA914687A0774C521C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034105, "uuid": "96060782-a0d0-43ce-a57e-e42e5342c289", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034105, "uuid": "64ea5b80-1d75-43ad-b7d9-3b62ed73adc8", "value": "12288:YgbCN/yfT90xWrti4mhhpqXJBhIW3fHF3zcZZ9Vjy4co:Y9QZ0xyirVqZBh93IZVjyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700034105, "uuid": "7e245a8e-afcf-4538-ae1a-f3ec1c1be293", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700034105, "uuid": "d22c9508-824e-42c3-9f4b-d1387f386b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034105, "uuid": "77ddd2e7-8dc2-43e3-9199-3aa4c916b6d8", "value": "REVISED INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca95034-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044681, "uuid": "f34d39b8-eb92-4a96-b24b-36979070b977", "comment": "Malware payload", "value": "5d855764241070eb52386b7a60e97fb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044681, "uuid": "2f16ea28-220c-4fab-8954-8c5e6f286231", "comment": "Malware payload", "value": "6c485e5e8e555eea6d9df398da467fc006baa7b621dcc8d87730b32b037e5525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044681, "uuid": "956c3013-f3d0-4a1e-b433-2b900838b6d8", "comment": "Malware payload", "value": "21fdc04beb6315910ebac73668adbe647d3a6f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044681, "uuid": "8b93ff71-3c30-43db-89be-eca0c9b4c171", "comment": "Malware payload", "value": "ddb5d3e947a436ac48aaeefbaf0be08ff5df34301c6b9ac05939255f897f558d9d4fff0caad9363cceb7594ebd344277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044681, "uuid": "87e72291-141d-4641-bbae-65b5748efcd0", "value": "T1C5960273F0DA2471F8732A36B8A21462393E189CE0472DA929B46BD7F972D4C4F47791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044681, "uuid": "48f88078-cb9f-443f-bda9-04d29dc9381d", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044681, "uuid": "42581ab6-e513-4a7c-b0c1-dfd21246d550", "value": "196608:wenDpF046F+7HSTVHJack+YlGlSRRbCvN:w+r0V+7H2acJYlTFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044681, "uuid": "401cba80-482d-4fc4-881c-ab703e5dfad4", "value": 8968524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044681, "uuid": "f011fd47-aab2-433b-8088-e6693cbfd84d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044681, "uuid": "688a0c61-ce69-45e2-870e-e18f652a3362", "value": "6c485e5e8e555eea6d9df398da467fc006baa7b621dcc8d87730b32b037e5525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674d2841-839c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700041826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041826, "uuid": "787457ca-03f0-4ced-aa2f-46f2a70aa5a2", "comment": "Malware payload", "value": "ac764c28bbaf5880051813e526d1f657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041826, "uuid": "0980b953-c394-402e-9f73-7743bafd7b0b", "comment": "Malware payload", "value": "6f40d5c35c41245183c6866fb0a4f8a60c5a70079213b1c76792c269f174364f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041826, "uuid": "65959a9b-0550-484b-8846-25f41ff50594", "comment": "Malware payload", "value": "c11cd7468479aba3f02ee0350213068bf80d1fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041826, "uuid": "f9b228e1-bab5-4f96-b7fd-536fdcf64ff9", "comment": "Malware payload", "value": "75dd0b10456ca2444ca0468713cd8ecf39a334d908ceec19c69d94f740d2f6b1f3617a065bef0e02721832eb747a723f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041826, "uuid": "3bef6ff9-0a2b-42af-94d5-3956684cc31d", "value": "T1C3343A8392D1FC50EB264B73EE2ECDE8B61DF9D09E497B662218AE5F04711F2D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041826, "uuid": "b7395fbd-c498-49e0-aa21-71ec307dc900", "value": "4548c55759faf298d7bd7ddf85a57818", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041826, "uuid": "6c873f57-0b2c-4808-b73d-69373d491229", "value": "3072:iAUmLbiaj14GNCJLbZ6+TcBcaEw4VpqKXE1G0zSAR25qwOqAA:lLbiK3NQfV2cVw4zEsEK5xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700041826, "uuid": "ac14d190-29af-44cc-a477-a08ed38c3c08", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700041826, "uuid": "4caf0ef7-9e5c-4890-b1ea-64c41eb764ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041826, "uuid": "bf10a91c-f7bc-40db-b346-2023d07556ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2937bf32-83c2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058043, "uuid": "4a562f80-e839-4251-b00f-53ac51e3596d", "comment": "Malware payload", "value": "741e485fd47d3e47423cb22747d76c99", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058043, "uuid": "bbb75b58-12eb-4ffc-81ff-09ab684d6a43", "comment": "Malware payload", "value": "70aa5561a87f3d07e2ade10726204db619f4370632d44bd9ff2b6619e4755803", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058043, "uuid": "685241bd-7148-4f5f-be6b-0f033abb684e", "comment": "Malware payload", "value": "1a7dbbdc449c5ded879aac5030b0ab5de79555d9", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058043, "uuid": "45aa0317-8190-47da-b150-8bdb5c962a8b", "comment": "Malware payload", "value": "fa1fd8f7fafc5e9a7d222ca59f8b104b998b81e1af15e8222358fe2b73de0b51a0197422c09ccd64dfc9861a4a1c75e5", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058043, "uuid": "e86257af-83f6-4a1f-979a-f1ccd02ec2ac", "value": "T1570523FBE5EC1410D65C9AE658998D2B3215ECC80C1359F85FE2FCE2DE5388BCA651C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058043, "uuid": "fb5f73d3-1c42-416a-ab0d-449d348ebd05", "value": "24576:gP0A4+wmevq1kk8NMeXlyPtvX6TfkohiSX9RsONS9jAjZ:/ukkgXlyP1qTMeii9RrQjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058043, "uuid": "126a64d9-4427-4727-a821-5eb96b8cce73", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058043, "uuid": "dfaebf19-273c-45b6-973e-cf035efb9830", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058043, "uuid": "55f9215d-30ad-42e0-8560-13a2c5bb190b", "value": "70aa5561a87f3d07e2ade10726204db619f4370632d44bd9ff2b6619e4755803.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d3036e-835b-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1700013767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013767, "uuid": "5cc5858f-4960-4190-9b8f-d3a6e8bc38bb", "comment": "Malware payload (Amadey)", "value": "501fa03f6abac7f44696927b21cfefb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013767, "uuid": "94d801fe-57b8-4823-8e9d-dff286900735", "comment": "Malware payload (Amadey)", "value": "755cbdd175e237a66a78ed70d9d8a39c8946a57e64c199be154b86f528671d51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013767, "uuid": "53fb21b3-9cea-4b22-b025-2b3e8f7c7e3e", "comment": "Malware payload (Amadey)", "value": "88776c7794a663b92c3e46944cc385431508c0db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013767, "uuid": "d2fea2fd-51bd-4e94-9886-bca0bafcf1d1", "comment": "Malware payload (Amadey)", "value": "dcedfd589ce73771415493c6f5056a23c0c21f1d65acfe82253b59934a1137668075e88b97808a1d5234c790a989efc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013767, "uuid": "e3adbe6d-7c1b-455b-95ca-be0702e40848", "value": "T182F53386ACC9098CD68899B44D92FC9CB6F96EBB0401C82C64F4B7CF9E7775415B62C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013767, "uuid": "13cfe607-ddd2-4e89-9349-9cd33ee0c0a7", "value": "5e1278a436b596fd9ce03147a33a3540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013767, "uuid": "fb5736d1-a88d-4706-83da-eeaa17e789b9", "value": "98304:JwlhearRNA71MktSQ6fOt8sYfpPhUWstcCCtOn+qVOOG5Wki:+lIoNVItAf7p5Up3OD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700013767, "uuid": "c6fae0c6-5c40-4c53-a348-0715e9966791", "value": 3492536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700013767, "uuid": "f0322362-5fdf-4b70-87ee-ed2b2b64ecc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013767, "uuid": "edcd685a-a89d-4a3e-b55a-17b238d16ddb", "value": "501fa03f6abac7f44696927b21cfefb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba8cfa7-83a8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700047175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047175, "uuid": "98929378-6485-4d36-9fdb-7c2a94b6ceee", "comment": "Malware payload", "value": "ccee963b42e78969f9c3db3d572cdd21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047175, "uuid": "a0ef2488-3c1d-4e86-8fba-1bf9e38d0d2b", "comment": "Malware payload", "value": "7639d10533c0fbbe7a72fbc584a77b48b2758d6b8e4587a6f2e78bb7dd715a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047175, "uuid": "96953cae-f3b7-4ce9-93d4-d8ee85e8ea7f", "comment": "Malware payload", "value": "340c399ac8cd9e1cacf3a11241270c122775d421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047175, "uuid": "4a708f96-fcf3-4bca-8de4-a8f83a41efc1", "comment": "Malware payload", "value": "264997b7f35ab09c1097ba670123b0544677cc1a2f00da98c729f23aca72f2dfe6945b09499d091c484bdd2d245fd2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047175, "uuid": "03d44301-b6f8-4615-ac93-70b3b628bae8", "value": "T1903623F954206841E26F577919D0E03E1B395DEE204A4989EFF37D4E14FB129AE00BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047175, "uuid": "16a8f28f-8593-418b-aa06-1ada7f56d8f4", "value": "44b2ab10f6e6f9292bf527ee803a6359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047175, "uuid": "01542e8e-c58b-415c-abe3-0d384efbbece", "value": "98304:zd0hyyQnIKBezmQA1ckiBp1eLeaGHiDpbwZkDQcESawLNZBOL3:5By9KovA1ckiTSGHiDKeMw5Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700047175, "uuid": "3732596c-ca1d-4a1c-a121-5437d32ca7ef", "value": 4935680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700047175, "uuid": "745f7784-f0fd-4f66-a832-e48a1eca34bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047175, "uuid": "7f11d276-e7b6-4e14-bdf2-ad3e34dada07", "value": "\u4fe1\u606f\u67e5\u8be2(3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88be5b1-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044969, "uuid": "edd0f430-4025-4d52-8089-4eca245f859c", "comment": "Malware payload", "value": "10becade76ccb8cbe488fddc823f7fbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044969, "uuid": "70199fa0-ea06-404b-bd3a-d3b485d8e9f5", "comment": "Malware payload", "value": "764e1d6e17b2bf3ff9beab19e067594d2a7f1fdcd9f3fe74031c11f650aa2f49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044969, "uuid": "5769076f-2595-4940-be2a-2cf1be2e24b5", "comment": "Malware payload", "value": "17a58fd39584c3e01bf4738501ecd3b03f3f8b7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044969, "uuid": "3e54642d-a00f-4d13-8c44-a91abde9c121", "comment": "Malware payload", "value": "9050b65b51de36d228f6ef35bdf0f4f7cbaf5bca88672d2cd3843468fb1eed8c9d8dcb31f6575d34ee1233b4b50a8f1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044969, "uuid": "ec644c62-48c2-48a2-ab8d-10257d9109f3", "value": "T18055C503B6469AE2C16E1B7BD69B481C8771D5C26313EB1F798A336988C37BB7D01607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044969, "uuid": "b4790eb0-0bb8-4d9d-aeda-cf928e5d2a92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044969, "uuid": "3296a252-de80-4bdf-bb48-42103ccca024", "value": "12288:cMtMdjmbosv6p0RiNR9YKWjJCMOv8C3HsUW/2R/wdWJSk+FZqkoYusdMcpB89LuH:RpKRmI3HsUWyYcJe27Gwh5XrLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044969, "uuid": "6d21fb2b-6d8c-4b63-b2d4-9097fb0fe3c7", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044969, "uuid": "e58aab26-e3bf-4eab-b456-7d2c236b3a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044969, "uuid": "903d30e0-289a-44fe-8b8d-9ebe60754c3f", "value": "10becade76ccb8cbe488fddc823f7fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee50921-834f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700008714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008714, "uuid": "dfed200f-c05e-4dad-a311-df73332e0e81", "comment": "Malware payload (AgentTesla)", "value": "8bb3726b8ecf0897aaf8f5704398c2af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008714, "uuid": "0da27ca5-840a-43d1-9712-44abc89b189b", "comment": "Malware payload (AgentTesla)", "value": "777c4e75052752ee1f5ccad536e28dc1bc5d8436892bbbcc86a7cf69d581ab8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008714, "uuid": "e5248e27-13be-4b34-8173-398a5413e90f", "comment": "Malware payload (AgentTesla)", "value": "df43668c9ee44766a3394b8946c01e961d796efd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008714, "uuid": "b54ed0f6-fe50-46af-b37a-354e93ce5246", "comment": "Malware payload (AgentTesla)", "value": "53654ba8360dd69ee7e076c4e5a1d8b2d245d6e17b33e866ebe964deb8494ade2a17bc1f6bb34af2bc47433d262028fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008714, "uuid": "42274d3a-30c9-4715-ac7d-c046727b8785", "value": "T1F5F407BF7B8C213780B9D697C3A3E062F27F88A7713A5E2524D3DA954687A0774C521C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008714, "uuid": "b05fb9e9-9254-4c8f-bcd8-0f555d36ca7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008714, "uuid": "41c2bb09-e7a8-479c-98b4-b312a208b3d2", "value": "12288:GhH02ThB9qnzKuGA2NHKGEuvRmVrrA5sQqnCtycaWmo:GhH7vsGhNq4RmV45bqcaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700008714, "uuid": "7907e364-bd78-45b0-9dde-56304c16a3b4", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700008714, "uuid": "60dd63b6-07eb-41e0-8d64-1c8e1a39293b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008714, "uuid": "00edcd42-d23d-4d81-8ada-80fc8cfcec2c", "value": "SecuriteInfo.com.Win32.RATX-gen.15364.16234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7d36ac-83cb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700062107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062107, "uuid": "70c0c790-2741-4bc0-a3ab-50a86a18b3a0", "comment": "Malware payload", "value": "aa212d5fe64ee85db450ffb3b1019751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062107, "uuid": "a7729648-de31-493a-b9ee-6081a925cd98", "comment": "Malware payload", "value": "78a194ef979ef86b3001e42bde28be13a7efa2f5744ac4b5126036bbce309606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062107, "uuid": "e6f74531-4cd7-4086-95bf-9beb3aa623b6", "comment": "Malware payload", "value": "82dbb15238292c6efa4b37d6afade1c163b73fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062107, "uuid": "c4beb6e9-93e2-40f0-a0e9-9b565720f2e8", "comment": "Malware payload", "value": "644b2cc1dcf497a4a5abaab673408c1bfc1699ce40fd8a30cbbd74e06a5890695104546d66e6485c6e7a933e41102a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062107, "uuid": "c6dbc1c9-7573-436e-bdea-d25ad84992a7", "value": "T1B7E3C401B6C18861F7690B311864F9E0496DED3C1AA0E99FF2787E3A1E311C35A7799F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062107, "uuid": "096569d1-c458-4918-a269-e0503a1ac7b7", "value": "44ff686ddfbc720471c1ec4582be81e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062107, "uuid": "853c4e12-7080-416e-8d64-6c7c1d45b3fb", "value": "3072:iCoACwDp711CUKtPL+Ldh/h/L8gUvwKbxVz0zW:nVxh1hsLJ1xVzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700062107, "uuid": "f1d75e53-79de-4891-8449-b7778194f64d", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700062107, "uuid": "6b0cd6ca-3c9d-498e-92a9-c87be3859913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062107, "uuid": "bb447c8a-64b0-42f5-b7f9-f7d100dec562", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12530600-83a1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700043831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043831, "uuid": "73307ad2-867b-44e3-90b8-d8e37aa89e0b", "comment": "Malware payload", "value": "ff2fb8b235643c908a5868caaafbee53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043831, "uuid": "42b7c673-5d52-4577-bd4d-8d232bb76553", "comment": "Malware payload", "value": "7aa30ac897fcf18158968453dcaa7a57d39aea3f5292a949bfede803e55bc8f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043831, "uuid": "7b07a661-6172-45d1-a0f9-250a3bb4ee62", "comment": "Malware payload", "value": "61b4ab59c01883fca2d06ed03d17c8c448e0e6bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043831, "uuid": "93509727-f90f-47aa-938c-0eb11089082f", "comment": "Malware payload", "value": "df63a6e662a6dca68fd8f5daba17257d5444bb60a2198e3c8b0e6fe6e8a1e197dbd9ac47f926ab86c6e55b1628f141be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043831, "uuid": "622899e4-d1f8-491b-954b-8568a52f6768", "value": "T1F9F73331B287C13BD5AA05B02A2DDB9F5139BEB10B7180D7A3D85E6E18B59C25731F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043831, "uuid": "f1b03f56-2def-4b07-b685-c053320e6af8", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043831, "uuid": "d650c20b-1291-4fca-aceb-d2ad6f6cb012", "value": "1572864:BqlqhpZDWkekSjofjyjsUSnSTt2mjN6LIFTtAmriZnW:wlqzpIkSjobmsUQC0mjN6QbsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700043831, "uuid": "1b87078d-b001-46e0-9f45-358faceeff08", "value": 70517124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700043831, "uuid": "13d0289e-9045-4270-8da6-593c373db7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043831, "uuid": "3e588c24-8f15-40e7-b254-974b8534caf6", "value": "BattleBrothers_TRYamaKurulumv15014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653598c8-8398-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700040105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040105, "uuid": "46f594e8-d704-44a6-b05f-925796acf847", "comment": "Malware payload", "value": "45c9b2ee403f4fd606669d3cd199f919", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040105, "uuid": "d73ce994-3705-45b1-b25d-d6755ce72bac", "comment": "Malware payload", "value": "7c31d4fe105e60a9729dbd33357ddc20f3526a5ec2dfd1fc69eaa1668f289804", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040105, "uuid": "c0a41c61-bcd2-4b93-9328-7c26e46a0d06", "comment": "Malware payload", "value": "0279d9c4b01e4582a2c8f8bd2ab3d71fac4a58e9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040105, "uuid": "bac11952-e037-4723-b651-b088df134ffc", "comment": "Malware payload", "value": "95831939802a8ffd73380300ef1434e74c13b0dfe76abff569e51179ac5540d59bd7db65e0560e4be04e7b40d5425fa3", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040105, "uuid": "763f5d90-c915-44b7-aeef-e5d9ff6406ae", "value": "T150B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040105, "uuid": "d051e32e-2d5a-4647-912b-1b633ae800bc", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040105, "uuid": "b1849e4a-a7ed-4475-a151-c2cfeeec0f7c", "value": "6144:AexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7opUlLaEx:AeZeWSpda70ADIgSoxgUW/zFun7OoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040105, "uuid": "7dadc2ef-6dec-4807-b772-20ba4daff216", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040105, "uuid": "0cae5dbb-a649-4ba8-b699-8d138cf99c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040105, "uuid": "d613ce4a-87ac-4a22-afa1-9e0ac8a35c17", "value": "contabilita.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2783726-838f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700036422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036422, "uuid": "26c20259-3a83-49a4-9959-9359945f5cde", "comment": "Malware payload", "value": "8a7e5664d1f1d5bf41c6d943299aa1e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036422, "uuid": "cc73e74f-68af-426c-8f7d-4079ccb496b5", "comment": "Malware payload", "value": "7e512bb8c1dade78162ab6116b93dd3db2cbf91dddf09d05955fa5fdcdbd7113", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036422, "uuid": "a609579a-1550-449e-9036-2d4fde719a87", "comment": "Malware payload", "value": "31c172e588ea995a31b5d00dc50a78cd97e85720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036422, "uuid": "2f358051-51cb-4009-a64e-ffcb93756cb8", "comment": "Malware payload", "value": "b452d0f8ba3d402f667338b1dbef7057d32a00fa25fcedcb4a78860e1ac90f9685874b7f0da9193a64013dbec969643d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036422, "uuid": "3f1e64a6-49ad-435e-a976-77962a83a399", "value": "T19CA4F10721CF97B1E3B5A4BE7C76D0675A224E050CB05142BA38B7CE7871793A51BEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036422, "uuid": "a38d5314-8a77-4711-bc23-5b921a916ad3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036422, "uuid": "d05dd1e8-8213-474b-9486-6f0a7b8394c0", "value": "12288:7fUipgn2/I7tPP5LiGV2QxSGBhRHukGdJvVjQDVTg:7UMgn2QRPP5mGod+RHadXUJTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700036422, "uuid": "e4bfd8f0-f02f-43c2-baf5-df8663288cb5", "value": 470599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700036422, "uuid": "9b3d429f-3218-4290-8be9-bf083d4feba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036422, "uuid": "1d30fc16-b5a7-4ae6-8f8e-45914ed74598", "value": "8a7e5664d1f1d5bf41c6d943299aa1e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb3636d-8368-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700019370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019370, "uuid": "07cf79b8-0ac0-4a3b-b76b-67b713fc5eea", "comment": "Malware payload (Gafgyt)", "value": "f616dec0c562e3e6d36f1a4b92f23322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019370, "uuid": "439d1a2f-e847-4f94-b40f-704962eef7d5", "comment": "Malware payload (Gafgyt)", "value": "7f571631dc5974149b8f7165b999f09f179e5674260b173fe0bbc38e221a8e88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019370, "uuid": "2d261091-5270-49b3-b75f-a3ca16579597", "comment": "Malware payload (Gafgyt)", "value": "2a7d7b001371a28be711a0d814793d78ebc11ac6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019370, "uuid": "9a257c9d-53ec-4acc-9392-ebe3e13b664b", "comment": "Malware payload (Gafgyt)", "value": "033203a5bb481766c9cd38fd47247a885981a6d40ccf3fc380889abb2afef305dec37a13c16ed5b243f632c5f598acb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019370, "uuid": "81a89059-6d2a-43c8-8f58-78cf2c970bff", "value": "T1FB930A9BFA42CEB3C45310F112AA9F219D71F9FB4823D682E3646DB4DE150C25A15FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019370, "uuid": "8c1534ce-1c8c-4233-a729-3b6791dc509d", "value": "1536:Gf6vL3eKZqGe0hbck6vWkw5iQryBgzUJ0rc6WMWu/J33/ZmEg0:Gf6vpNe0hvXoLBMUJ0rc6WMtJ3vZmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700019370, "uuid": "01c40677-fbc5-4e6e-92c3-b409de15c72f", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700019370, "uuid": "8909fcaf-a18d-44b7-9264-a83987fe4540", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019370, "uuid": "a4b7ea2a-3240-4e22-9f90-5d38237421a2", "value": "f616dec0c562e3e6d36f1a4b92f23322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3dc873-8410-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700091606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091606, "uuid": "0aa0d673-8e32-4314-9adc-1e419986939e", "comment": "Malware payload", "value": "46b3e4bd8fabdb7463b20a679df6abc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091606, "uuid": "a0669722-d736-46f9-8557-96f0a990a3be", "comment": "Malware payload", "value": "8094ecda8ca0f8d5adb805dfef15a5d13c1dd670c3fd701ea98c36d19fde8cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091606, "uuid": "2180c9aa-4753-45fd-b0c6-97c2e6d7f6ff", "comment": "Malware payload", "value": "6ae796a8965d62b01ebeb848cf498cd9f0735dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091606, "uuid": "9d0c7728-7069-4807-a35d-be08096e7f00", "comment": "Malware payload", "value": "c9afc25269781f091427d9e00f6920cede3aa86dd7ebb6830ab9dd0c8ce7ab248987981a9f46057b762c84c54615057c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091606, "uuid": "022d4e93-aa02-4807-88b1-41a809f3e875", "value": "T16B76335132EDEAB5D23507724DD1A5C6A2D4CCE02F214427BB891CBB3FBC4D4AF261A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091606, "uuid": "9bf4165b-9ce3-437c-a96a-5f98c8d58ca7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091606, "uuid": "31aeb79d-973b-41c2-909e-3b46b218add4", "value": "196608:91OVAIBs4t0SfrA4dXtCNDaOk2lmdQnF6UzMvxYYlkS/tnq:3OV7Bxt/c8ihk2JnF6UzSxPFxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700091606, "uuid": "bbfea27d-d5ab-4e2c-a138-082335fdfaea", "value": 7537531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700091606, "uuid": "69174b1a-bf1e-45e0-961c-1ed3ab338fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091606, "uuid": "cb9bda58-3d2b-4725-8c73-5ba9566ad7fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1af215-8376-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700025597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025597, "uuid": "4b5066f7-22e9-41b5-ad23-2651952f7509", "comment": "Malware payload (RemcosRAT)", "value": "74c3f82f438834f8115f55ab49864f18", "object_relation": "md5", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025597, "uuid": "4afcfadc-13a3-4cc6-a550-7edd005aeced", "comment": "Malware payload (RemcosRAT)", "value": "82801d63eca2fdd570d211cdffe08f8aeb3ead46d51dec316ca36f389fe29d8b", "object_relation": "sha256", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025597, "uuid": "706e1fc4-fd37-4f33-96cb-d651515adbeb", "comment": "Malware payload (RemcosRAT)", "value": "67168207be165c8cd90b79093323dfbebf7c021a", "object_relation": "sha1", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025597, "uuid": "52c2785d-48d2-4cf6-a71d-161e417c7f45", "comment": "Malware payload (RemcosRAT)", "value": "6cbe817b2d094727d4ea5332207ebccb753a4e0350aa51e10a66d0a32091d9cb35890dc6dd73beb1ae3a6983eb0d942e", "object_relation": "sha3-384", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025597, "uuid": "3bda3bca-e968-4ce7-ad32-f4247fde3ef8", "value": "T14575339AB1C6804FC4D281714AE25C56EAB53D212EDD658F6FC2DF1DB213AE1C607B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025597, "uuid": "b7b2475c-b642-4fa8-b4af-f8ea30068bb9", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025597, "uuid": "c47a2f15-1b19-43da-93ff-7f3d0a641c29", "value": "49152:i5h2lKxafpAiFXeiKtSTmvzj9gap6MQIYDIYL:EXxaBnFXeNpNgIxwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700025597, "uuid": "84462c08-b339-41b4-aa2d-eb96911520b7", "value": 1614848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700025597, "uuid": "2b6c52d5-8f41-4c44-b323-c28dc977c870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025597, "uuid": "4c65fb60-72be-45a3-ae59-24bd4e8dcb0d", "value": "bf_after_pato.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b521b214-835a-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700013610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013610, "uuid": "256d68a6-2a30-4291-9885-e252bad418f3", "comment": "Malware payload (Loki)", "value": "fa3d63a56288fe37d338d2f709b80907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013610, "uuid": "3f988139-4229-4a60-9ea6-1710b8aa17ad", "comment": "Malware payload (Loki)", "value": "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013610, "uuid": "e07fdac7-5bce-4ea1-a05b-39c3c2d6800b", "comment": "Malware payload (Loki)", "value": "184b30909f04e44729d9bd39baaf9fb7b0ba8394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013610, "uuid": "84ac5c09-2a23-459b-b5b7-658c011de943", "comment": "Malware payload (Loki)", "value": "7e5c6e027bcceb1598406fcf3cf8a7c83e96da4bde0e468641f92b9156fe25312ff12d62d3542733fdfa2efd44adc318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013610, "uuid": "9dc3e384-af2f-4aa3-a437-5e23a728f83f", "value": "T193B32981B5ED1461E1A7CA713A7DF1F4D12BFCFE091B861A300E2E6A19F0A449877727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013610, "uuid": "40f6eaae-be8c-42e0-952e-2132bd1e7f76", "value": "c42d5cd53ab0f6ec2316f135b7a5f0ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013610, "uuid": "0eb9cee0-5ed3-4f2e-95fc-83e1921a7e96", "value": "1536:sCBygrZAyQAYhzPWsDGm3C/1qbnIZF8B6GbjVQBUuwlveq:stGAyQAgTWs6m3eYbnIYB6CS+cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700013610, "uuid": "33a9e9bb-947f-4cd1-b495-1c1341ca348d", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700013610, "uuid": "3a6be83b-181f-41eb-a69b-d4e28b5cf206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013610, "uuid": "5a58a34e-69d7-460f-bff2-38265b359e72", "value": "SOLICITUD DE OFERTA 30-08-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c811488a-83a5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700045854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045854, "uuid": "81c34982-a1c3-44d0-ad99-491d9b70118c", "comment": "Malware payload", "value": "5f609ce7020df85f0231e9862b7435fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045854, "uuid": "fa2f007c-3b76-4338-b3fe-724406ce9b7d", "comment": "Malware payload", "value": "85899457d67ec7a33751203ce6af4f98699d6832f0cf0264db1163c21e70b8ba", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045854, "uuid": "19b0391a-6527-400c-b1e3-4bba73627a58", "comment": "Malware payload", "value": "ab6470dbb2e400d91543a46190737e3f70e38943", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045854, "uuid": "b8dbc99e-111e-4d23-9a7f-470b0befdb5e", "comment": "Malware payload", "value": "218df1c57f38b6fbacdd710208bcb5dc45fc425667c9ff6343da07848bc14b3df69435a86b2813509bf63d25b1bc7175", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045854, "uuid": "aecd5490-1a6e-4d50-9880-8049f35b9d1c", "value": "T15897E04AD92CD532E4DFF07C5E3A0B17F13D2C2402A5C5579929F508FABBAE046A2BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045854, "uuid": "c2c9b17f-9e1f-46f7-9048-91eded553e3c", "value": "786432:tgEwJw2gIMe4H1l+nBZ2W8bQ1qndrZel/vUMig6DpYwiIrgr:iTgIMR6n32W8dOig6DpYwiIrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700045854, "uuid": "04f24f7d-8b89-41a2-adeb-b00d0e83a3d7", "value": 39804815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700045854, "uuid": "3042dada-0f5c-40cc-97f5-5098b6be0c5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045854, "uuid": "bd7680b2-dad4-4a70-8372-b63aaef1a084", "value": "Fatis_1.0.3_Apkpure.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12be67f5-83c3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700058435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058435, "uuid": "4b070120-1d09-4ee8-821d-c6839c3d8a32", "comment": "Malware payload (AgentTesla)", "value": "07ff2e53678892b871dc14286df16edc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058435, "uuid": "f13966dd-5cda-4bac-8692-facd746b8438", "comment": "Malware payload (AgentTesla)", "value": "8632a6cdacd3c2ca44c427d1ef6bea4a9c16a7089a31f12fe79ba6e108860902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058435, "uuid": "b4058e81-5fae-4a33-ac52-d26a3bdda34e", "comment": "Malware payload (AgentTesla)", "value": "2308987959856cd9245855688ef4779cf71251e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058435, "uuid": "7b6cbb82-3320-4d72-83ab-382cb8a12a7f", "comment": "Malware payload (AgentTesla)", "value": "1e98573befe893efb66beea0a1eb69c58075ec05cc8778bd286bb170941266aa0f0b4872bdf076f9f27b8799b6003833", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058435, "uuid": "fa364fe6-3657-4e5c-bf86-3e02bf1ac64e", "value": "T137F4022733685823DA2E02F5D02650A417B1BE27B220E3DD5DA77BDD2BF2BD146016DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058435, "uuid": "53fc6d9b-fd86-4f99-b721-5710efdc3a14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058435, "uuid": "5b18b40e-a20b-4ea2-80da-604b931664d4", "value": "12288:4JX4QtLaBlPDn3SfWXGYLfDjBXTmQx82XKm8Xkom9xaPPK7L0p:5PFjtTBxvamjom9xaEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058435, "uuid": "d3cb776c-7af6-409e-896b-c01d053bcc0c", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058435, "uuid": "f69667b7-4313-4cde-816e-73f8438337f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058435, "uuid": "932d2bd4-219b-4fe7-9704-8a1c12046d88", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da35c417-83e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700073372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073372, "uuid": "10f1bd89-0e76-420c-813e-eabccdb2ef61", "comment": "Malware payload", "value": "bffcb464866e540ff1004282ac7d7ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073372, "uuid": "78af690c-f695-4477-9c32-bf222c0427a9", "comment": "Malware payload", "value": "871c57f351c6debafe3210ce09ccdb78f8ec84223ac7d70ab96126b1bf5f6d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073372, "uuid": "a66fb8c6-bd33-41e3-b2b8-d56b42fdc4ab", "comment": "Malware payload", "value": "eea37497762df849b2a19288ae5d959080f8de56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073372, "uuid": "bb3fdf30-9874-4a16-9b8a-1495fe107f2f", "comment": "Malware payload", "value": "4aded3eb8a5cf85796f8f1305a6aa23823b792dbb21190984736630fa1cc41394347950943b1158c9c8de4bb1eafcc48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073372, "uuid": "52e8207a-7ff0-4308-885b-876ab5e065fc", "value": "T17A457D6136C08163EFA335764E9FFA3D025ED0B8CB248ADF19944AFED6707C12A71685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073372, "uuid": "c0674bda-b7ac-4610-8acf-4b2d260e185b", "value": "0f2421503cbb5d49fe417b88d0084470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073372, "uuid": "15499cba-6e65-4bc9-9e61-c77168ec1a20", "value": "24576:IZqkT2MtymlKgQp4cMxKrb74NnrePLHFZl5azVsk3lrlGyEoEqWj/t:IZptymlKgIBxczVsXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700073372, "uuid": "048b5f8b-7076-4762-8763-17e911411f6b", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700073372, "uuid": "50b35568-3823-44d7-ad66-dc8c5302cb7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073372, "uuid": "10faf84f-fdcd-4bc4-a584-66432f5ff1b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52a28c1-83e3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700072505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072505, "uuid": "16957c2d-66a2-4b25-943b-e4c233ab0372", "comment": "Malware payload", "value": "9dcbbd8c6ef3fe1df26e2c6dc77227d9", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072505, "uuid": "e429fca8-6a2e-4c10-b538-3360041cd1b4", "comment": "Malware payload", "value": "8a119d3b9fce9c74bec4f0a150d29ff043af16ec7202b42c23b4c77da5266676", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072505, "uuid": "ab9f8bba-44e0-455a-8964-29f3375326b4", "comment": "Malware payload", "value": "8c82cad447f02f68a8f570dfce5bd3b31afce472", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072505, "uuid": "81613455-aec0-403d-a1c2-20d0e15a75a2", "comment": "Malware payload", "value": "6217e1d1559185ef24be11c605a1336ab5a96517074f491821bc833eb8e66e297e0654b9776e8e7f54b4e834446ccb32", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072505, "uuid": "871da1b0-c3ee-4675-b906-84f291180c76", "value": "T18EB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072505, "uuid": "9e6f3b1b-c9d2-4215-bda1-08a265c0019c", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072505, "uuid": "87eddc57-6d6b-4a6b-abea-90e58dc26a90", "value": "6144:qexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O73pUlLaEx:qeZeWSpda70ADIgSoxgUW/zFun7OdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700072505, "uuid": "f417c276-7a45-4c93-ac4e-38812feb0656", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700072505, "uuid": "f761c514-ad6a-4dec-b4c9-2d7192d6d095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072505, "uuid": "aabd0b4c-5133-4dce-abc3-da4e7f4a093b", "value": "serverInstallv4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a8f729-838f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700036475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036475, "uuid": "d63acfa2-4904-4215-951b-a45a20f519a4", "comment": "Malware payload (AgentTesla)", "value": "e9bedd0b704f463e74e6077c2e865ce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036475, "uuid": "e7031a26-f988-4402-88bf-51187b880345", "comment": "Malware payload (AgentTesla)", "value": "8af6097b2ebe610f5f0602bfc6f5414f797cfbaef62ebf522f8c93e1f23eadf5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036475, "uuid": "993856e3-c9dd-4cad-8e82-92db94b87a6e", "comment": "Malware payload (AgentTesla)", "value": "59bdd2bd1f7c80738947285ffe7c2d8c6df39bab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036475, "uuid": "881016eb-f32b-4041-ac34-326105ba9054", "comment": "Malware payload (AgentTesla)", "value": "c74eedf291ae75ff055aa3ef1f2e5cfdefef797cab40b12e73bd9678ee7e33ef97dee89a81ce5be8fd82d7fe3e361a2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036475, "uuid": "41ab1ea8-06d8-4612-90d6-75b8e83bacbf", "value": "T10705F0403AB96D63CBA501F41B46A98C37F83D825951E7F6AFE130DA34E1FF1161A24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036475, "uuid": "00a257c1-3a5a-42c8-bf06-0a0d31da3430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036475, "uuid": "c65e6ec8-a51e-4815-a9ac-b0aa7e7e0fde", "value": "12288:/J5uPuBw/6FgcgXSPkmorbUY15x8JOPAc0+JkErqhuicRq79WBWGwPF:KuBwiCiP1kUi5iS6ogyRm+wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700036475, "uuid": "281da751-1032-4487-b53a-83b948f95052", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700036475, "uuid": "9511bdf9-30b0-4b65-9c6f-25559ddb0c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036475, "uuid": "40997c75-57ee-47d6-9555-b0a87b51030e", "value": "SecuriteInfo.com.Win32.Malware-gen.10616.22988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a5b64c-83c5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700059512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059512, "uuid": "35452a71-b7c7-4802-854a-a49c11b268d1", "comment": "Malware payload (AgentTesla)", "value": "b22d91b08515148ecd0f723f1b03998f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059512, "uuid": "57708468-9a3f-4665-8619-7d3fff165d63", "comment": "Malware payload (AgentTesla)", "value": "8c69f8ddbe47d5020425853ec7cc411a6656b7f411862d1de7f1081e1f6739c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059512, "uuid": "f243ce36-4429-4af1-ad7a-892bef2fbb8d", "comment": "Malware payload (AgentTesla)", "value": "972d48cc0b3bc753113f26be7c348babf73baa2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059512, "uuid": "27b36761-5095-43fc-8b22-19ad405b8f17", "comment": "Malware payload (AgentTesla)", "value": "095ee07a4e723db2850c23b7ae7ca73421db9c12070880a5670cf5bf625e69c2a134335719ab57736d77a83506ecf35a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059512, "uuid": "79485f6e-cb38-43b8-a693-2fc943b3181d", "value": "T1B3C4DF1036B16E13CBA582F45B66258C37F57E628162CBF90FA2B0CE74F2F705619A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059512, "uuid": "eaf51357-d77b-4fd4-b773-5e679f684cef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059512, "uuid": "30f06ad2-cda6-41cf-95ca-2ad7165956ca", "value": "12288:lJeVxoYuPhqVPyG3A6HrdM5s3vOnTokdT39WB:ne0jhqNXQ6HrdFmUKTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059512, "uuid": "394525bc-14ba-4f7a-a2a2-09fa4d8c7aa4", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059512, "uuid": "73e080fd-5e29-4465-8bd1-d6bd855e674f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059512, "uuid": "f57c133c-dc1b-4437-818f-aad56e9e24dd", "value": "Justificante de la operaci\u00f3n realizada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b73564-8404-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700086605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086605, "uuid": "c9f4f82a-caa0-4b7d-9745-cf69bf10c1d5", "comment": "Malware payload", "value": "743971bf2800191d1bfaf5a4255524d9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086605, "uuid": "5de42c6a-6990-4ea5-a282-fb15c7345710", "comment": "Malware payload", "value": "929c3cadc1a37a6f11f9f2b473fa9518d3c4162480b90e517204842f1f809429", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086605, "uuid": "ed8d502c-cae4-4537-bcc5-a683a4eff3c2", "comment": "Malware payload", "value": "bd74ce4b28b2e14dedb8e4270a9c27d04fbcd8e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086605, "uuid": "2118f0e5-8197-4b44-8479-2ec99d858bcf", "comment": "Malware payload", "value": "a33e6b214008bef09633a1a2f81a83e70f3c5b09e911d7bace1fdba02f88b25c14166468ac395c52f4b9408386f0b836", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086605, "uuid": "2dc06fa5-e305-44d2-8397-5b882f57d8b6", "value": "T1D0E31359C37B23CC417644AA8DA339A3229A55235CFB796662ADD063F1F9C0EDC9007D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086605, "uuid": "ae901993-679f-4d2d-800c-ac95e4fa356d", "value": "3072:VR2wGoxr9+jKVpBCecDLm9Nf66A218+jpVd8yZW6FyFPFi9HQj:H2wB40JOmL6Vf8pVGbNi9wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700086605, "uuid": "fb45a3bd-4136-47c2-aa8d-ac4944095672", "value": 149388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700086605, "uuid": "725887c6-4d84-4453-bdcc-f7961b20ba79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086605, "uuid": "958f925a-b665-47de-87c8-fbeaeb4faa2e", "value": "Sat_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82de2d05-834d-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1700007942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007942, "uuid": "be56f98d-a499-49e6-82c1-cc2f0b90219b", "comment": "Malware payload (Amadey)", "value": "c48c58d873eacde201d14af9cad50e81", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007942, "uuid": "1bfbe8f1-3a31-4537-82c8-8d0ede1df6e5", "comment": "Malware payload (Amadey)", "value": "92b44334a248b6b3850c38fc3aadb63d0ae1828cc2a6617be41299eb4707d82e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007942, "uuid": "bd058fb5-6978-4bca-b5b0-c242f0b40b0c", "comment": "Malware payload (Amadey)", "value": "70f5c86800d9d8f636506f17d331f3001101d0f0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007942, "uuid": "f4f3e010-0c0d-4ffd-83db-856746ea0a04", "comment": "Malware payload (Amadey)", "value": "3eb55190ad42bdace976633d974d52d7cf841d891af7c86d4d26fb0e5359e0ddff65926fd45232f20006b7e894d81694", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007942, "uuid": "7ee850e3-99e7-447e-b8c4-259094a58bc3", "value": "T18A74F121B3E0C072F1A755704A72D3649B6FBCA24B7185CF27845ABE1E706C2EB7531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007942, "uuid": "263be671-b7d3-455e-9af0-6baa03dad6e5", "value": "6d9345bf08688119d85e339b601df9ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007942, "uuid": "efda1855-4958-476f-a12a-ff22b2982a19", "value": "6144:GQtkcSu6OM9kVkxzR9AFWt3ExxJOlI3uemluLoXAR:icSulMeaxzgWtAvc5e1oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700007942, "uuid": "6bfa3c58-490d-49e0-b435-49840363ff66", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700007942, "uuid": "7cbe401e-feb8-4221-af10-850ea73b9ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007942, "uuid": "850703ab-2c95-4923-b39e-269209b90904", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e608ac97-83c5-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700059648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059648, "uuid": "80bcbdff-6526-4611-804b-230fbd960d15", "comment": "Malware payload (SnakeKeylogger)", "value": "26048e02ba3f8483fa15e7c0660c4c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059648, "uuid": "d6d3eb6f-6a54-47ca-be38-e9995e1f6ba1", "comment": "Malware payload (SnakeKeylogger)", "value": "93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059648, "uuid": "e380e507-7d9d-4003-b656-d967e9877a3b", "comment": "Malware payload (SnakeKeylogger)", "value": "b98cf8f5a2f6b7f5801de10ae4873ca654958009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059648, "uuid": "d26bbc01-5ae5-4ffc-b2af-32ca77c80a0f", "comment": "Malware payload (SnakeKeylogger)", "value": "cef22059b08a94c52ea4392c2a05f09a4711e5d5be5b374ee71fb2addbce92db47194c2ecde9b616c5d1bbc95e49193e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059648, "uuid": "9fd43e0d-942b-4259-9356-2e110c201513", "value": "T189D401063224152BD63D05F9A4A651C19BB2FE137051E7991EA77BEE6FF27804B033A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059648, "uuid": "bc964106-09d1-4b1b-8417-f17b032c1cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059648, "uuid": "97c210ef-1b61-40dc-94d5-f1490df36818", "value": "12288:HaHLlfxMEiWtZjRHUCwRwqYCQiURT+NEbQdf3id:QhpMEVZ4LXURYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059648, "uuid": "466b687c-179b-4334-91e3-3577fd2e8a90", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059648, "uuid": "6a02457b-d5b3-4387-96ae-eff64a05cb2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059648, "uuid": "5b029a49-0fcc-450f-8f36-fbf208e28008", "value": "Draft BL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9a1856-8365-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700018188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018188, "uuid": "fe13aff1-18a8-4256-860f-37e7b37e3698", "comment": "Malware payload", "value": "dca73d055e1bfc4466bc9ac6a4f4f90b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018188, "uuid": "abee31b9-4f08-4a87-9b43-716d8c827614", "comment": "Malware payload", "value": "93f4f7dd1458ebc9caa287fe4a81737a417a75ab8e3a4a150c5c907f87b51d11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018188, "uuid": "987b9b30-a85e-4436-9943-95e3f00d5afb", "comment": "Malware payload", "value": "e63e7cb07f36d6583987eb5af74f68320c901bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018188, "uuid": "2f7ac1a3-9894-4c43-ba65-325299b82d66", "comment": "Malware payload", "value": "79007d9b5da4b52946b78a51ff802b32daec3e1da3bb5673048eaa09757d0874f4d66b1e2319823d382851c2031f3e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018188, "uuid": "325a2bc9-8705-4be1-acc7-42dffe9a104d", "value": "T129371824E1FAA54DF1F79976CED0B2E9A57AA4223703D2A6DC10D302782D5C7CEC2476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018188, "uuid": "7fcf180d-6685-4b15-9d49-4b436c8976a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018188, "uuid": "1145bf9c-45a8-43d7-9d86-f6bf8ff9a187", "value": "196608:Wk3rl/JJM8vz9ZgCldbshh1BrB/WxsJwG9afGjPAn7b91FhQYImmsyr3XS1Y18YN:WkJcru2iAc7b91FhQYImmsuDvQE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700018188, "uuid": "5ce6b0df-3fe7-4f25-926b-744e3585edb5", "value": 22709128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700018188, "uuid": "7ab12cf5-3325-42ed-aa10-f023c9f7f9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018188, "uuid": "06f37eaa-7aa3-4ad6-ac61-250c36fb83be", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.30386.5839.12065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e46f7e6-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044764, "uuid": "9256db9e-669d-43e0-981b-7937f6b06b0f", "comment": "Malware payload", "value": "4502619d3c09ff53b25a603c64a08109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044764, "uuid": "b2c9cef8-4cfc-40d4-895a-5694eac7a46c", "comment": "Malware payload", "value": "94e606d5814003e1ad02da673542321ff27f3c0900e5d80c10f5a2b163e9be95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044764, "uuid": "7ae1735f-fb50-44b7-83da-658a378d8431", "comment": "Malware payload", "value": "a6f097ce16ba8e28544e544dfe0913bb1bc2a17f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044764, "uuid": "db976b8b-7c28-4ccc-badc-3fea4d3e1f1b", "comment": "Malware payload", "value": "74ed9f7010de12feac75dfbeeff491b1bf92e4333dd9973b6f02ef4e001227b8af3a825318a4f1f08297cb7ff90b1e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044764, "uuid": "d566d88b-d251-42f1-b57c-8d9723906439", "value": "T12966330A67C004EADEE4A3F99A6787571E3371914F3512AF36D094B89EB63C46D36F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044764, "uuid": "31b4866e-a17a-4a4c-b795-743dcaf552b1", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044764, "uuid": "f3b383d0-8512-4eb3-a2a7-8c2b25f42d3b", "value": "98304:qnjUqg1xhCae227fn9kdChgvp7N/xr1Angy+ppqEjazjndVRpsbJRSDjF:EWkL22jn9NKd1Agr7jQjnfDOJRSfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044764, "uuid": "bc27d027-0865-4310-a976-86eec0c6a29f", "value": 6627840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044764, "uuid": "19fdf488-e8ae-41c2-8252-8a6b4883a97a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044764, "uuid": "67d6454a-8235-4bac-acab-71a89cfe4729", "value": "continuedeveloperpro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b203101b-83c4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700059131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059131, "uuid": "0b7b01c9-68a5-4b60-b1cd-c6b502999d46", "comment": "Malware payload", "value": "1d73e459f7e64c84dbf25eda14b3bfed", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059131, "uuid": "267048c6-d7bb-4d8e-a910-304548fd9790", "comment": "Malware payload", "value": "95d14e055fde0847733890ca247d22a1ef9ad581389e6beead1de46d3147ff90", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059131, "uuid": "80a81406-6a2e-4739-9259-ddb6aea86c0a", "comment": "Malware payload", "value": "bb65d20dcc68cf7489048e5264033e069334c656", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059131, "uuid": "63437bd3-a6c1-472b-9b80-34aaf6d24ee4", "comment": "Malware payload", "value": "4d4490cb34aa14ee28e912273e9b1ea860cfc600aa87fc1baee8ef4b5b76d72031adad1cfd4b934ad6ce7ee006179edf", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059131, "uuid": "76677a65-15a9-4d3f-98c4-3d2d4ff140a2", "value": "T10AC3127090E7F9AC83BC1CF7047D6AEB0D608BFB5965D564D2FACD28343A14C09994A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059131, "uuid": "1cdc4abd-9b5f-4f76-b5be-479b430e7f94", "value": "3072:94TTxOGcZczudmAwLoAuXs0kvkWBojCjQS5nVFRLzO:2TwGcZfRsoPc0kSjIjnrRLzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059131, "uuid": "0f0468ee-d62c-40b1-af57-f130cd350834", "value": 125461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059131, "uuid": "10b64b38-20b9-445d-8486-3adefca13646", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059131, "uuid": "f8c01130-3196-4c53-a06f-90b392cbcaf8", "value": "QTDX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da306cc9-83a2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044596, "uuid": "3833a5ef-77b9-40c2-aa73-2c981236e783", "comment": "Malware payload", "value": "2228c2aa4ccebb0eb5abfd11061bc72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044596, "uuid": "e46063df-4791-41f0-a55d-5644fa1fbc06", "comment": "Malware payload", "value": "97cd6e5130cbaa45bd0281318c61c122cca866764dcfc87670422dbe4bfa8d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044596, "uuid": "fdcb92d3-100c-48c4-a6ca-bfdfd1948359", "comment": "Malware payload", "value": "3ac3c7251371b4b2e906e5605b71fd9377b2b296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044596, "uuid": "aa373295-5f78-4c12-8de8-d119114b9903", "comment": "Malware payload", "value": "7db0701e623ae887f967445e4b4d841fbece02a6c6be36294aad2ee45b44090b3411f3376f1a59ca1517996e465bafec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044596, "uuid": "6e61ea7e-510b-4a99-bacd-63857824cd42", "value": "T1B2F73331B286C53BD4AA05B02A2DDB9F5139BEB10F7140D7A3D85E6E18B59C25732F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044596, "uuid": "6fc1d52c-fc11-45ad-af41-1502101a74d3", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044596, "uuid": "ef9bf79a-d41e-47ab-b2fc-d420fa443fe0", "value": "1572864:LrlqhpZDVkekSjofjyjsUSnSTt2mjN6LIFTtAmriZn1:nlqzpBkSjobmsUQC0mjN6Qbs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044596, "uuid": "9fa756af-9c0f-4dcd-a4d8-1eb89c2bce5d", "value": 70388596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044596, "uuid": "d021e8d9-f527-40c1-88dd-57246a082bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044596, "uuid": "86578ed2-75af-48a4-b04c-161b3b3f3606", "value": "Blasphemous2 TR Yama Kurulum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f193d2-836f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700022434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022434, "uuid": "7525e4df-d8af-4cc2-a298-87de2aa73be4", "comment": "Malware payload", "value": "67b6b48ff9d6b2a39c2a9afbbadb6e31", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022434, "uuid": "a00d974c-4f2e-440f-8ab2-231bef059547", "comment": "Malware payload", "value": "98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022434, "uuid": "66d4fa20-419e-438e-a955-f7f28c8102dc", "comment": "Malware payload", "value": "8430d9d0f97722bbd1af3ceb6271a2b1b6b8632a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022434, "uuid": "bbb1afe5-e6ac-4a50-bfb1-7e01fb490361", "comment": "Malware payload", "value": "f48f28b82695a4db9f399f9fbe52df2f687ef881c490cf8525ed642ed0cd335d44ed614e6811b7311dcc76b6cdee55c1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022434, "uuid": "eeba9d81-2f68-41b6-b54b-d305510dfafd", "value": "T15604AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022434, "uuid": "de4e07fd-f061-4853-aa0f-30dd9538a1a2", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022434, "uuid": "bb8ae668-6248-47a9-acf6-0398dbb8291f", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlL0bVaKoXAxOPYe:I74elpowsxizqyStZlpel5IyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700022434, "uuid": "f6974d4d-85eb-4eca-aa58-35e16363a222", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700022434, "uuid": "a9e8b281-66a4-4f5e-b4e5-0f5e420de318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022434, "uuid": "503ff013-ed3d-4f95-a9f1-e102e1741009", "value": "WCUtil_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57796d82-83a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700045236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045236, "uuid": "f9904ecc-4664-4412-b010-e2a707ddcd31", "comment": "Malware payload", "value": "db52eb028f7990546650cef810841bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045236, "uuid": "556469b5-f254-477a-8b2a-5e641109ed5d", "comment": "Malware payload", "value": "9a4b6b2f92768653a963bc7658be529a27e94bf082d8c8843f189ecb85dcc653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045236, "uuid": "e49825f1-05c1-4f9e-89e3-1f0f38a48495", "comment": "Malware payload", "value": "0b1d08614e720561556c43b656654fe78bdb753f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700045236, "uuid": "cab6b0a4-5913-4791-8193-f8c96bbf292d", "comment": "Malware payload", "value": "248649c9c2de659754837e0d226d676d51ed21a0e9d62107cffc46d1f80e13fd22b0d255ac2d6c49833ab34416b89427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045236, "uuid": "f9fc2181-7b3f-4e89-a348-7375aa36e819", "value": "T105F73332B786C937C1AA0570257DD79F4139BEA20B7544D7A7D86DAE38B58C21332E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045236, "uuid": "7bc3ed54-3dbd-4930-9a90-daf185de1770", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045236, "uuid": "6cb0dbe5-5b99-47c3-8a52-2e9798591595", "value": "1572864:+llqhpZDdkekSjofjyjsUSnSTt2mjN6LIFTtAmriZns:mlqzpJkSjobmsUQC0mjN6Qbss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700045236, "uuid": "3002ba8e-7d04-4701-be9c-4f5d7194026f", "value": 70629776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700045236, "uuid": "db454243-ec7d-4cad-8b7f-89d78d698130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700045236, "uuid": "cf1eb22e-9d2b-460c-b649-8efc773a2ef5", "value": "Case Of The Golden Idol TR Yama Kurulumu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6ffe2d-83b6-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700053133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053133, "uuid": "bd41c0ea-b444-4a66-bf56-f24dda1199b2", "comment": "Malware payload (RiseProStealer)", "value": "d4eb2628dd8a3ee863ff400529f2a316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053133, "uuid": "0d95f7de-f7b1-41ee-82fa-18c3d5c3af75", "comment": "Malware payload (RiseProStealer)", "value": "9ace8da13504444a98946407ecc83fa59efa2c8ebc3d0fda73b11b28aa1b0664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053133, "uuid": "42d244cc-aa9d-40c2-b8d1-05efb358168e", "comment": "Malware payload (RiseProStealer)", "value": "5375a6116eec6445fad06b78ba87ea17943ae085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700053133, "uuid": "9aab74c0-2bc7-439b-a23d-9be6755c186f", "comment": "Malware payload (RiseProStealer)", "value": "5b07f564c61b1faeea50e3a84454d323689541b07f385ac848cf5720c254dc335daed91719fb7048d5442f6fdde2bc73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700053133, "uuid": "2e01d130-da6f-47dc-be33-39ab422925f2", "value": "T1D3E523045EFA21DCC489A6344692FF2E72F4C9E546E18D04DC69E3CBAEF3611A6B7107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700053133, "uuid": "d4e93d30-b764-44ed-8d84-0cd4f238d27d", "value": "f7384899725683d618a954462a12cd0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700053133, "uuid": "c281e697-e0e3-4eb6-a3d5-285408c9737d", "value": "49152:QUqdcf07SVKcGcKJtxHDoS9rWo0s9o9yQD9lRlAjjAtIxmAqOH3MvKP5Vycq/Dtq:nrf07S0tLxH19P0ao8QD9lrUxmAqOXMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700053133, "uuid": "134a23ea-025a-47ca-97a8-0e04459a64e5", "value": 3022112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700053133, "uuid": "49c5780a-6ac7-40c6-94b5-dc2bcdfefbec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700053133, "uuid": "71a5014f-4842-4b14-9899-9bca0ab6d6cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dc8c21-837e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700029154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029154, "uuid": "72a74865-cc32-451f-9efb-94d94c3624f9", "comment": "Malware payload (AgentTesla)", "value": "78cbd1b31a62d6917b291cfc042b7d63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029154, "uuid": "5c02dd88-fadb-490a-b9b0-d3432306cf68", "comment": "Malware payload (AgentTesla)", "value": "9df6347fd6d4c18024e5330a6d05ab03d7f85f7aa70d7f083bf80f764852a367", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029154, "uuid": "7d0290ec-a359-42d8-98c8-605072a99c62", "comment": "Malware payload (AgentTesla)", "value": "db0e3e59566f8644bfba3836de13e26e8c1c4ce4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700029154, "uuid": "e465f0ec-b338-4a11-baef-60211a15e962", "comment": "Malware payload (AgentTesla)", "value": "59b69a49dfda068e3aaad290946c55c82ee1f26fbcf765683a9f53ade6d6c3a0ca14ac429213e3ed10145742b88dbcfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029154, "uuid": "4529f877-fa24-4573-8300-1956cd7fb9af", "value": "T18905F97F2B481123D079D6A3C377A826F17B88BB717ADF6474D2F6825983A43349221D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029154, "uuid": "ce0646ec-5e06-4e4f-bcf8-82c1cc6f95bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029154, "uuid": "f06cafee-4336-4752-b807-00bfc9badb3a", "value": "12288:IFMI4+KKj5lQEWjDICRpRt2DGpjucx9y5UBuGYDCaQ:AKK91UpRfju+y5UB8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700029154, "uuid": "08043171-af36-4317-a395-59175a21a797", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700029154, "uuid": "1ddc9429-32cf-4d4b-b0a6-3d869dade65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700029154, "uuid": "e90d4a94-c2e7-4356-8930-a44d5b4b6c6b", "value": "SecuriteInfo.com.Win32.PWSX-gen.19412.10300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d065047b-83a0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700043720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043720, "uuid": "ffcc0e9b-4490-48ea-8ca4-30549d2c3cee", "comment": "Malware payload", "value": "e8dbb9ebdeb0ff2bca0833b5c251e395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043720, "uuid": "603a3c22-d0ee-432f-ab29-517f967ea820", "comment": "Malware payload", "value": "a0b708c25e2fce2346235d0bb42abc98432e664bec6e925a04e9636277ead082", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043720, "uuid": "3716013f-6dcf-4d2d-9e3c-63e78fe0900c", "comment": "Malware payload", "value": "05069ef860ce79a27b988f6d8c6c3c179c394fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043720, "uuid": "f14b40cf-06dc-4a88-a87b-c560e4c4889e", "comment": "Malware payload", "value": "e584390d3ec698cdb48fb58fdd21830c387eb7f169e7b9c256b45099804d8e8c8e14213114259ba89daba4fc69c1ab62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043720, "uuid": "bb51a945-1b6b-4354-9c91-90738df1278d", "value": "T19B849DC392A1BD51D9254B73CE2FCEE8B61EF9408E4D7B662228AE5F04712F2D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043720, "uuid": "8991762f-bc7f-43ba-adb5-ff5ac53c9c69", "value": "4548c55759faf298d7bd7ddf85a57818", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043720, "uuid": "8914dd4e-c7f6-4161-99f3-9f1aa5d38be6", "value": "6144:GLgToHjOO9KdDmcTRWKCqnH/CZUsEP5BHeFLk8:GUNyGTTRWKCEKUsE3eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700043720, "uuid": "f8cbe334-f29a-4bd4-91b6-4ab7d9993f4e", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700043720, "uuid": "c50ea97a-9d30-4562-97c5-09bd78ecfea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043720, "uuid": "9ddfd4c3-3f91-4755-b425-0cabafdbe44d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d0d448-83a2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044619, "uuid": "8fe8900a-e91c-47c8-8505-eeac38c85a24", "comment": "Malware payload", "value": "ab1996b9ff4f6aceb0bcc017cc60f93d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044619, "uuid": "63294d99-4ba4-4fab-8a3b-2eb376d140e8", "comment": "Malware payload", "value": "a31e66233b55244dea9219f5b5a4df56732ea52b4d2c7dac246851fcb9b9c318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044619, "uuid": "ae324911-ef72-42b5-a447-fc102697916a", "comment": "Malware payload", "value": "81d24d93427ae0f726080058d8b0c4e1a8c9d5db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044619, "uuid": "6f0ac1ac-8406-408a-9d3c-2d80ed971aea", "comment": "Malware payload", "value": "0f5e612834ddf5d88d2e38a6921e39c140abfcb5925329896f2f048f4065d4ce9941e5d69920f7a31185feac2f11a748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044619, "uuid": "2a439f36-ced2-4327-9be0-40e6c8fd95ed", "value": "T1CA443A8392A1BD51D9164B33DE2EDDF8B61EF9608E4A7B663118AF5F14B10F2D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044619, "uuid": "0a2128db-3a54-46ae-abeb-dfcefc73c73e", "value": "0a046e791e3122b7d021f9aaf3ba90b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044619, "uuid": "b273a09b-8ac7-4f48-ba6b-6bae6b735499", "value": "3072:Zr4O9Libfc8/OcZyCk3TN2uVkVGqvTJJr/UhGQ3R2nILk:BLiTttk3Z2uaRr/hIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044619, "uuid": "c2fd3a7f-df60-4d1b-b6d4-f62783367841", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044619, "uuid": "9c733de8-ee9b-4a6b-8d0c-e48a1d210cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044619, "uuid": "962b83cf-6671-43a4-8823-9dac927cec91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e35c73d-83d2-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1700065004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065004, "uuid": "a0e72736-26a3-491b-ae4e-f783225025ec", "comment": "Malware payload (Amadey)", "value": "8910bec70841a3246416820e6b9a299c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065004, "uuid": "05ca4da8-b029-4751-83c1-3bd84afb9957", "comment": "Malware payload (Amadey)", "value": "a4528e6b733c6b595e93e3d50fb849edbe9fcd062b65fb2bd4ae5d8d76ac5b76", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065004, "uuid": "cdf9a8ec-3d6c-42e1-b970-f76f319680ec", "comment": "Malware payload (Amadey)", "value": "416388674468211f3fe8b933026507cbe7e4f411", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065004, "uuid": "20c8adfb-352d-4973-99b8-b2efbba9fda4", "comment": "Malware payload (Amadey)", "value": "97c3f605807872813a4e413ce2cd4312012f04fe8c0570e168682a79c43c95ecc2db2083bc1c6e6e4aa416c97fd34da5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065004, "uuid": "cfabaf4b-e866-4b7e-b7d5-68136d58e8ea", "value": "T1A3849E2392A1BC55D925CB729E1FC6F8761EF9509E493B6632287F2F14B11B2D2B3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065004, "uuid": "befeb43b-ff7a-4498-a801-2301bd181079", "value": "fb752e503b6d05b37aeae46cd3910859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065004, "uuid": "86bc7992-67ab-4cf8-b278-368aedd1aeb2", "value": "6144:qLL+q+uA0685+FQ9DC4qOcLBYEE5lSSQvXtFEUT7EqLG:yqqHATtu9m4iSEMmtFE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700065004, "uuid": "65fe2121-ce19-4f33-96e7-0ceef6f2ad47", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700065004, "uuid": "02c4f324-9bb8-43ef-bf69-2dcf4d4f8783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065004, "uuid": "8ab777c1-a315-41c4-b425-7a973570cae4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae30f7a-836f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700022451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022451, "uuid": "e5921924-030a-4d44-ae11-346dd35c0b89", "comment": "Malware payload", "value": "030de40e768d4bcdf79cf8cf6701ab43", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022451, "uuid": "f136e59e-414e-4e07-a782-f695ba8f2cb9", "comment": "Malware payload", "value": "a4a651ae85e06287fdbd48c3d753856b07429f1c8b9566312cab224980f7895c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022451, "uuid": "cb7467ea-d040-46f5-88a5-7136f71ba43f", "comment": "Malware payload", "value": "300ef5bab56900bb83c3d1529120dc0a5562ec3d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022451, "uuid": "e2e53206-f469-4838-a533-5a48066faa95", "comment": "Malware payload", "value": "0fd677135fd7e8eeee2b42ab9f9643ae31acaab204dcc2529f97e4503e8b98905a1e7c8fed86ad22495c5493cdee9fdf", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022451, "uuid": "71ec2ab6-6d6d-4423-9169-698a86e2852f", "value": "T1BAB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022451, "uuid": "1505f719-250e-474a-8914-f14da3428894", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022451, "uuid": "8457dc7e-f2cc-46bb-9956-39c35e3672a0", "value": "6144:uexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7zpUlLaEx:ueZeWSpda70ADIgSoxgUW/zFun7OJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700022451, "uuid": "ee4bdc65-f9bd-4b1b-ae4c-387ab4bc8699", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700022451, "uuid": "219cd26f-38d7-452b-a123-81ed481c85b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022451, "uuid": "2c18181a-63f0-40a5-a184-5521af51e73f", "value": "unito.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d479fd3-83c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058425, "uuid": "b34f64ba-a363-418c-b3f6-6984cf406523", "comment": "Malware payload", "value": "4fc54b7a8cf418c223e2a63866912930", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058425, "uuid": "7303659a-fdd9-48e9-9ed1-98dbc03ea262", "comment": "Malware payload", "value": "a56f0f054bd35ec2153c00022e9c811c24e2a352e7e1a0e7c23daa96d86da910", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058425, "uuid": "507af52b-8530-4b10-a535-3cc1a7748fb1", "comment": "Malware payload", "value": "233f8c050f608fb3d2a2cc5303a91ef82fcbc292", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058425, "uuid": "5a8829db-bf78-418e-b158-1cfdeb9ea0ea", "comment": "Malware payload", "value": "228b11fd8f74bc3b697bf86ea09202008d2cb363c19626532e8d70f7743ae28f225ef6376201ece5f54f409c614a402c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058425, "uuid": "895cc44a-1c98-4021-a49c-51cb83e47e6c", "value": "T163B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058425, "uuid": "d474a829-7df0-4df1-b6a5-f90527dd5613", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058425, "uuid": "151bd0b4-dba9-4e59-8cac-5bb0e8009b58", "value": "6144:9exbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7hpUlLaEx:9eZeWSpda70ADIgSoxgUW/zFun7OTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058425, "uuid": "ca1d6687-4219-42f1-82c4-80c6b25eeb15", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058425, "uuid": "cc48b65d-208f-48f0-927b-73f435302f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058425, "uuid": "378e8787-ea42-4631-b849-d58333db0ae8", "value": "wizarddaemon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971cf679-839f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700043195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043195, "uuid": "271eac17-6e06-41e8-9d6a-339ddcc5ab81", "comment": "Malware payload", "value": "749bc94e9f2ab6b495971230c5fdfd0a", "object_relation": "md5", "Tag": [ { "name": "CobalStrike", "colour": "#24FD6D", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043195, "uuid": "1d77dc40-ee60-471b-ad45-17fa3310c228", "comment": "Malware payload", "value": "a7382872a48a55f433257999b847b4ba8c26bfa1a565a819967a410033aa346d", "object_relation": "sha256", "Tag": [ { "name": "CobalStrike", "colour": "#24FD6D", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043195, "uuid": "d4a248c7-dab1-4817-b990-904ac713ee64", "comment": "Malware payload", "value": "8e5a6529841bf17936431d6936302046e2797a43", "object_relation": "sha1", "Tag": [ { "name": "CobalStrike", "colour": "#24FD6D", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043195, "uuid": "72b80fca-60e8-4635-b2f9-577b215eda20", "comment": "Malware payload", "value": "3d9bae921cdf26a46f3c5ce4840992a983597df2f082ad04db9bc32622be83e0a44821a829046c5416957cd4bb7ee3f1", "object_relation": "sha3-384", "Tag": [ { "name": "CobalStrike", "colour": "#24FD6D", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043195, "uuid": "bb373347-5d4e-4157-8bf3-b75579a941e6", "value": "T1E6E733A0F8F9061BF2A6DA31E93141DB71DA206CDA23BC2757339186DDC74E71712BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043195, "uuid": "87795681-f44c-4c4d-97c0-a3b97f29e5e5", "value": "1572864:PMcdwrcQt5SvkcWgZiud8HANH8iMgqwj7xCiSHRzCYaCFykmOpZQc+k7h1uqH:UOwrcQt5V8ZN8mxMgqwj7oRzCzCF7p6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700043195, "uuid": "01cbd656-3a65-4c4d-b277-9162c9503672", "value": 69299023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700043195, "uuid": "52ac213d-44c8-4729-9cf0-ffe7456d2970", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043195, "uuid": "2d4b38bd-1e6d-4a10-94fd-79c40157878d", "value": "WebModuleBrowser.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f7353b-8354-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700011001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011001, "uuid": "5a9013d7-6326-4331-962c-9340a1c926c5", "comment": "Malware payload (AgentTesla)", "value": "9bb7f3b0c32cc58c27054de628206cee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011001, "uuid": "fdce8f97-061f-464a-987e-2be37cc9fcf5", "comment": "Malware payload (AgentTesla)", "value": "a999fa0b2c139c85ebb6a33cc1785777a333ee9b491ca696d776887f6d0400bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011001, "uuid": "4fcf6a12-918c-4acb-878c-77017b1ec11d", "comment": "Malware payload (AgentTesla)", "value": "5fd5e46dc9a53b5af49fcac45f52d3ccd60114b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700011001, "uuid": "0cd43a7c-d5b7-4bd1-ada8-81637a03db7c", "comment": "Malware payload (AgentTesla)", "value": "4e10c8f2fd370515182931862f7822c1bc94fa37de0b9842e3af2038a975836ba0ac82e51e2c9aa03cffae9695e2d838", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011001, "uuid": "f96f8cef-aa2e-4f13-a8ca-c64f00655390", "value": "T1320507BF6B8C213384B9D693C3A3E066F17FC8A7723A5E2524D3DA914687A0774C521D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011001, "uuid": "a202fec9-e70c-4b5b-921b-37b1e34b3ce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011001, "uuid": "ecbd98c6-3305-40fd-8778-789f0497788b", "value": "12288:DSprtFnXkIxN/9PCfsC6jf0ftLoydvr8yj2+/DV+3:6pF0AN/S2fstsyw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700011001, "uuid": "a8511f78-b1dd-4ef3-896d-a2fec95d78fa", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700011001, "uuid": "f120d9b1-0509-41d1-af04-77060ed0ea76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700011001, "uuid": "0b31906d-ed84-4d4e-aa59-d4b369fb1202", "value": "SecuriteInfo.com.Win32.RATX-gen.5138.32043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74683935-83ca-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1700061605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700061605, "uuid": "69c7befa-c0cc-49d9-93e5-6de18fe58f3f", "comment": "Malware payload (AsyncRAT)", "value": "b0f2b902c66d71756f785eb099001989", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700061605, "uuid": "480937c5-1a52-47ad-ab39-49ce3bbfcfea", "comment": "Malware payload (AsyncRAT)", "value": "a9b516990db5fb757d5745cbca218fb6996562af0454dc3820403890d77abcb6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700061605, "uuid": "8e9260ed-7a7d-4170-9afe-618d4aa82f88", "comment": "Malware payload (AsyncRAT)", "value": "163511b438a862ee53b63bba267efdf4dbc5ed75", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700061605, "uuid": "66cb6265-3eff-43f6-9927-90b1487aa5a2", "comment": "Malware payload (AsyncRAT)", "value": "30a525360dc71a51d7a4bf24c8d03560d3404d88f28db37d75a8c2ed784f4cc0f909b31e1ff2aa3afca2f357c3a22ca7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700061605, "uuid": "a373a59d-327c-49bf-a6e7-984a35295eeb", "value": "T15B83E72037E8A015E3BEDF7458F7694086F9F45B2A12CB8D5CC4249A4522F878D91FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700061605, "uuid": "d88bc5fa-a5ec-4fdc-abb3-9c8ce03df538", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700061605, "uuid": "aa1e6653-5a2d-4b30-97bd-d294fbc3572e", "value": "1536:x6d1aPk8kVCrKuHUYFLCb95bFAPiDkjCClbo0rITGdxFjMvK3YpeGm:x6naPk8k0KuHUYFO5bFvAjCUnOuxFjZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700061605, "uuid": "22f24862-e5fe-4671-80d0-8cbf4021d915", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700061605, "uuid": "b06b7cec-9762-446e-ad3e-def990b5fe23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700061605, "uuid": "36e4448b-5ca8-4710-8ada-c7c251de3566", "value": "b0f2b902c66d71756f785eb099001989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da34257-8398-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700039985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039985, "uuid": "b3b94737-c11e-4fdf-a3db-c7dfd862dc56", "comment": "Malware payload", "value": "d3ff3e08a24b58c1fda9ab30d9640a58", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039985, "uuid": "cef4bd15-ee04-47a1-811f-50b8f6a13a08", "comment": "Malware payload", "value": "ab0b4acbb22f1cd54d35446d3edce16d9346d213b63fc14842a841df6a048617", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039985, "uuid": "a5eba747-b2a8-4929-bb00-106a6b67b1b6", "comment": "Malware payload", "value": "befab96b358e8aed3861c0ae592c7de705addb32", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039985, "uuid": "ca9f6d4f-e0da-4494-8c19-c81d4fb00269", "comment": "Malware payload", "value": "d118d7a6de0f0aae46d7cb5ec9eb0e9f7d49bba98a4ef4f7c4e19d042c9b86f9b13bc8545af0ea2a8e841ed991fd62dd", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039985, "uuid": "4acfcfa4-79e7-4c41-9155-3d597efc3cbf", "value": "T197D022098A4CC1A2C15204178098FC88AD0EF48428F2D89C5284DAC69C820E1DD08BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039985, "uuid": "1129f7e9-5289-4d58-b5a4-f84edbcb4206", "value": "6:HRYFJb/5sZOC7xVY3Qvyc1yc54vVG/4xHn:HRYFJDpCNVSQvhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700039985, "uuid": "e6dd34fb-68c1-416a-b5c6-889fa7f4b9a0", "value": 195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700039985, "uuid": "6353eb10-0b36-4162-937e-9d95a8f4a731", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039985, "uuid": "c7daa469-59d2-48ad-905d-c5f015a9c88f", "value": "Direzione.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7543da66-8367-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700019086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019086, "uuid": "e7f22bc6-718f-449d-bd2f-5aba741beabc", "comment": "Malware payload (njrat)", "value": "9bc7730e14189753be3c8c680c12d3a7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019086, "uuid": "f567f9fa-c4cb-4c84-bb04-398b7a2f26f5", "comment": "Malware payload (njrat)", "value": "ac8753ced58a7ac1ee13dc6de9f1007cdc10e9be93e398f4fa64689f2ff22ae7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019086, "uuid": "774f70bc-10d2-45f7-89a7-28134f9bfefd", "comment": "Malware payload (njrat)", "value": "eb9948206b454f948b87bf0a7e797a0fd5d34c8f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700019086, "uuid": "deb92632-0737-4670-b440-8d77a3818bc3", "comment": "Malware payload (njrat)", "value": "8976d0d7c38e6c6e5673503760850f67fbd0b67be9a23a258f10bf2fa9bdf737e19d4d8d81d4050b34c77d254f702ed7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019086, "uuid": "378e7866-ffb7-4ca4-b85a-af4f42828726", "value": "T19345BE537908EED0CDAC0030C96EC9B606667C7698901AE373F97F5F5DB26A0B91B90D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019086, "uuid": "02d2bc9b-bcc3-4372-a67a-82a769972dae", "value": "b3295e259e3c7d46d0d35596d3de7e27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019086, "uuid": "976c5097-c409-4f50-8714-b1c1424744fd", "value": "12288:4FD+ahx/IY7/yR91MMo539cncz8sHGV7g4Wa98D1twkT3ll5GgzHPnFo8lRUfrqw:wDHt6VMMkzHGV7g4WHdigTi/mAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700019086, "uuid": "103671f0-6c75-4e84-8309-c8c85b007764", "value": 1181696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700019086, "uuid": "a3f9d6fe-a111-4db3-be20-a4723948bd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700019086, "uuid": "3c0a7500-e024-4c56-9e17-f007214e7123", "value": "9bc7730e14189753be3c8c680c12d3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb49159-83e7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700073994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073994, "uuid": "a141f758-dc00-41e2-b435-a423b77461d9", "comment": "Malware payload", "value": "22ca610098805557434a4b2810329689", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073994, "uuid": "54b86f8e-40bc-4f85-b2f7-8765111b515b", "comment": "Malware payload", "value": "ad208fe787c74f455a317a5050c3462c8236ed6e3c58f9c6082147ca09902335", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073994, "uuid": "54ea1410-1ad0-4b86-bcbb-02d2b5a2aac6", "comment": "Malware payload", "value": "23cf1f231d4b1a53416c3f72accbe8e21b4b1fc3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073994, "uuid": "f660d4bf-6e67-4fb1-ae4c-a38b5fc33a3b", "comment": "Malware payload", "value": "371973f8e9f67df33db6d6669ac11766b5209f3ae4595201b7cbdb7d2e4c0d56d79e103522e83d63fe96f23878f5f3cc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073994, "uuid": "4674e1b6-d3cf-4d9c-8c62-e91620e27fa4", "value": "T117953387312F260DBC5AC7F34AD1E7A55752BBB1036FC2B9FDEA754C31A4C868842249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073994, "uuid": "4837f3fa-c95f-47c1-8e51-ccf284d837dc", "value": "49152:0kVgTbHTs6oLbLvnlfRzlPlJfhQKyd2jgC0c+QXjI2yD:2TzTdoLbLvFRzljJed21+yjIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700073994, "uuid": "5ded37cc-0222-44dc-8a09-7acf0f9982d1", "value": 1962198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700073994, "uuid": "7c1831f9-33d8-44ba-beca-a11e41ca6a4a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073994, "uuid": "a9289fa2-3c11-4b41-a08d-5efd37be690c", "value": "Quote EXW..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7be28e4-8370-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700023171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023171, "uuid": "053edc1a-a8c0-4eab-a309-37592f9364ce", "comment": "Malware payload", "value": "50556a1f28c62ea6ffb44887337fd014", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023171, "uuid": "a0f65f4f-f6c4-404d-8ff3-bbe719144e5b", "comment": "Malware payload", "value": "af32907430cff27948a020b20e76c590d6561e1a9f7464d7071fc4d5c4db7b1d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023171, "uuid": "499d03a7-8aa5-4216-9bc2-9db5a6496879", "comment": "Malware payload", "value": "77d7a2f11356ff2f0a61edc901b16ae8ee6f3c5a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023171, "uuid": "84f36e8f-c1b6-44ac-b734-64189fb40cba", "comment": "Malware payload", "value": "48b4d6122bd40f390a4e63b5b7d1ac7973cae26bbb9ec5a0eb12fd2357582085b70473c76266d5d50a349f4fdafbf0f3", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023171, "uuid": "dde174c6-31e6-4dda-ae6e-01e97973496a", "value": "T11804AF11759181BBDB9E223854FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023171, "uuid": "017eb51d-c984-41a6-91eb-5383e42eb85a", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023171, "uuid": "79d112c5-26ed-49e0-b4ef-568d4f0bdc09", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLvbVaKoXAxOPYe:I74elpowsxizqyStZlpel5LyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700023171, "uuid": "3eb5feb0-67a5-4bcc-85b2-acff18af6979", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700023171, "uuid": "5717b57b-6464-4951-95a5-21cf8a542840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023171, "uuid": "3c0f5d30-b94d-4da9-94a8-053ffdd86d18", "value": "WCUtil_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc05707b-83c1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700057886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057886, "uuid": "89e85e1d-c0ab-44d6-9c99-68e459bab13d", "comment": "Malware payload (AgentTesla)", "value": "4fd23b69a770685097881ce0a9428c88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057886, "uuid": "0bc20a1a-4797-4954-a9ea-527006fed35e", "comment": "Malware payload (AgentTesla)", "value": "b051fc9f064e736c6293b5f0d074f4fd3cbf145d0885b9a44539c8fbd4a15621", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057886, "uuid": "99bb8344-203b-4936-9d3e-2ec0005f23e6", "comment": "Malware payload (AgentTesla)", "value": "ccb1f1b61aa91eb71b6fa37567b23d1778d760b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057886, "uuid": "a6a62762-4051-4a78-910d-cbd10b626613", "comment": "Malware payload (AgentTesla)", "value": "7a2f2c7e1dba768475d6a435d6cde4c80e40acc3a676eede0c6d2478dad0a1ef3184f284bfcbd255fa86b65644bf83ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057886, "uuid": "e5267787-6b3f-4308-8c9a-395911501f73", "value": "T150156B66235BD60EDB1A0970AC1917E836F36C139554BDAF0E1271EDB2F2670F40A1FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057886, "uuid": "f17ba4ee-0adb-4740-885a-25dfdbee0224", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057886, "uuid": "bf9c97bf-f4b3-4b2f-868a-124e0358e978", "value": "12288:XNWXGlenLaDb8PpSUCNrkhcLwvEzofPi0QCDw2I3mkx21V4:4jO/eczL8uoVQCDwtx21V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700057886, "uuid": "f27fdcfb-3687-4b79-8c4e-bb1bb56427f9", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700057886, "uuid": "a2fbb7cb-454e-4af4-b56b-25fac6ebca62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057886, "uuid": "c28467c2-f860-4855-acf5-2ebc5ff9fe64", "value": "Technical Review Report_Blank_F05.CP04-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e568f3d5-83b3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700051916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700051916, "uuid": "b61dcfe4-1364-4120-9476-67277aad3ada", "comment": "Malware payload (AgentTesla)", "value": "c293aadb41e92b85ceb614a80ef00523", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700051916, "uuid": "8f03289b-a747-467c-9674-8b888111a8ae", "comment": "Malware payload (AgentTesla)", "value": "b1e5d0c3a97d2c9fd511f7991e33b2782f6dfc92ce9310e098e7fb53f6c4e3be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700051916, "uuid": "a07e52ca-e702-42fb-9ed8-202b8f9184dc", "comment": "Malware payload (AgentTesla)", "value": "c765c6f6aa72384efc99c9a1d6aecddffaef6ec2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700051916, "uuid": "474d4abe-ca49-4f61-a8be-c1e6a7306299", "comment": "Malware payload (AgentTesla)", "value": "19c6ef5423e30e1912beee8f8f378d36387926f6f07bdb810224bc4644bc0a66925352be55c17ef74105b8f854b2aa39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700051916, "uuid": "67c0d28f-7f82-44f7-b900-cb12e2b15a32", "value": "T1CDD41208B21DAF7BCAAE18F72DA26347437A42A75153D3831DC6F0E848D57D92E062D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700051916, "uuid": "f4659811-aece-45fb-ab8b-5918a12f493f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700051916, "uuid": "53f541b7-00f6-44e0-8601-cbb62cdf1908", "value": "12288:m9qJ0NuP58LT00WrrjyfetIEK5/je5fAArGIX+LG3ECsfO/vZB:V5Jzr33gM4MXX+LG0tG/vP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700051916, "uuid": "9a0a5e80-42e6-49b8-81e6-a5d375ca147c", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700051916, "uuid": "babd20f6-2c0a-4df6-8e2f-aacf56a890aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700051916, "uuid": "29cd6e68-c9d7-4093-8817-7efcbf974b74", "value": "SecuriteInfo.com.Trojan.MulDropNET.68.19983.18831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22944b0a-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044717, "uuid": "dfc779fa-dfba-450b-9244-04d62df214ee", "comment": "Malware payload", "value": "b8835bfaab0bd1b9b4c5f5dca55abd60", "object_relation": "md5", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044717, "uuid": "cfffecc6-458a-4bd1-8702-7d640f125342", "comment": "Malware payload", "value": "b312181bf94aea26d5f11a6bc046b8e8858328f1c8ac2b199100a08d5c0d4e87", "object_relation": "sha256", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044717, "uuid": "7c5b2600-0274-4865-93ae-29c5544bcc42", "comment": "Malware payload", "value": "6336f4a500f59348d2007b47310c57682e580bee", "object_relation": "sha1", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044717, "uuid": "ce7a9d84-fab3-4962-abb8-c753c12c2dd2", "comment": "Malware payload", "value": "94edec0e51729a12971f7bfa9f1269fb3aa83a12d9bf6f7c520ce76bc4f4c58e8fb48cfd5fbbb1cd2e0d343456953836", "object_relation": "sha3-384", "Tag": [ { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044717, "uuid": "daba8392-3cdd-4683-8609-fc53c4efbf4f", "value": "T12A563329EB9DD59FDF46CA8E9181FCC1F028D71EA89491ACDB2101A6D37E43C44EC19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044717, "uuid": "540cf782-5ab3-4d1d-b822-379c1406b140", "value": "196608:EXSzek2kUmlY5ype5mfqmdXU1HnXFoEJ+Rp0bsv24:KSC3m9g5mtXm1oxPvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044717, "uuid": "8ee4036c-7b5e-4350-a967-05889af5a979", "value": 6440786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044717, "uuid": "ab2fb518-fd21-4af7-80dc-bc97afe9b652", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044717, "uuid": "5c1d03be-5013-492a-841e-c3fedbcb8fad", "value": "respondintegratepro.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e360c0c-834f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700008713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008713, "uuid": "7f3c3a98-0ee7-4693-aa8e-d99ac4d85bae", "comment": "Malware payload", "value": "7959aeb15083f9df755ba381ef97b596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008713, "uuid": "fcd5bf2f-be1f-4b21-ab43-7a9c9e89a395", "comment": "Malware payload", "value": "b3b3761301129116546060fdda707826c64c631f45c7af948a809fc4e81cd87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008713, "uuid": "d97b93b4-b077-492c-b4a1-7492b605ffca", "comment": "Malware payload", "value": "2c3573df3906fb0aaa1375aa3d57d4577c04c635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700008713, "uuid": "88621847-d8cc-4ae6-a69d-24939d97c559", "comment": "Malware payload", "value": "dbbf4202bb663087327745ee4744d7a506d313c9543fb9529918ab265eeb9e35590ba684a2bf9b58017a4df19435c58c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008713, "uuid": "fece0f7c-9ecb-4557-8e5d-c9462d5105f8", "value": "T1D0946E0879E3C03EDE2316B9969447B406FE791013578B8B7FE90BFE86F85D185A0636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008713, "uuid": "5c04e300-3a51-43e8-8bab-f6e081b4e78a", "value": "21e0e8ef5bfebf9362c851b68dae053c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008713, "uuid": "1946a415-318b-4911-b527-5b5ff7311855", "value": "6144:dmnttntG3PuxBHhbOsAOgi+io15D2T0/QBKjeabbbbbbb7PH93d:QttntGfkOsTKkT0/GKjeWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700008713, "uuid": "ce3310d2-8a87-4783-8df6-43f379a0898a", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700008713, "uuid": "54506775-10dd-4d6b-bb05-ce20de0815f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700008713, "uuid": "d6acf283-e480-463d-9874-3ac4ef7b9d7a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.706.18062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a7de2e-83c2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058060, "uuid": "ba136123-7142-47e4-9125-b281325defcb", "comment": "Malware payload", "value": "7336d8c0eff6e1b70256924c0d5ebef9", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058060, "uuid": "2d69676c-a31f-477f-b9c6-336b7f3359fb", "comment": "Malware payload", "value": "b6702aff8b11508caf4a291f7580eeda872dd8d8d46b31bd342828fa23124e46", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058060, "uuid": "5c530097-9a53-4c7a-ad6e-2acdb37545a6", "comment": "Malware payload", "value": "fbc0ef31575f3ff9f7fea14171859826a6c1efa7", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058060, "uuid": "5c8b2c23-cd47-4e76-9656-dd8cf4e6d126", "comment": "Malware payload", "value": "a8bfae86f1721badcbbfbd54a34f6fd543b70c081359bc12567b74942685054028cd296968a24373f4be8d991e62c4cd", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "fakechromeagenziaentrate", "colour": "#AC56AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058060, "uuid": "4a8e382f-4fb0-44de-9193-17e931d6f792", "value": "T11135233A7E6251F167C7A7B3CB5025FB0B20C8F1AE752AD37515195B28CAE209CC5B2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058060, "uuid": "69d89773-6fc8-4d8e-9929-5b83a510e70d", "value": "24576:dYAPXJ2DCG05cMP42dZKAY2PYU2TNkFuBdRxpVRVG2HqKUtD4A3CUg5:dYi2DCGbsyEWNkWBGCctMASUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058060, "uuid": "fd82065a-8dfb-4aa5-b1cb-12482ff91d86", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058060, "uuid": "c41321da-c6b7-419d-babb-018b3165081c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058060, "uuid": "b64454c7-e379-4b7a-9120-21594edfa29c", "value": "b6702aff8b11508caf4a291f7580eeda872dd8d8d46b31bd342828fa23124e46.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888282c6-8376-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700025561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025561, "uuid": "9149ae90-c2fb-464e-92a5-0582be7fb83b", "comment": "Malware payload (Gafgyt)", "value": "29ba86507a969e6ed343dac735d9110d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025561, "uuid": "d3ecd5db-30ad-4ceb-8871-9429df99dff1", "comment": "Malware payload (Gafgyt)", "value": "b6ee6cc4d468044d42a71e0cc4ae1b15a352baa52e84671f8a0e8bba743e8788", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025561, "uuid": "bc342d8f-df7d-4931-9f5e-96df466d08e4", "comment": "Malware payload (Gafgyt)", "value": "b2bec1e1477fdb437fcc7c88c2d0f06f0f4c015f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025561, "uuid": "e23688c1-9a07-4525-9587-37ce3de561aa", "comment": "Malware payload (Gafgyt)", "value": "41e8bf909b991b1138047a2bfbe8a5e1d5b07cc2f7c414130cf5d8c81885d96508a51cd00a96b1dac179a0a066e76a31", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025561, "uuid": "be93f362-3688-4c24-a16b-cca50e518beb", "value": "T1EA03F1A9B2333E8ECBA4633386C755773104DF0525B1360AA3B674DF64AB2528B4DA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025561, "uuid": "e6fc8562-f17f-4349-b842-06f558378470", "value": "768:rJr3M0pcuCqxYGMupgCik6r89j5dqvqI9tQDHoxM8x:rZM4eupgCik6r0jKvL9uDIeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700025561, "uuid": "fad686f0-5b40-491b-824d-698723820ad1", "value": 38680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700025561, "uuid": "95f2e0c1-b765-4da2-943b-b6114762bfd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025561, "uuid": "a23a278c-6952-4f8c-83e9-2f5ffedd6fe5", "value": "arm.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe546ed-840d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700090535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090535, "uuid": "9f66664c-6ef5-4368-a21d-883595f285bd", "comment": "Malware payload", "value": "af3b051d8a6a33705bd095b6d5608355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090535, "uuid": "3c2d45fc-5298-46d0-aa58-f75136b26e4b", "comment": "Malware payload", "value": "b760fd1b8d86af6b67ac24e6a269f2ffbc818d37f7930fb562cce1331213d031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090535, "uuid": "d2124703-27b7-49b3-858e-dcec5ffceea9", "comment": "Malware payload", "value": "5d40bc70952705708d9bd87f1057e3e05d941b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090535, "uuid": "0e6ae02c-2889-4672-a2f4-1a62e7bc8bb3", "comment": "Malware payload", "value": "c9babac22be31f932b964a03a7809516d55de7dc47088e779870459baa195b3486ad681a673b61fb9420e497d23b913c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090535, "uuid": "679ceac0-ed55-4656-92ed-1d9a534c901a", "value": "T1E944293392D0BC55E926CB728E2EC5F8761FF9509E497B663228AF2F14B1272D173210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090535, "uuid": "2aab7b6e-5e78-44fa-8710-ef3566e10924", "value": "fb752e503b6d05b37aeae46cd3910859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090535, "uuid": "16a42125-5adf-4e42-a8a5-8ac675ef3150", "value": "3072:lNL7jL+5ScekHLTlZGTfobBKgJLR2ghco9CR:XPL+ocFHPlZGQKpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700090535, "uuid": "b30f3a43-d5c5-438e-b025-05788f8abfc9", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700090535, "uuid": "2e185bb2-f693-43ea-b624-4ab44016d3df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090535, "uuid": "a90eb9e5-0857-4280-8568-231d9b345d47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7af04e0-83cd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700063006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700063006, "uuid": "ba329bd8-bfde-495d-899f-32e6a48853a5", "comment": "Malware payload", "value": "8c25db407a860024f7afdf84badcf4c1", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700063006, "uuid": "8e72cf0f-ef22-4f70-ba96-422d8a883e02", "comment": "Malware payload", "value": "ba3324366a76daea76cb9a0d78c5367085091ec5efa75eb41120d66cee286881", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700063006, "uuid": "28114024-8241-4359-aeb2-c4b7fb9e62c7", "comment": "Malware payload", "value": "3bc12c6d7b4a3cc1472317bef2654bfa843f774f", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700063006, "uuid": "dad289dc-eaeb-4034-8abc-525b4584d9ec", "comment": "Malware payload", "value": "49ab5cb7eb6b78e6975886f150a655d183db0714dcdcc33a1d87e6e74b561e861f08ddd957a1bbc9825f69cbe1013b7f", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700063006, "uuid": "87827f8b-df5e-4773-b6ee-ae41a82cef4f", "value": "T1C634F110B181CE96E351817A5CF7DAE9B136FC883D41E1077290BB0F3E706B65E66B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700063006, "uuid": "bd371a6a-b400-41dc-a79b-7795400ae996", "value": "6144:52LHjFsDv3HM3FU8GWfqfeau1+iQVnbD7zvBhlSE:ALHjF2/H27fq2hwiQVbD7dh0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700063006, "uuid": "62d06a69-7cd8-4074-8f4a-593ebce68b1e", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700063006, "uuid": "0e808f50-c92b-4143-a3a2-ed6595d0f372", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700063006, "uuid": "5380b09c-5301-4bd1-867f-fb0a9e2f247a", "value": "SecuriteInfo.com.Script.SNH-gen.12817.4151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff40308-8399-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700040606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040606, "uuid": "d997d97b-c22f-41c9-a786-f8c7709698a0", "comment": "Malware payload", "value": "9cd274c747a6430ada57a91774245468", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040606, "uuid": "a546dc52-f5bd-4a70-b8d1-99fc43080a89", "comment": "Malware payload", "value": "ba3b6093e676d0d4ed3832efc496ad3a1b7c24e9a27574520c7b54e84b93de32", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040606, "uuid": "ad0d8d81-41b8-463b-9e92-332668564a06", "comment": "Malware payload", "value": "d30238254b4b79504a7f109f1cd414dad73db7bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700040606, "uuid": "fe7ff3a6-087f-426c-94a8-88ce85eb8e71", "comment": "Malware payload", "value": "6876c33fc56996ae82aa2f0dd274921da630480e6263acc3fc6ec268e66552de6117e425cf441075ed283f260b2a04d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040606, "uuid": "f5c68f8a-8c76-46e8-9526-0805242cecd8", "value": "T11806CF139AC68077D96B02304D6A775FE6FC9BA44174D693738C2D09ABF02D2B26B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040606, "uuid": "00edd68f-94b3-4938-b075-b31dc013c05a", "value": "6ce276c8483d8fa9331cdae0855f96c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040606, "uuid": "9599db77-851e-47f4-a625-12539ae712de", "value": "49152:oCobtSmY8KMUQ3ua2YdlStwcY6HRrnP9sAvUrrb0YLEavwIOgeXNwsKW+G0MU0:ozQNMHuhYdQ5YsdP9hGr9s3kU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700040606, "uuid": "eb8cdaf5-9d2a-48ce-a5ae-8b8bc1c067fc", "value": 3731448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700040606, "uuid": "9297b8b4-a7d1-4e7b-af66-2903ee793c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700040606, "uuid": "b84faf1e-82ed-4d80-9e98-66e711781952", "value": "SlobberShoddily.conf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff35cda-8400-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700084710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084710, "uuid": "ee5ff14b-8cef-491d-8dcb-cd16eb58c241", "comment": "Malware payload (RedLineStealer)", "value": "a28a27b6c23e122e4523364f7328ed2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084710, "uuid": "842f9aad-de34-4040-8868-440f2175ff8b", "comment": "Malware payload (RedLineStealer)", "value": "ba87c237b03a3a5a54273ccded35d16559f33678a76f05ce856389e207b68046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084710, "uuid": "c6e78ddb-6c11-4fdc-b382-d8b255832b97", "comment": "Malware payload (RedLineStealer)", "value": "fab7abf1d8a28c24660000e429ffc5bf269d3205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700084710, "uuid": "4a32ca96-0ef6-4699-8d5d-be8d9826b7b7", "comment": "Malware payload (RedLineStealer)", "value": "e3ae03c0c501e9d0a2c9ce9950c5bf6bda974dbccdc66169f7749477412aea98595e84ee75f335cb98db69826c40c92d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084710, "uuid": "2063b1a8-176c-4fba-a83c-6aaea57baa18", "value": "T1CC442867A2D0BD54E926CA728E1FC7F8761DF9509F497B662228AF2F14B1072D273310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084710, "uuid": "78560b70-0053-4ddc-8a32-9efbd04a5005", "value": "f62af2e8b5dd9dbbfa6927c42dc35c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084710, "uuid": "174e5602-e630-4503-82cd-6d8bd0f33030", "value": "3072:A7RpLqsnBHKmo+0kWE23iyofv7XcMY5YMJvROUQEeck9CR:i7LqsBqmoEvZyeser2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700084710, "uuid": "b0ce14c7-915c-446a-a1a7-2bee7ef4fee8", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700084710, "uuid": "c449cb6a-7885-40fc-92d9-e03f1a3bdc7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700084710, "uuid": "f7eb8b09-1a0b-4435-8f23-3f49ecd95c2a", "value": "a28a27b6c23e122e4523364f7328ed2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa559a0-8386-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700032230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032230, "uuid": "c11b70a5-3591-466c-90a1-23ad513c050c", "comment": "Malware payload", "value": "fa3ece873e9555cff2d0a45fd60681a4", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032230, "uuid": "4d5027f1-9509-43f1-9fb5-1bd21472e41c", "comment": "Malware payload", "value": "bb4d377bc3a7dd434ee93d3de114df09e1985dfcca00d344d9ad656dbbc07493", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032230, "uuid": "b245d6ca-3a37-48c0-895a-cda7133590ce", "comment": "Malware payload", "value": "f851d68f5c06416fd9183cd0ffc947a69c29b1bb", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032230, "uuid": "c0727187-4ce3-4db4-a17c-190bfdc6d6e8", "comment": "Malware payload", "value": "913b55d6678da5d11f95da07dbd8974079e5ba6f9874790efede26b0c5522b8ae1ecf31149ab40a2b0b4f2badc4b4d1f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032230, "uuid": "b8e5764d-ec0d-4e1e-8970-e918e3791b30", "value": "T1D9B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032230, "uuid": "15e095db-e57f-448d-af64-70fb3726eadc", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032230, "uuid": "b361d45d-84b1-4adf-8640-fa4e232d6264", "value": "6144:/exbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7ypUlLaEx:/eZeWSpda70ADIgSoxgUW/zFun7OGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700032230, "uuid": "d0b23085-7867-4a99-bb38-5ad0b5218c90", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700032230, "uuid": "582e70c7-854a-4621-96f6-a9706b305f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032230, "uuid": "9d5bce92-ac61-4476-b856-8189eeae6ce0", "value": "proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a1fc43-83c1-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1700057690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057690, "uuid": "6e4dda56-c2c9-4e25-86a4-708b00163c55", "comment": "Malware payload (RaccoonStealer)", "value": "34b8f4812ef8821f651d1f74618d54a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057690, "uuid": "395454a0-b1d5-485c-871b-f0c5be7600f3", "comment": "Malware payload (RaccoonStealer)", "value": "bdcb0564911bdb1f151d4f58f82bce75a8c861ee251ea7273487a34fec865654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057690, "uuid": "755737b2-373e-4856-a1d0-524fbea0175f", "comment": "Malware payload (RaccoonStealer)", "value": "ef8e085c913d1b86847cdf89a469a773b2c71594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700057690, "uuid": "9129a8ad-74bc-4781-925a-fa4fe52eab24", "comment": "Malware payload (RaccoonStealer)", "value": "4d9583169a7191cce672faa3ff268899db2447bfddb22b644c03040b63a519bcdf00fe69fdf4d51dc4f7765ac0fe3708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057690, "uuid": "c24c7407-93f0-4a45-874b-c3b010f14aed", "value": "T189259E2138C49072EEE720F746DCFA26866DD4B4476945DF17D91BEEEA202C27F32582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057690, "uuid": "8c7fe9cc-7fb2-4cc9-9dc6-f28868de52a7", "value": "0f2421503cbb5d49fe417b88d0084470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057690, "uuid": "57144f94-c40c-4838-932e-bf9695d5d1f2", "value": "12288:QqybYkkT2QnftLyH61+/SwNpo7crbhla7HVoPcItnbuc7ySwvSyKrg7:G/kT2QftLyH6OzdA7HVstnvESyKrg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700057690, "uuid": "e8d96b5f-075e-4b19-acba-45a0a4779747", "value": 1020840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700057690, "uuid": "7d74e5fb-ca5b-4cb3-9597-93eb720c23e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700057690, "uuid": "aca25754-8497-40d4-8cb1-1ee7a2eac653", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f95a9b-83db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700069016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700069016, "uuid": "b447df49-8bfe-4756-a81b-18a78ff97520", "comment": "Malware payload", "value": "b475f7f5e666d878d53e238e0bd1dd17", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700069016, "uuid": "a52464d5-3187-41aa-aa1c-1de06bce08aa", "comment": "Malware payload", "value": "c0aa81cd918caf90384d90ebafbe293b25968bb1a6063d74e2ee998f471bb635", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700069016, "uuid": "0839fce5-9fc1-4d4d-8d7e-6a15d0dbd2be", "comment": "Malware payload", "value": "a3633882309acdd986d80fe281c2e7e4827e67ee", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700069016, "uuid": "9b2b3a01-7340-4325-9082-0d68630c6d91", "comment": "Malware payload", "value": "7fe8023b787c13380f07e0b4edda9325ff33804010725c72a5b01ce2fa267c2217a64faf89f533f1a452a97a0e412aab", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700069016, "uuid": "23a54cbb-fcc9-48a5-bfb6-bbd08d71fea0", "value": "T1001833D560E5C09B5CC482D77B893503B92BB2AA31481EF95B8C0F01DFB269637DA6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700069016, "uuid": "a896dcc1-cd06-40d5-ac96-0efe17730e08", "value": "1572864:1FRzTO1Kg7JnwSo0yiJ5DwJ2d/YLgS6opy3v8knRiaD1BuQIoo:1jHpgb3P5DwJ2dQby3Lnp1BuBoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700069016, "uuid": "4263667f-13b7-40c1-bc56-2b0425b8b2cf", "value": 89768455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700069016, "uuid": "53f97b0a-432f-4645-bb82-5328299b4742", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700069016, "uuid": "d2cf6f9d-1cc3-4b2e-982f-901ba98c89b3", "value": "Cheat.Lab.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e008cc0-83cd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700062775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062775, "uuid": "682b32f5-14f2-4c70-9586-467769b7ac7c", "comment": "Malware payload", "value": "0ea7539729f5b1df9ded3a36171e9692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062775, "uuid": "cbefc889-3abc-44a2-9a5b-94132e92b2cd", "comment": "Malware payload", "value": "c28c4cec1d98e3f612108826f92aef8d25da93ec22ac1b91523e944126ad0dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062775, "uuid": "c391c841-2549-4087-b74c-8a3ff8d16b64", "comment": "Malware payload", "value": "a37685ae35e785b1502e5bdadcacca85eabf7467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700062775, "uuid": "7714ccb0-3fd6-4c70-924c-6d4c59f1e041", "comment": "Malware payload", "value": "22201b0748ce538eb8895ea50b245ef466b202b22958350762f1e7adea672f3a55c33f6156ceb36d6923ed693c3b1e05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062775, "uuid": "57810550-ec63-4489-9890-f2cba2970583", "value": "T12F442A839290BD90E92A8B73CE1ECDF8B61DF9508E49776621687F5F14B11F2F263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062775, "uuid": "d726651b-d369-4254-9dfa-14616da2f417", "value": "840e4842bc97c9779b45301f8bbeab2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062775, "uuid": "4e0f0a29-2cd0-4df3-adaa-25a1752bdc84", "value": "3072:Wvrfw/LZmUVMthNLNog2xknaS1YsBxdpaDBA8RuYNi9ujS:7LZ3VMRNXSvDyYNisS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700062775, "uuid": "5bc289c2-1632-4ffe-8ae5-ebf7352f6f2e", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700062775, "uuid": "c035ac04-6e0a-41ae-8b74-afd4294d09b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700062775, "uuid": "62d5deed-6c1b-4f18-97f1-41514c9c4411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc80a876-8397-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700039848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039848, "uuid": "8077b956-ca81-4f76-947f-52adcc4b0b53", "comment": "Malware payload (AgentTesla)", "value": "9ca8294b417aefdaf42ebf524fa896b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039848, "uuid": "eb90dfe2-debb-4ceb-880c-7dfd584cb711", "comment": "Malware payload (AgentTesla)", "value": "c29c56a3681fb8d2f46ca4e7070f088e2e7c8f8b11c3d4218c79b91778c3536e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039848, "uuid": "1c8b2754-3183-4bd4-9497-ec7702379a71", "comment": "Malware payload (AgentTesla)", "value": "b5c5182ac9949b9729e90edb921230504e6a8d33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039848, "uuid": "c613251d-b37e-4ada-83fb-d24c97183952", "comment": "Malware payload (AgentTesla)", "value": "35cac31b232c75d3f9f41b896de59086fb5b33bf80e3cc0122b7990a8bfc68ea74927a974f2242f5658ddf313039582d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039848, "uuid": "551f7e41-a6f8-4eb9-8ef1-ad04f67cb661", "value": "T19305E00036B09E17CBA546F04B66359C7BF47C668262D7F95FA270DA38F1F71520AA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039848, "uuid": "0826c24c-815c-44c5-a543-dc6387d38391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039848, "uuid": "ecaa145e-173c-47bc-b0a8-6a0875e6fa73", "value": "12288:grrVZPYuPMlETIBgXTeGmspYXDvFz1uhV6iVNWtf4UE4g02TV6H8A9WBn:wrbjMfGmRXDF12V6iVNWRR9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700039848, "uuid": "c31d2df5-88e4-481f-9042-57764f4cbb4a", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700039848, "uuid": "3b58b037-f601-4912-961e-bd56e12571a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039848, "uuid": "0972a480-6f7b-4d1c-9491-593ce246d2cd", "value": "SecuriteInfo.com.Win32.PWSX-gen.23586.1908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edeb37b0-8370-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700023154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023154, "uuid": "75d133c9-f372-47f8-8840-4554cbe433a3", "comment": "Malware payload", "value": "801c43e2d53f18513e62f1fafeaf058e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023154, "uuid": "c3b94203-b4b7-4894-a61d-ae9508c93fb5", "comment": "Malware payload", "value": "c367c645711aeebb01f2332638dbad2b665bb9cc7e34fcc6c2eae91385da730d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023154, "uuid": "1648af4e-5731-4f25-9df0-ac68a9ace76c", "comment": "Malware payload", "value": "84ae7792da721f462d3763cd809146fe19de7e14", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023154, "uuid": "c10ba60e-d32f-4246-891e-9eeb3f793660", "comment": "Malware payload", "value": "7caa68c64cbfb7679abd966550b386c81e27cdd702a683acd14d89134dd7d2e9ce9e72b2e2b65383afd9e92afcefb6be", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023154, "uuid": "0d02f1c0-fe9a-4c61-bf22-f1c5bd650c02", "value": "T13504AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023154, "uuid": "11842b67-dc69-494c-abaf-8f560bcb365a", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023154, "uuid": "e8a715a0-4e0b-4d05-b4a1-5c923c32f230", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLqbVaKoXAxOPYe:I74elpowsxizqyStZlpel5OyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700023154, "uuid": "35dfde60-5e4d-44db-86d9-fe8758ceda32", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700023154, "uuid": "6d80ac34-7ace-4b1d-b0e7-a627c54eb5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023154, "uuid": "945661ff-0c7a-4e73-9e52-7b91fd4676fe", "value": "WCUtil_4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc37cfa-83af-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1700050130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050130, "uuid": "52804809-9e90-4f40-a362-d60b387b7466", "comment": "Malware payload (DarkGate)", "value": "6696048e8c881d11d34693e7bd489914", "object_relation": "md5", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050130, "uuid": "4800dffb-136e-4419-91df-8b3c77fb87fb", "comment": "Malware payload (DarkGate)", "value": "c38255b259f5e552c33142d192afd438f824773dfcea4eb31c707ce86949464c", "object_relation": "sha256", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050130, "uuid": "0cbf661e-67c4-48c6-917d-dee8ad31d7b1", "comment": "Malware payload (DarkGate)", "value": "006775ec7d52759c9332fca82511f2393cca91a0", "object_relation": "sha1", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050130, "uuid": "0471ca9e-4223-4508-9539-bb91f055793c", "comment": "Malware payload (DarkGate)", "value": "1f36e806cd9e3610cd4b464f778f628d7c59e5cb3457150a44c768cb7a1603f70788bf139cf7d6f58cff5d34cefb8277", "object_relation": "sha3-384", "Tag": [ { "name": "A11111", "colour": "#6144E9", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "faststroygo-com", "colour": "#6AB51A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050130, "uuid": "e4500c7a-6499-4c65-ac29-07ab1eb0b301", "value": "T195B47A337EF8978F79EAC452DC6A5B22AC1F21DCEE301648C598344D1ED90AB045EBD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050130, "uuid": "4ba42307-fc21-4216-a60d-07e1cd19a91e", "value": "12288:HoaijGVpGRDtP4h6TJOIiTRmyNmhRq1Mprs4D9S5E:I/JRh4GSx8KMptSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700050130, "uuid": "2db12938-bd1b-4248-bbf9-9099f3d654b5", "value": 502874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700050130, "uuid": "6e7a9c7b-53f0-467c-8393-736cf2975b17", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050130, "uuid": "42b69e18-3ff9-45b8-a1f0-c9b35c20e027", "value": "hgfkkdd.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd199165-83e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700074666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074666, "uuid": "29bb0ae0-7077-4844-87e7-0edf70896b4b", "comment": "Malware payload", "value": "06e2d86298746110ea703acc31c66323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074666, "uuid": "8a0553f8-6d1c-4717-b35d-9c454f6c7828", "comment": "Malware payload", "value": "c3f6354c94ae880d0254f356f2836aaf4aec81b903e4054f75f6e517183e9fce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074666, "uuid": "9a9ed047-d4a1-4db6-af12-09e8373e28b6", "comment": "Malware payload", "value": "b341bb06c3196103723f44a95f0b0afcb86ce1ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700074666, "uuid": "a9060bd3-c51e-4b1c-98bf-972db84ede83", "comment": "Malware payload", "value": "952e963080783e89dbc50e2f5f9150d783b7abe765daec36cbb6fb9e9578bc00ca267e4b0c25b86028d6771643a0f0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074666, "uuid": "25ab9894-7c33-459a-a1ac-54c85d38ad19", "value": "T151849D2392A0BD54E925CB728E2FC6F87B1DF9509E497B663228AF1F14B1172D273310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074666, "uuid": "12e5c65e-e61f-4b41-93ed-251d3c4049a7", "value": "fb752e503b6d05b37aeae46cd3910859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074666, "uuid": "60232ff2-24c4-44dc-b45c-66dbbeeda53d", "value": "6144:JILhVvboBJDl5mUPknVDzRbIoXMGx8DSPm1bCHU75M9X2l:yNJYl9knBSoJvPm1m0d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700074666, "uuid": "e3666964-1e1d-491e-b7ae-c22ac6704d07", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700074666, "uuid": "fee1551b-21db-4d94-9e97-ea1ed9f6b74d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700074666, "uuid": "e776bb08-ebec-47f0-8fcb-184d09211c06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86839ceb-8376-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700025558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025558, "uuid": "797ec41c-a02d-40ac-9486-e8b345ec1786", "comment": "Malware payload (Mirai)", "value": "cff1c217c8676af91fdc655f26d5b8de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025558, "uuid": "85d78ab0-52e3-4d7c-b3b1-acb5acf8b65f", "comment": "Malware payload (Mirai)", "value": "c8112fddbfed0adfa62343a770dc09984c306063cfe01e4989f8a96893fdb908", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025558, "uuid": "a71fcafd-3d47-46d3-b1c7-54ed93a22842", "comment": "Malware payload (Mirai)", "value": "4cacd542a896aa770d85a46d64d6d3cdbff8ddf8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700025558, "uuid": "780b12eb-521f-4903-a154-c94843d3909e", "comment": "Malware payload (Mirai)", "value": "d908cb485b29bb50d29927602b299e36ac9db250389979f2c83327f8ff828b0d927e5cfae5a19429066f3639a98e5cac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025558, "uuid": "3d4f17cc-6e6d-4e16-8e77-a2f4bec7903f", "value": "T17B13F10ABC81796EEBD400BB370BE7782557A417E43AD5131B4616363D593C72A3FE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025558, "uuid": "ea41d0ca-a3df-4a0d-b301-90001f1702a8", "value": "768:lJvImWQqW8NY4jozBi7EIeIhKr4u3XO41TMzom5bCDDM9T3ZA+dSKEGS572c:lJYQfrBzBVI+r4JegVKDMdZpoKTSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700025558, "uuid": "deb44ab1-d732-4450-afb8-aafe2dc5ddf5", "value": 42336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700025558, "uuid": "4f6419c9-ccd9-4c6b-9d43-a3d00579e441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700025558, "uuid": "691fd5d0-81ce-4c7a-977c-ddba3490e68f", "value": "arm6.nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597f15f6-83a2-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700044380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044380, "uuid": "b6abc490-022a-4f8f-bdce-c248b7c8fda0", "comment": "Malware payload (Formbook)", "value": "c25ee4af0d79052d49c02ebb2b71faed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044380, "uuid": "b01d1018-c83e-43a5-89af-9390e610fb7f", "comment": "Malware payload (Formbook)", "value": "c88aa06f7f7d22f3a6c66c84bf6aafd8838357d02d2287bbbcd61fb21264dfe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044380, "uuid": "e2bdd42e-f93d-4e01-988e-7e70f0204c89", "comment": "Malware payload (Formbook)", "value": "00cd811be103d358a56326bf216ec7771620fba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044380, "uuid": "e6820560-00a2-42ee-a5ae-b0d05b0ebbe7", "comment": "Malware payload (Formbook)", "value": "2b280138b7c99e481ecc1f9f77afa34f6e6e186a1eda0106888855ac7c9c96b981ce3f5d3363388d04c68399cdd97986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044380, "uuid": "bbccdc4a-4c16-4f96-95ec-812427adc2d1", "value": "T1F505F1003AB46917CBA246F45B61649C3BF07E6695A2DBF90FA3B0CE74F1F704249A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044380, "uuid": "b4be1af7-0350-458e-9e69-f2431da03b35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044380, "uuid": "726e52a7-a85b-45a0-b3ba-2cc849b88033", "value": "12288:EgvnOcYuP9D1tfcq4rgF/10k9cTQWpH8SbNJzM+KRqRir9QYcuokraU9WBVf7wjx:Tv5jJ1Nc1glJeT98SbjzhJuVm+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044380, "uuid": "4f169cbb-6748-44a7-85b4-53455906a920", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044380, "uuid": "f67d2280-c037-4289-835f-878de1cc2d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044380, "uuid": "c5f93fdc-de78-496e-857d-24aa1ca973d7", "value": "Mnp10GPUmthweWl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f13b5e8-839c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700041785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041785, "uuid": "99f435c0-9d17-41ea-9e6f-80565a4c9956", "comment": "Malware payload", "value": "141309db604d3395e527d9485147ae4f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041785, "uuid": "c7764fc2-c92a-498c-b0b8-655317fe9dc6", "comment": "Malware payload", "value": "c957b6e7aeb2e6b6af16e5da1a09ccd6d5eb139a0db5429cfcc67a0a954c9bbf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041785, "uuid": "3bbd548b-0706-4e16-9961-090305bc18ef", "comment": "Malware payload", "value": "566436290c2ecd87fecce77df7404a8843121765", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041785, "uuid": "6af6b772-6eb4-412d-af89-7b6a04b02021", "comment": "Malware payload", "value": "878c0d89a7c5a7e018c37c665675417bf8f5574e040e228a351517acc739a630a6662ab42798913538bf6713eba6a6e7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041785, "uuid": "34972ef9-88b8-4c54-978b-9516728a05dd", "value": "T167B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041785, "uuid": "abfd9a14-04be-4a91-84fd-9a993caeeb7b", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041785, "uuid": "f0fc65bd-8d1a-4045-96bc-72ce0b29647a", "value": "6144:dexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7/pUlLaEx:deZeWSpda70ADIgSoxgUW/zFun7OFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700041785, "uuid": "0df1dfcf-ffbd-4d8a-be4b-0b6c7b7418c1", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700041785, "uuid": "32122b61-5fc0-487f-a95c-24a7fddd59e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041785, "uuid": "0b0d4113-21e0-4746-b7c0-6db7759ec467", "value": "contri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f5c86f-83db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700068753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068753, "uuid": "3e2fd52a-9f93-4796-a672-f009a1dda4f5", "comment": "Malware payload", "value": "6d5c304bef8b2c32e904946f03b601d9", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068753, "uuid": "df903f29-f512-45d9-8989-80b846b467bb", "comment": "Malware payload", "value": "c9fcea3aed96b45b349ee794e0cd17c073b76a251f5dbc2285a2025e76225654", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068753, "uuid": "de2162c4-8b2e-4933-b645-aded75822186", "comment": "Malware payload", "value": "3f65c5428818508c4f532a9f1e690e5f0cd298e9", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068753, "uuid": "df06f8ee-d595-4556-953d-9a64bc9a89b7", "comment": "Malware payload", "value": "da3525d64c75570f94852238c1547b578dd72cf42b6d1d9ae02ada187c1bfc4d74daabd04ae365f06da1f8a96f869b10", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700068753, "uuid": "5fdfb800-d75f-4c85-ada6-a3571f5d0134", "value": "T11E183313B684A03FC49A17366967B712983BB66027178D9B9BF44C4C9F356C03F3A687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700068753, "uuid": "376c00b1-f8fe-4998-b215-aeb8151ce479", "value": "7e0b2c8cee523b3f3a7a127ae6de5d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700068753, "uuid": "e7c9df60-a263-4266-8ad5-bb3e5fc86f60", "value": "1572864:oF/fhqX1WAhhwFiAOPyWodm05LXfFFJAGJz0L7eNfvkIbCuYLqdEqHR:odZMHhkc4dm05LXRz0Cf82+qdxHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700068753, "uuid": "34d0e078-b23b-41c3-8efa-3dc59595057c", "value": 91739051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700068753, "uuid": "ea5950cb-3342-4d8f-9ecf-2dc8113145fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700068753, "uuid": "a9d5382e-0888-4730-810d-ff9e1579b919", "value": "Cheat Lab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083ec1bc-83e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700073020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073020, "uuid": "94ef6a84-67d9-43d8-bdc5-60845b0feead", "comment": "Malware payload", "value": "ad1f4ef175202d30916a890305ca230b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073020, "uuid": "6d586cbd-a2cc-465e-b4b8-84467d31a5b0", "comment": "Malware payload", "value": "ca45f40c10f30d2c60b2ab67afffc295763d61c890f92b4bc71885d96ac56e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073020, "uuid": "16777cb2-74d8-4d00-a659-d100187a6c52", "comment": "Malware payload", "value": "b9382557bb2eb93cde8ff52ece9ee1e58372ef99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073020, "uuid": "657bfb82-ec0b-48b6-a266-e965d8237251", "comment": "Malware payload", "value": "367d8997f8750ae2a58bf0a30db793c08d63f11985846e5a0752c4505d5b334b7f4e84e0c443f6081b38568f3d638aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073020, "uuid": "1c4ac9f7-e095-48e3-a932-88de9fc35221", "value": "T175F4E06392E0BC55D565CB72CE1EC6F8B65EF9408E493BAA22286F1F14B11B3D1B3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073020, "uuid": "8935c44e-40c8-4001-9a18-4db307586ff7", "value": "fb752e503b6d05b37aeae46cd3910859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073020, "uuid": "e82a8ff0-3ba3-4ca5-b404-6d905dacb25c", "value": "12288:F9IGRHPCWz+KoCAObHpto+VQUN4TYc0Q70xocaSyE8pnMsnW7EQdHZJCtIv/:RyCAqbPQUN4sEsaS6VMs+57JCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700073020, "uuid": "81c7ad38-4e77-4e7c-9001-7328a6531f4a", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700073020, "uuid": "0fce1307-8548-43fe-b036-855ba2c4a746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073020, "uuid": "d166fcd9-ccd3-40f9-8229-20a322957f84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd336643-8397-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700039850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039850, "uuid": "e37b4ffa-9c21-409c-a867-2173a20af74d", "comment": "Malware payload (AgentTesla)", "value": "b1bc805cca3277d33b478075d5e7b6d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039850, "uuid": "af6eadb8-989a-4c41-990d-6bdd10f1b94c", "comment": "Malware payload (AgentTesla)", "value": "ca75c3b3a4278d054eac12a4c06addf6b48ab936ed5a21f1ba652d0d209c0f97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039850, "uuid": "313338d4-a831-44c3-b3f6-39a617048e0f", "comment": "Malware payload (AgentTesla)", "value": "b4d309b5138d4ac5dbb17d05c8721c7fd9f5c221", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039850, "uuid": "42518677-f674-43a0-8c50-a76c5ad9ef09", "comment": "Malware payload (AgentTesla)", "value": "727902c38398486ba340be7d70d2c7c0f18cba37f5bde75ddf66c4922d195d292fd48b0842658af6dd104371cbd92671", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039850, "uuid": "1e313525-9766-485d-b93d-fb7729745d03", "value": "T1E205F0403AB55E13CBB58AF84762249C7BF46E628161CBFA1F9270CE75F1F70521AA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039850, "uuid": "fc5a43e8-e939-4d4e-ab56-b42b72c65402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039850, "uuid": "3aac12e7-b78e-47c2-9fed-9771506923fe", "value": "12288:Z4BxVvzYuPyxeqp8wXXAzkNkW+njiEA7SPSi9HuqFqoSYWQC6BcQZFSDEVWB:wxJj47p80UxW+nGHMYYBCaZYDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700039850, "uuid": "891e043e-55b3-47ba-94b4-c174536f64f0", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700039850, "uuid": "ad7b86df-9ffe-4829-83cc-9531e43cc03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039850, "uuid": "2c20ccbf-0187-4d9a-8b9c-bd1e38e0da46", "value": "SecuriteInfo.com.Win32.PWSX-gen.17772.11685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754faf7e-83f4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700079645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079645, "uuid": "ec1efc9c-8dd4-48ef-b6c4-b917bf5f941a", "comment": "Malware payload (AgentTesla)", "value": "3f493799aa0e20e16b1971184f891c79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079645, "uuid": "63c60b82-1f5a-415d-add1-0318b54d0c8a", "comment": "Malware payload (AgentTesla)", "value": "cbebcef944dc8b96250fa57c98bef408a1f3f053f303871f89f8f3035b4b3e7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079645, "uuid": "d101ff7c-39f9-46e1-b89f-91722039a4dc", "comment": "Malware payload (AgentTesla)", "value": "443223f997cab4bdc02f491dc4a0c07cafcd2cf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700079645, "uuid": "961ba1ee-cb2c-4beb-b324-87cc7e013f2e", "comment": "Malware payload (AgentTesla)", "value": "246ae6446af34745a3fbe18caf82bf0c5a79947c4029bd8947c8fd4dff45c37dea810d5f65510102d95a85e2156de5cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079645, "uuid": "74b35ef4-90f7-482a-9554-203eae863e64", "value": "T1D70501403AB1AD17CBA546F80B62249CB7F47D529161CBF92FA239CE74F2F704609A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079645, "uuid": "cb37c738-768c-4f60-ae9f-51b9ec9a4495", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079645, "uuid": "bad3f971-130e-4b1d-bd8f-d31adf03f304", "value": "12288:kykIVkuYuPZ9WH0ADaWPGl54Mm4FWdAdjpckcmGQiG+sRSNjFNQACeZNw:YIHjbQFaJliMm4aAdjOkcmG8+ibA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700079645, "uuid": "5ccb1355-a7fd-4b2c-9319-f70e3d43c0b1", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700079645, "uuid": "222f7e65-bf2a-4bf7-af86-2c6b33c4f5ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700079645, "uuid": "45cab894-959f-4eb2-9779-11cd13975cee", "value": "SecuriteInfo.com.Trojan.Inject4.59820.23997.12300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38541f6b-8391-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700037023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037023, "uuid": "8dfee923-f3cb-4c75-83d7-4ef85232579b", "comment": "Malware payload (AgentTesla)", "value": "cadaa81c52c5279f48e86d8037cc1784", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037023, "uuid": "46b97f40-c4de-4e5d-80f0-84b18aeea7b6", "comment": "Malware payload (AgentTesla)", "value": "cc9ceb589bbbf22fee3f7456b0269d06773a6e96974aa20936868bcbbce88ba6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037023, "uuid": "7a2fb410-ec07-4b59-baa7-a064352dd6a3", "comment": "Malware payload (AgentTesla)", "value": "1e91112920dec8d70b1e344eaaec32968937cec0", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700037023, "uuid": "39c23fdf-33e1-4654-bf03-b1d9be964b5b", "comment": "Malware payload (AgentTesla)", "value": "752a46554ba8ddb0b1473c37d0a2abfa611c5aeb2283feb93f8bc63b90cd2fed0363810066b5b9c82e28d79b951f5b1e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700037023, "uuid": "ff22e0ff-cb6a-4169-8b3c-0d06951e0a1f", "value": "T1EBD42354DE3A99CA7AAA0C9A0447D8F1C29F09CC6ED637857C34362F6C667142BC5E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700037023, "uuid": "8d479bb8-47ea-42c5-9ad6-833750e8c272", "value": "12288:5s4DfDMA3wTyhaEfN0Q/p8aOg+ZOWlQWDSXSajIAZOi8:5fATyhX10+uaOgMOWCWeXSMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700037023, "uuid": "40b4dff1-8511-4a60-ba67-49d82c70dc19", "value": 614784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700037023, "uuid": "2ff4f229-87bc-45cb-b27f-40f78ca19c15", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700037023, "uuid": "d43c4deb-5168-4b43-ba54-d37ed523224c", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb93143-8387-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700032846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032846, "uuid": "00124e28-3a0b-4bbc-b3cd-365cf29f84b0", "comment": "Malware payload", "value": "698165289f8a06b39a0006ca7058e55d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032846, "uuid": "3be78fa0-7533-4d1d-aefd-dd89293cbde8", "comment": "Malware payload", "value": "cd12655ebbcfc6789326d27f125ee39ec47b49c93ffd3e80af11d308a917107d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032846, "uuid": "1e8a60dc-4ef5-4ccb-9dfd-febfe61cd827", "comment": "Malware payload", "value": "6e0dd0b996cc621c3bccb09d1837f4fc4bac9b06", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032846, "uuid": "0d1b52df-7823-4cd7-a08a-73922fff99ec", "comment": "Malware payload", "value": "072607690e3d05fa53b517b0a6987f085be6a7808f644223a692fe8d39c659ae850770be3e5c98d790c2f5cefd328d7e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032846, "uuid": "b5467603-2649-40e3-844d-728ff752e5a2", "value": "T18D04AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032846, "uuid": "a533d5e7-8d35-4493-a1ad-a6f6ab6a2019", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032846, "uuid": "55456159-9926-44c3-a2ee-119d09596de0", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLLbVaKoXAxOPYe:I74elpowsxizqyStZlpel5fyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700032846, "uuid": "7f7df912-6045-4c64-8d0b-9a92b4debd79", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700032846, "uuid": "3b0029d3-26ab-4827-9f5c-19d795950a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032846, "uuid": "843a7742-2a84-4254-8fb0-752b271423d0", "value": "WCUtil_2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ab9ff7-840e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700090841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090841, "uuid": "73bff84b-0384-4d33-b7c4-cf1bd5c341e9", "comment": "Malware payload", "value": "c928554921c9960bcfc0e6ad11caf37d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090841, "uuid": "1137ec43-addc-449e-a6c5-017d1642eaf6", "comment": "Malware payload", "value": "cd378b012d0bdef2786e3d488cee11fd34b93d1cad9339351bcbbcf6b0214017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090841, "uuid": "4fa75eb3-6621-4730-8bbf-5a4ffc9a5495", "comment": "Malware payload", "value": "990a854634fc666848fdd72704a4eb72a7eca898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700090841, "uuid": "026dd016-f8b3-46d3-9c6d-897732b6656e", "comment": "Malware payload", "value": "42ea94cefbe036f42a6cac03e543c2d502b28f9a76d79926c3641301769a64d08967942c934dc4fc25e9f69c8b26ab25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090841, "uuid": "53df735f-0500-42b7-a34b-484932e2b903", "value": "T13ED080330F0A41DADAD4123F6578995CE77B8976574962310C90DD010C09A045F62C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090841, "uuid": "d13f3918-e5c1-4544-b9d4-92fd8711aa52", "value": "6:BnX//In8/r1uBxHocmTZ4Q3RQdygg5XJYD:BvwncrAH3mNJ532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700090841, "uuid": "507cf2de-4414-43d8-a031-0be8d465fab7", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700090841, "uuid": "6470b53d-cb9d-4149-97ed-e15b9c85cb0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700090841, "uuid": "0ea9ab18-8c74-4d2f-b2a6-3c686be046c9", "value": "1hJuhLuvSq8fq0q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524d969e-836f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700022464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022464, "uuid": "732215e4-57c7-44f9-b868-bc6d5c283f23", "comment": "Malware payload", "value": "886aeaa433e3ede6f3a973f66e506a81", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022464, "uuid": "188c69d3-906d-43d7-9b9b-f93d9330bdda", "comment": "Malware payload", "value": "cf03c50f7197f7511f36824745a247f4dcedb427689fcb1f34074f07ed99b5ce", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022464, "uuid": "4d3c525f-effb-493b-8ec1-04807e602b74", "comment": "Malware payload", "value": "d5498803eca83d05064e26899dd9d0b7a9ec6a3b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022464, "uuid": "43635dfc-e919-4bab-af3a-a09512d578be", "comment": "Malware payload", "value": "db19f9fbddaee9331a36e3228726f1360cba9e93d1b33d7a34b75e715b2c7d405cf9bf8040fbbcc05ac4ac76ff3f11ae", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022464, "uuid": "01bb450f-953c-4af3-848f-9f538a0a884b", "value": "T11CB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022464, "uuid": "118b952f-39ee-4e54-b794-ac0f03bb9a1f", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022464, "uuid": "01ca8050-0162-4e7b-9830-116439057f95", "value": "6144:fexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7XlpUlLaEx:feZeWSpda70ADIgSoxgUW/zFun7O7bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700022464, "uuid": "c853321f-966f-4493-8669-313b7ebd5693", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700022464, "uuid": "19a67363-4b83-49ef-ba57-cb761dfa7392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022464, "uuid": "32f4b3f7-0f3e-4fa0-9131-507c709ed665", "value": "parte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10868202-838a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700033950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033950, "uuid": "ed5fb257-5ce1-4d24-8c06-e46269c0c732", "comment": "Malware payload (Formbook)", "value": "e344bda7899df6fb9d12560254d07a13", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033950, "uuid": "d80d5373-8cc3-4c08-b7fb-c5a77c3be8e0", "comment": "Malware payload (Formbook)", "value": "cf33cf1b99aec2e58ebff495b327734f9d444884af6846ea086c210bd4ee2623", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033950, "uuid": "2fae8523-8927-490b-b7db-4b6c881132ad", "comment": "Malware payload (Formbook)", "value": "5d3e07d0d41fd3e16d4f9cde32362120e5f2c8a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700033950, "uuid": "20663173-a7ec-4cc5-8f02-15b86ed60b9f", "comment": "Malware payload (Formbook)", "value": "c016f27ba65322d834710e75834bb03584ae655b482391f6f08feadc10bc19684cd9613be364a6862ef40e9d83e52748", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700033950, "uuid": "07b269ae-2e4e-4c39-9880-bb11e7e4c446", "value": "T13864122474E0C8F7D4E24A735F7ADF61C3F8A651252492CB57604FBF0E46DE2621B681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700033950, "uuid": "db726877-1039-4e31-895e-8950c12123da", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700033950, "uuid": "dc18070c-4fe2-4d07-b447-6c5cd02902fa", "value": "6144:wBlL/9pMUHq5ivHw521qti+5WmKasPxo9Rge/LAx9EUEgno9TF0KB:C/+UHq5mSDBK3a9GY8EUFnQF/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700033950, "uuid": "35e3281a-e1e3-40ba-96b8-0a64f4161c24", "value": 320549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700033950, "uuid": "4aa60438-9195-4505-8f10-55d1ce56d220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700033950, "uuid": "4d816f92-364f-479f-8d37-15274c8ac45f", "value": "Shipment Document BL,INV and packing list.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3f7845-83d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700067287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700067287, "uuid": "42c21759-171e-4bb2-b4a8-fc57931d0677", "comment": "Malware payload", "value": "81db7e8f8715621b82a7ff4c6d983da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700067287, "uuid": "87082a15-a31a-4829-993f-6760af0e3431", "comment": "Malware payload", "value": "d09f9f6cdc590384d14c7aa5e5580fc0a358d0aa0f05199d12faf6ee17937646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700067287, "uuid": "ed314ab5-e8b0-4029-89d3-8a5bad3e43ae", "comment": "Malware payload", "value": "776302d3425cc946ad3a46cb53892fd6ae744086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700067287, "uuid": "833332ee-b47a-4da8-afe3-75f525f90e17", "comment": "Malware payload", "value": "88c3ffffae67559407609a6aad3a4b391d063e9b1afb6a50fc48cc4d8436367d6d390f587e0b73345bb900e3f2488eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700067287, "uuid": "904ee6dd-c8b2-4196-881d-cef71239545a", "value": "T1CD7633137839C87FE50927319D915FE8F298DC118D3240E3B3CD192A7EBAAA9D471399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700067287, "uuid": "2d1cf855-8fc0-4fa1-ad98-d8c3c636a1af", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700067287, "uuid": "f051bd1e-c0bc-4bc1-8fb9-14a7857fe748", "value": "98304:91O/qaWgy/dndJx0IsxZMgidvLfyPUKqRu8rF4ESFEC8WfvHeIyXeryZgw6GVh6s:91OiBlnRT/NLfFXhh4lE0HeVI0ozxI+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700067287, "uuid": "b5ec3a9a-7cda-4626-8388-1cace073abd3", "value": 7495195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700067287, "uuid": "32c7dc13-fd9a-447d-bce2-74ccc84e98b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700067287, "uuid": "bc4c0cc5-3673-4992-b8b3-1ec010f1cf2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f98680-83e3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700072501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072501, "uuid": "be5a59d4-5c9d-4681-9a21-73e4a782977d", "comment": "Malware payload", "value": "058f51c776571062fade4b67263682c1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072501, "uuid": "fad85cb8-0546-4932-8b09-a336c24406e3", "comment": "Malware payload", "value": "d102730f766be0466151499f76d91af1c8f4c57ed3d973fcf60f1ff16a0b2594", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072501, "uuid": "0acde23f-b81b-4ff4-9f0c-888b19198368", "comment": "Malware payload", "value": "f40349500ee19edb4b37db4b537d6fb0c40ba5cb", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700072501, "uuid": "ff021d45-307c-408e-9e5b-5c1bf9011b51", "comment": "Malware payload", "value": "18ada469a7a1e804729c64bc7c956fab9cb42272e2f8fcf394d35ac66a17c1704a4007f00d141f08be8b5316dd4b5106", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072501, "uuid": "dcbe7985-665a-4ea9-bea6-ce203d140d54", "value": "T1B2B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072501, "uuid": "a7cf7915-33cc-4c68-aee7-5054c5ef1604", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072501, "uuid": "b7a27d3d-22ca-4ff4-b8f6-e9ffbc201db6", "value": "6144:6exbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O73pUlLaEx:6eZeWSpda70ADIgSoxgUW/zFun7OdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700072501, "uuid": "af1e13b3-df33-49ac-b899-975028724be3", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700072501, "uuid": "94b1cf74-11ac-4ed3-aee5-8b83a793a351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700072501, "uuid": "d309ef53-8e83-495e-8b14-81011419182f", "value": "Odconfig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a1544e-838f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700036476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036476, "uuid": "049c7949-6c30-41e7-a05e-6b2431deb2de", "comment": "Malware payload", "value": "13e571bf34717b3c6ab617f41af24229", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036476, "uuid": "a65ac0fd-41ed-4c6c-ba0b-24e641c44ee3", "comment": "Malware payload", "value": "d29a9252a15d46c47c38d4f70439c69be41443862544ec3cd2d6a23897b4ab2e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036476, "uuid": "26f8a56d-fde8-4965-805c-ad058e90b3f7", "comment": "Malware payload", "value": "ef0065dfb57c1dcaf9c945547fc09377329f80c6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700036476, "uuid": "00f68e4b-eb7e-4ec1-931c-47253c50bf7b", "comment": "Malware payload", "value": "4bfed7d18bb020d1b8ca7131c75958fbfa5badcc697ffac039ff2a0b9d88749ab101ab11d92e1026f5fffd30d728517d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036476, "uuid": "6dffde68-f970-4ad6-abe3-6bbbe6adcbe0", "value": "T1E3A38A6DD34B01A98F5263779B1B1E4541BCBA3EF38551B1306C833933EAC3991266BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036476, "uuid": "0d7de2f9-503b-4873-a347-2bba72c797ad", "value": "768:IwAbZSibMX9gRWjGDTQj9RRPifoTzb4jL1q:IwAlR/a9R1if8zsv1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700036476, "uuid": "323e24fc-9d1a-44e6-bf1b-d4cfb2402ad8", "value": 99852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700036476, "uuid": "0e843f13-fa27-45da-92c6-c70cc4249acb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700036476, "uuid": "45b1fa26-fdb6-44fb-b8b0-c668f77b1853", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.8006.4970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a67ec16-8360-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700016062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700016062, "uuid": "858e30fd-433b-49b7-8191-e9faca38e2cf", "comment": "Malware payload (Loki)", "value": "9385f56c0efa6b9fe6ded943e768335e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700016062, "uuid": "40f71ce7-8c54-4902-b3e1-38f099fc2563", "comment": "Malware payload (Loki)", "value": "d4285f204614a02df0ce4b1e6e80f402057495dfcdba66993fb94ad5e686e2bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700016062, "uuid": "e8e38ba6-4276-46f8-843c-6dfe80d0de0a", "comment": "Malware payload (Loki)", "value": "c3b681c1a95072c461884a379e43fa1f919c7c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700016062, "uuid": "95ffa356-8e22-4abf-aa5c-3a7cf57ce309", "comment": "Malware payload (Loki)", "value": "2b17bfcaf0762bc915ddcb70d3ee7d326c5d5d8d1dd9e0c15d70cbc87b907b739252c73e992bb843fe6de04ea536c5cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700016062, "uuid": "18cf53e3-3e5b-4d27-b338-f09a83109b38", "value": "T11DD4CF9F7D9E9812CC260732ECD9018467F27EA27602D6DF2DA73186C2723DD4698F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700016062, "uuid": "92738716-3e61-4ed3-9776-1d1e094f0aca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700016062, "uuid": "ad057600-5d2d-4f48-a8e7-575bf069b644", "value": "12288:peYRo0ch1Zn2ELpPfD8z1O71PyEeFmki9bFaag/2JgNdfIrdygtxpH150qzfdJ00:pNkaagBRIrPtxpH15zSm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700016062, "uuid": "59b3e592-ed1a-4e5c-b7b6-f73f0171bfa9", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700016062, "uuid": "9ea61a0b-386b-4e09-a50b-bdd46fdff3ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700016062, "uuid": "4dc88549-c838-4392-a3d0-43f763bd1c06", "value": "Solicitud de oferta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221a6336-837a-11ee-8907-42010a9c0042", "comment": "Malware payload (AZORult)", "timestamp": 1700027107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700027107, "uuid": "96891af6-07da-472b-8187-a04df25d79b9", "comment": "Malware payload (AZORult)", "value": "c69f3daa7c4e94e3399487aec0e18f38", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700027107, "uuid": "ada7bc88-b289-47b5-a275-71fa44a250b8", "comment": "Malware payload (AZORult)", "value": "d4a414388bb5c63306ba96450753a3191d32afa1c9dc0a621c831d28956e0400", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700027107, "uuid": "fcbd9c83-8fd6-464d-86fc-f3523ca80058", "comment": "Malware payload (AZORult)", "value": "1d9b93f366c9b02b0a65a863cc87a597a59ec290", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700027107, "uuid": "907cdbe5-c534-4055-b32d-89bec4df8c29", "comment": "Malware payload (AZORult)", "value": "36cc5de3d1f086adfc663428bc776ddeb5205ec9946fe2bfb94c0288421f01f5a8f6cbaf6c752d13734c3ab83bf1d025", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700027107, "uuid": "de19f00d-a001-4be2-bc36-6b2f3288784d", "value": "T18FF4593C4CAC123BC574DEAB8B958066F5E0977337018D3924E356865E26E26F9CC27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700027107, "uuid": "82450169-9e6d-4126-8775-67ad384c86d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700027107, "uuid": "47579953-e5c9-4610-a254-e96919976568", "value": "12288:fKONkZz/V8mrzOVcCiNExE7DrZUtGSW4wtsFoIYTOkGWV5xqpWBrGtUJQ:fKSkZzumrw857DrZCGSW4ys6ISV5xqMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700027107, "uuid": "04e71df0-0d1e-4dbe-8875-78c024840a62", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700027107, "uuid": "861b0cbd-533c-43cb-8336-fd2a2b3e67bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700027107, "uuid": "389e28c0-9254-4ae4-8d2c-f255a8daf78e", "value": "C69F3DAA7C4E94E3399487AEC0E18F38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6249c00f-835a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700013471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013471, "uuid": "94f4ad73-11ee-4f3e-bc9b-e69fbd237cd3", "comment": "Malware payload", "value": "4db746e9683f9da42e5957bad9afcf37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013471, "uuid": "623729ed-efd8-4130-951a-c63a30cf5af5", "comment": "Malware payload", "value": "d61440747490d4b403f4436639207f3a665dca0cd035267ae044ceff6a0c80e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013471, "uuid": "8cdd5d5a-a10b-4cbe-9307-c6dab7508c63", "comment": "Malware payload", "value": "f1ca17e1bd7f5ca6eea517ab364f009c036e07a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700013471, "uuid": "4bd91373-ec40-4636-9a43-40fab33aa3e3", "comment": "Malware payload", "value": "7f5b938b5a71132f6cb17d3f1c4cf2c2fc61b1cb0acb2dcf3659610d4e0c6a0b02c0028ca0c94b5bd254c11de7b18a5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013471, "uuid": "35253f86-54e8-49b2-b5ad-00d789fbaa90", "value": "T1A705C969A6D59BC2C3130EB8A0261804F1B9F5D6670EFF72558F1B2A0787307CCDE666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013471, "uuid": "75a963c1-6d62-4ab2-9741-2ae50933d600", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013471, "uuid": "2e6ee3cd-edd1-4b42-a085-d994e2215641", "value": "6144:zsL+2uDWSccQH58LFWA+Ugf8jn11ryDHy8VUo744L0bzNlzwl92GhN:zGncG5q+b4eDS8VUo744QbHo2iN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700013471, "uuid": "85de31f7-9635-4e27-b959-526d17ab55ac", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700013471, "uuid": "11fd45f0-940a-44a9-a2c6-73e73205b198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700013471, "uuid": "3ec2c81d-476c-42a4-95f3-ad07195c2817", "value": "4db746e9683f9da42e5957bad9afcf37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ca30f8-83e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700073736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073736, "uuid": "f70c62b7-3ee7-42c4-ba58-2b56e89b1f94", "comment": "Malware payload", "value": "54157cf64e446ff5a770a6069b8fbe3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073736, "uuid": "b4462f36-f167-42f3-8386-7dec355e51ec", "comment": "Malware payload", "value": "d6e31c14d40784a2ff3b92ddea17ceb6eace0d64c4526bf17f8932700528dfe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073736, "uuid": "a8fd26fc-f544-4844-944d-a413702bf23a", "comment": "Malware payload", "value": "1fba63057d28f0ca09abc3bbe49e5a112c2d6691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700073736, "uuid": "14684c3d-9840-4563-8c01-e76408ac736c", "comment": "Malware payload", "value": "da9598fb5f68eed38cb775723e5b473a5d5b6d3119a1e55e0d8f543885638ee658ad0811bbe97cc3d9198e689666cfb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073736, "uuid": "534f30de-3761-4c7a-8aeb-fc78bbe1bd3e", "value": "T1CC350E9D365072DFC85BC4729EA82D64FB60787B870B4617E42312ADAE0D897DF181F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073736, "uuid": "5e863c14-548b-4958-801c-b3cbb4bc34a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073736, "uuid": "2800bd6a-d2e3-43f8-9852-ad60f0b449ca", "value": "12288:HxGpnfsN5omb4dgxnjxNQSn/npYb5z/B1f2QFkR1rwSlmrbpALFLzQuRGux2WTv7:HMo5omEdgNjxHfpYF5oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700073736, "uuid": "20c096ef-9788-41b1-97bf-80e02bc18db7", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700073736, "uuid": "dbd8e420-d6b1-4623-a628-1f4d277fa73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700073736, "uuid": "2d6d2848-4625-4396-ab43-1a28743eae60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c605b699-83c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058735, "uuid": "ddda758a-f1f2-41b8-a346-41a83c61c01e", "comment": "Malware payload", "value": "0592e6ddd170d5f5e7ab9ff0956860f5", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058735, "uuid": "aece42de-30d4-45b3-8eeb-357454dc893f", "comment": "Malware payload", "value": "d6f843c7ea0e1bbef9b381b35d2e942b88f204c1a43de76011da57563f21c95e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058735, "uuid": "0193e0c4-9726-475c-9c05-33cdf0ecd100", "comment": "Malware payload", "value": "0f571d8e29cc969572afc6550cd7dbb6610ceab0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058735, "uuid": "aba436de-63aa-4fb7-8876-cd7871b0cfe4", "comment": "Malware payload", "value": "9980ddf4ab1ab0d4783067d077ce2be2a5ad1d560b2379ad68b1662f8c82f27d947097ffa4d3b9bce45ee5d47a5dab84", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058735, "uuid": "4007897a-4504-49ef-a511-f57818eac15b", "value": "T11D04AF11759181BBDB9E223454FE6F3AABBDA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058735, "uuid": "c12ccbd4-23f3-43a6-944b-8033595044bc", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058735, "uuid": "996b0095-07fe-4675-8af6-d62f3b97836c", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLMbVaKoXAxOPYe:I74elpowsxizqyStZlpel5gyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058735, "uuid": "72a13d7f-f407-4b1d-9842-6516757375be", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058735, "uuid": "aaae44c0-d843-4084-9fe6-d7bd3e985b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058735, "uuid": "2567f67b-b74f-400b-ad86-c67197b73070", "value": "WCUtil_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fc0b40-83ab-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1700048434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700048434, "uuid": "1b358ad4-063c-4266-9170-62fce16c600f", "comment": "Malware payload (RaccoonStealer)", "value": "14233600f7b7f4e29c3d03ebd8facc60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700048434, "uuid": "0af26f63-933f-4690-a9a6-d06c15e2227d", "comment": "Malware payload (RaccoonStealer)", "value": "d74b9b445cc4cb4fef7ce48910ef2f930bb044dc09221df368ff3353aff70841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700048434, "uuid": "8c69975e-fdcd-452f-98d9-bd6a70a0eb02", "comment": "Malware payload (RaccoonStealer)", "value": "1aa2e40eecf0382661120b50abae0d890767976c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700048434, "uuid": "59da9597-1b29-47bb-ba9d-0ff92712d0f4", "comment": "Malware payload (RaccoonStealer)", "value": "59b250c6169a1d695acf65726dd311b52290808beeb25c34e1735d87a78b03814f4876e125fb19976f12de0d6235311c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700048434, "uuid": "d24b0eb7-bab0-4cca-87a0-4f7e1ae91b82", "value": "T1D486337723264185E8D4CC3DC637BED231F6073B8F81E4B966DE79C625A25A1E213893", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700048434, "uuid": "4a154659-ecd5-4859-8189-2caae5842cf6", "value": "e52976ef9ceb0df9a20dd9a6bed9a562", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700048434, "uuid": "2796ef19-8101-4418-acd1-a610f4c2a99a", "value": "196608:2DISdMjz+71pQGUuG5ToyrGaHtAV+VjhtFC:2rdMjzyQGUucTotaHtPhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700048434, "uuid": "51f1ba41-bd2c-4173-8dc6-8d6ad9b1b54e", "value": 8439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700048434, "uuid": "5447161c-d05e-418d-8820-b7d7f6791d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700048434, "uuid": "7b3a1767-fef6-4ca8-be36-11a5fe620cb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e349ea3d-839f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700043323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043323, "uuid": "2f91f228-c481-4178-9e1d-48520568ffa7", "comment": "Malware payload", "value": "730942ea255c68cbde5b9de3b6654307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043323, "uuid": "91838b9a-502c-43a4-90f7-1df4bfec60be", "comment": "Malware payload", "value": "d790818dae55b8474612f9a1d45d4cffd35d083dc4ee2215b94ad9acb1aad808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043323, "uuid": "2f8c5196-9860-42a8-b01e-ca28220339e3", "comment": "Malware payload", "value": "f72359ce25e41edc066a1dc3c649e92f985596e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700043323, "uuid": "b11c9495-64b6-42a7-899f-a7c2ad63504d", "comment": "Malware payload", "value": "79cb1f8eaeb649597e19b7847675a65bebd3a5718c02ff0e86bc78e63e1f9cf56ba02964c866f75e258fd435073f896b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043323, "uuid": "a06ef2ea-0558-4591-9a83-20ff6dd34dbb", "value": "T15B7633A1369A4A7FC7CE153585B93BB872F6D2989EB080730390CB0E2F3C954647ADD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043323, "uuid": "9531e653-b66d-454d-b76b-75f286216e78", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043323, "uuid": "a27bc16f-f68d-4b05-afef-2338dec403df", "value": "196608:91Op+KbpqBznxT2sM4gxwUfyuYGDDRiyq2ySiz:3O4dN2sqYGnRbq2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700043323, "uuid": "a058dde0-eee9-48e5-80f9-f0d3d7d84efc", "value": 7525524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700043323, "uuid": "268fd518-7108-4c76-936b-cc2150ceb195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700043323, "uuid": "3578cd82-3421-4991-aff1-7558b27f6eeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6b9b9-83da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700068679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068679, "uuid": "d520d2b9-ddbe-47b4-a989-ed0068251e46", "comment": "Malware payload", "value": "60d8c0b2a730fb91d4ab034d5c47aea9", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068679, "uuid": "9555ec03-7cd1-48ae-8965-96e59318560d", "comment": "Malware payload", "value": "d82ea0bf95437276d3c5bc8f78b6f3ca21e028ec69e3c0ec15bdca37badcbef6", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068679, "uuid": "95a50016-616d-4ba4-8d89-2a0ec24ac6a8", "comment": "Malware payload", "value": "e019a543a44e89d520537e70e01d7890e2e4ca5d", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700068679, "uuid": "76651e98-ebde-43ac-a156-e48701b8dfde", "comment": "Malware payload", "value": "5caf2808805931df095c88844518549d6a4c8f4c6a5131bf918e1a23703f3742c3036ce4fdd83d4e64e4ae96de424b9c", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700068679, "uuid": "34c1007c-9011-4019-8213-84d9aa8cb489", "value": "T1D8D5BE2A35CAC637EB7E82316669D77A61BE7EE00BB100DB63C42A5E1E305C14275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700068679, "uuid": "504183cf-44e9-4679-bb15-6826bd35f99b", "value": "49152:VlDUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZFOOsLRm:430ZnqKzFnWntuxdsLRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700068679, "uuid": "206b782c-726b-4085-b4a7-93114d282d49", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700068679, "uuid": "ffdf50d6-dcab-423c-bfc6-6b8bb451c0b3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700068679, "uuid": "1846642e-60c2-4347-ab9f-be264e11d5df", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff974a43-83c4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700059261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059261, "uuid": "3348e1a1-cba9-44c5-b68c-9c8f5c259f69", "comment": "Malware payload (AgentTesla)", "value": "198e317f08c6b5c1b235d7ddec70626a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059261, "uuid": "e15dd968-cae2-4522-8359-d423c498f547", "comment": "Malware payload (AgentTesla)", "value": "dbe5ea4fdeec96fa6dbd4e378dd10f4c6b89a921adaff45fe358f3dbb55da1fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059261, "uuid": "0154385b-6efb-4cd4-be1b-ba68ccbe6912", "comment": "Malware payload (AgentTesla)", "value": "9ae90ab596023acec5ca750e64b9ac07523d9f2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059261, "uuid": "b81e0295-2ba9-45d8-87e1-137387d006a7", "comment": "Malware payload (AgentTesla)", "value": "6847886c34984ad4ae0525cf2073790ac52a0307c18bfd01e219ff97550ef661e0d5cfc6f55c3ace2d58fab0a7e4b86b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059261, "uuid": "0fc5a7bb-d47e-4505-b219-b9e89a8d622c", "value": "T1FB05F0003AB4AE13DBE246F44B66259C77F43D626162DBFA1F9270CA74F1F704219A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059261, "uuid": "d0d32c56-4f83-4733-a3c4-5cd85b6017c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059261, "uuid": "0a95eaad-66dd-4ddd-b27a-e4dcec23911e", "value": "24576:aZBjdfwvmlDIisBV1H6+Om7HZyccjl0ETyl:aZbfweliPlnR74xadl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059261, "uuid": "0924bde2-afa0-40ae-bc02-bc22f2dc7ef8", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059261, "uuid": "1c7f5be9-45f1-43c1-8d5e-436a3bfe23b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059261, "uuid": "5451ee8a-b3fb-463b-a7d5-ddce1e61b792", "value": "0324_Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb51339-839a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700041085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041085, "uuid": "cd6d07b5-46ec-479d-9a3e-dd3393f1ebb3", "comment": "Malware payload (AgentTesla)", "value": "a31dc40908b34de1aeef206ef067d280", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041085, "uuid": "10befb01-502f-4773-a682-745616089d2c", "comment": "Malware payload (AgentTesla)", "value": "dc7b17accaba0cbe8edc9a22bf625eb3e74f64b6e17046175095e4197792bd98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041085, "uuid": "f11e803d-2813-4c88-9a76-fa5a40311363", "comment": "Malware payload (AgentTesla)", "value": "7a214399f651a162b6895484602ee0dfd415e5ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700041085, "uuid": "4ab83c05-0e6b-43f2-b685-047c6e38ed74", "comment": "Malware payload (AgentTesla)", "value": "30c20c02d9b3ce429992c130652de96ac8e5fdf0e2db9d372d5509c04cc66bb9431e4fe140f82bfbd6e9fad89b4a2c94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041085, "uuid": "14482ed8-2346-496f-a540-267609ff3f7e", "value": "T1672419166719D420CB5F527DC01A820431F1D703A72AE78F5AA6D8EA2F836CDF90BDE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041085, "uuid": "8c8770f7-684f-4331-8b31-4cc7db018334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041085, "uuid": "b6d29adc-9f03-4d5e-8b95-82244cf7afd3", "value": "3072:cmQ5xDOxLgPX7FdtXEwAu1sKUvlcNGJR9X1eStP1luF4QJpqbj0vl4r0o7WwJQYO:cxawfUeAR9xNluFDqkvc0w1Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700041085, "uuid": "2b250530-cf7f-4c56-aff6-1e2c3d3b206a", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700041085, "uuid": "809b55d6-9553-4410-bfab-185b24b22f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700041085, "uuid": "7e1e2338-c285-48d7-a8b8-28c5b6805add", "value": "17000410846d47e6b65e48f98c4726d3f72972952f1c4792deee8f14ac2125a8f4caad0e43312.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2eeed1-8386-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700032228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032228, "uuid": "6f32e60c-5a57-4439-85fb-533e6756a926", "comment": "Malware payload", "value": "e4b5a24c7bd364f21a91e0ec87662ae2", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032228, "uuid": "056fc1a4-beab-4803-b372-b120d2049455", "comment": "Malware payload", "value": "dd69c8ab0e6f97b1e877054189d93360498d5bde5a61ec6aa100e04741c303f9", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032228, "uuid": "986a93bb-c414-4ede-bad7-064c6c38de72", "comment": "Malware payload", "value": "7d200813b83974c024ace47df19bcaf1327f7bb9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032228, "uuid": "c6ea7f3a-c44e-4454-a46a-c1e220022e94", "comment": "Malware payload", "value": "ba337d1be35ceb2e688d89a608b998a445c01cb4fd878d23607a435618b6e99b56284ab2eccb01110d517f448d7ea5b9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032228, "uuid": "ea411434-c854-43f0-92b4-fbfbbf0b827a", "value": "T1E2B49F0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032228, "uuid": "c7f701e0-a52f-4963-bf5f-d021709400b7", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032228, "uuid": "0aa85d26-6a9e-4c77-a6a2-6a93ab82a4c7", "value": "6144:CexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7EpUlLaEx:CeZeWSpda70ADIgSoxgUW/zFun7O8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700032228, "uuid": "6544eef3-af32-49ab-8170-0273573aad5b", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700032228, "uuid": "a0ce474e-c14c-4617-adb5-9a6514d0100f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032228, "uuid": "fcbfee02-cbc5-412d-a026-c517d016274a", "value": "contratto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fad949-83c2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700058193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058193, "uuid": "7e800a10-a135-4799-8047-bc0c8bd4db6e", "comment": "Malware payload (AgentTesla)", "value": "39f965b19b984e7cb6350c7cdc91b09b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058193, "uuid": "d44ca0d7-ad02-433b-9a60-2d7d4940280a", "comment": "Malware payload (AgentTesla)", "value": "df5e129f51b16e5dec57270b57c8c742242d83d3fe7c556184cb004ef353eea5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058193, "uuid": "412a3602-6bdc-4a51-9df3-94c12296afbf", "comment": "Malware payload (AgentTesla)", "value": "de8d8c4bd793d639018c017b3550166433566fb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058193, "uuid": "d0a3d646-8ff4-4ce0-b2b5-54cc9184d32b", "comment": "Malware payload (AgentTesla)", "value": "df17f55d29e482cc95179443af9ac0d315a599dc259b280ba3b072507a42d97224db972f32498ca74b81b3105b164332", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058193, "uuid": "fa11ce4d-f9a8-4f10-9aa8-94373810b455", "value": "T1DD15CE81F2945565DD6D9BB06836CD714733BDBAA870E61C28DE3E6B3BFB3920012163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058193, "uuid": "81854a77-87d5-464d-8062-f946793b290b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058193, "uuid": "ea35140c-83fb-4049-8e42-694875435980", "value": "12288:7aPNlfDMXeymo9APeMXQDwj6bnAwsN2wS2sgUGzpDr2SdgslrncpCIaP7r9r/+pj:QjpgajP4AwsND/sgUGFDSQ441q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058193, "uuid": "eec48148-6c50-4f34-a8e4-83885e36c00f", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058193, "uuid": "19a0d0b0-5976-4015-8e7f-d9fd6ea3d712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058193, "uuid": "addff40b-b01e-447b-a838-dc6dc01181e3", "value": "FLEX-2353393_D0_20230912TO92723.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb8bc8d-835c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700014589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014589, "uuid": "b0e37486-dac8-4cc1-8600-48f13b6f0233", "comment": "Malware payload (AgentTesla)", "value": "71000d0815b9c38da9d5f8efa014f99d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014589, "uuid": "3bc9f8aa-314f-41da-99e3-06cc52e4bb1b", "comment": "Malware payload (AgentTesla)", "value": "e3b762b0f49f604badd73ea22cd90861766a1568211b461ce08f687ff9d22f6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014589, "uuid": "1fe36da2-a43a-43eb-a7d6-bf9efe0d736e", "comment": "Malware payload (AgentTesla)", "value": "a5fb8f07cde827bb9417f5733c3d913e7af0223b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700014589, "uuid": "c92a3891-f1c5-4e27-8b46-1eb67bdfbddc", "comment": "Malware payload (AgentTesla)", "value": "d640fdfaf05ca18fcf911eb9996e21ca6873c8c00b32f3d97dc01f3ef43e3376c129d60d89ed16b6e0a73a1442496840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014589, "uuid": "d4205e81-9788-4375-a31e-18b247ff6d2a", "value": "T1120508BF6B8C213381B9D697C3B3E066F17BC8A7723A5E2524D3DA914687A0774C521C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014589, "uuid": "223b6b0f-0345-4ae0-a806-a8d311127e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014589, "uuid": "01b447e0-8155-4880-a315-ed02ed86c11e", "value": "12288:/tRywdbzyrT5GzSdnoIsK3Ss+S7eG9Qvfkn6wm3WL:/tRyMbzyrVOosK3SsDSvfknLm3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700014589, "uuid": "1b9501e8-90a1-4378-ad25-9c015acf8608", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700014589, "uuid": "b250b1f9-a0bd-4558-ae41-25a284bafdfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700014589, "uuid": "baf543d0-d7c1-4881-914b-373d53b14092", "value": "SecuriteInfo.com.Win32.RATX-gen.333.15935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b418be37-83de-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700070302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070302, "uuid": "9cc8dd00-2e60-4e9e-8caf-de1453110c54", "comment": "Malware payload", "value": "e7637f78f9d76c02e1a8d13fd53de0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070302, "uuid": "bc66e0d5-78a1-4d55-9483-3f6ad52c0882", "comment": "Malware payload", "value": "e3ca09965edf62f810d4889f9650b4669791102332ed761769f0ca9dabed1908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070302, "uuid": "21165441-33b4-4bb9-a983-d4b29aa72f47", "comment": "Malware payload", "value": "83366a119391bc62c95aa295d279684924f20a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070302, "uuid": "0c53bf56-1037-41b0-85da-69240a18a566", "comment": "Malware payload", "value": "07afe930eccf8ffa727c50e5c567cdbbf3af31945a28e2ba2bf443d561f686cfacb4e2431238372dddfcd1bc05b41351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070302, "uuid": "68b97921-4cc2-4d46-98b9-ac1a843fdde2", "value": "T10EF39C3C96C81132CD56E0B9CA620257B3337B66DA61C3CFDF198A6B45922D4BDC89C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070302, "uuid": "c5a9cfb1-f936-4260-8410-0682db785e39", "value": "c0f9401b13dd35f3e11f2b5cc5de60ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070302, "uuid": "38065b99-35eb-4a19-80b6-4dee15aa0872", "value": "3072:qMQ9MYbEVnFegMJUEUOPIOaAQSUdiW9QbYXjByJ2fZpFR7+hjSe:6MYb4nMgMeiLeSKUbYzEsxpLShb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700070302, "uuid": "ff9e396c-77dd-46eb-988c-7dde7d01fe1d", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700070302, "uuid": "d6120355-c87f-4b54-8d45-4a692e3bec04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070302, "uuid": "14eecbd1-694a-4088-8bbd-61dd7f765426", "value": "SecuriteInfo.com.Trojan.PWS.Steam.36751.7877.27701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faab0c34-8370-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700023176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023176, "uuid": "b34148e2-5f02-49ed-b2b6-8b4e1f2a609f", "comment": "Malware payload", "value": "57313047d93142678488f6b1fdccb2b7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023176, "uuid": "c38e84f0-37e7-43e6-870d-3f28fcc70788", "comment": "Malware payload", "value": "e4f32b898bb95e747f9b11d1b7dd52a8a36e7116e66fa171eebed1bb290eabe5", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023176, "uuid": "7f581dc1-37fb-4ded-9e76-352adc9e05f4", "comment": "Malware payload", "value": "e409d44bbebefd3d993018b60674d5cfa87d5f71", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700023176, "uuid": "8dfd6046-a104-4267-b22a-383f7f84de30", "comment": "Malware payload", "value": "9ac6a08424bb3a114d287aedce31744c2bc668624af1f4e4d92cb0f92f9dbcdd2b45ecc85a0ab747d5de4cbc19398040", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023176, "uuid": "2b10ed35-251c-42fe-9e8a-7fc49717dbb3", "value": "T10104AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023176, "uuid": "ec76f622-b2a2-4112-be1f-cd6d0961492d", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023176, "uuid": "ece2fc5c-e6c9-4f0a-a871-b8d44f913ab6", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlL9bVaKoXAxOPYe:I74elpowsxizqyStZlpel5hyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700023176, "uuid": "fb545ce9-f12f-4f61-a1af-d784b77b5d9e", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700023176, "uuid": "988a8776-79ea-4814-973f-db425dce0700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700023176, "uuid": "1c34c8bf-2356-4afa-b4dd-595a833442b3", "value": "WCUtil_5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b819d0e8-839e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700042821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042821, "uuid": "fd99d4bf-55d5-4585-b452-459302d02eff", "comment": "Malware payload", "value": "692a63b81b65b897ec74222d796c0b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042821, "uuid": "131f8672-640f-4bbd-bf0e-6409a17a65d8", "comment": "Malware payload", "value": "e51d0b81ca8d23771538b6f9f787293c86fb78ad2d30fb09a57a9f8bc301dac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042821, "uuid": "67eccaba-d362-4abc-9e23-173d6c02817c", "comment": "Malware payload", "value": "b7a4b61ddf5bc6d5c394b7c9711301dda05ea664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042821, "uuid": "144c5558-31c7-4547-bc22-7e672271a259", "comment": "Malware payload", "value": "c4fd7532f259e834211c610adb0838862ea42c4789cbe2ffd2c8533348e94d96e193ef5806b456c4233ce1ee8cb67023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042821, "uuid": "1368dc0c-8c35-4554-b09b-a120b8fe06fd", "value": "T11F5409D03EB34CB3CEDFB5364BB46044A4E93425658E3764286385A637762B8BD08D7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042821, "uuid": "309fe105-dae2-4792-b32d-4ce56eb8deb0", "value": "c9841028b9dc21821bee70c3fbfd867e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042821, "uuid": "89fae4d6-ce51-43b2-9c70-41a8ea856b27", "value": "6144:zD6cswHTGkIdf487tQi2iklho8Jixi0d:zNswzCj3kr1f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700042821, "uuid": "4a0ab3db-99db-4fa5-9cb3-4e7f42f338a6", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700042821, "uuid": "43a2242c-dbf3-4093-b8bd-314f7794eb61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042821, "uuid": "6b802ae3-cefb-42c6-ae3c-38e04cc07d35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b27ee6e-835f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700015687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700015687, "uuid": "12b9ce7f-caaa-47fa-b3bc-b1420ba635b9", "comment": "Malware payload", "value": "cbbec85922c4e62c6a7e8ead2e076a03", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700015687, "uuid": "fb7d2712-448e-47c6-948b-f3415e651473", "comment": "Malware payload", "value": "e583e248ba55bfc925e3ea9bb9f45bbf4473b87cdec850a62dff5f25f4945dff", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700015687, "uuid": "f9abbd9c-baec-4878-a113-0d18e275b4dd", "comment": "Malware payload", "value": "c584440efa494f7a8798c633e192d3a82a2902cc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700015687, "uuid": "c0faf01d-f8a7-4679-a6ab-9e344a7c175f", "comment": "Malware payload", "value": "a5acc8d45e5f7dfb48b509de3016bba02730dee352d9b339fb43932fe1e1266a586328630eb17c9279e950499ac96809", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700015687, "uuid": "bb46c3d8-c13d-4751-8c1a-0e36239f4748", "value": "T15184125AB3A81B43C45B03BD4C4FA8552E1EDD006F22623B72967C99F93BB306F15729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700015687, "uuid": "eb0225eb-81d2-4702-9554-a037b417bd3e", "value": "6144:e0b19l/FZ2Pjly7gW12nsBj5Q9ftspAqqMt+g/8nhOFvRAx6UaEyFDzi0M1qXprq:nrFZ207v1QpJ2+LhevuIUafZjfXpvivD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700015687, "uuid": "d3d2302c-042f-41d7-8764-46e98e735ecb", "value": 388792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700015687, "uuid": "b62a6409-67d9-4ffb-9b25-b9745475a72e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700015687, "uuid": "201b8faa-dc90-4acd-bf32-e3850550bd80", "value": "Solicitud de presupuesto-08-06-2022-301.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bca459-8404-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700086513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086513, "uuid": "9b74561d-1963-4cc0-942b-4d0b6ade2c5e", "comment": "Malware payload", "value": "bcddf14b096307edfbfdc92384539645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086513, "uuid": "c5711fab-fdff-4269-9a62-645d2aec81cb", "comment": "Malware payload", "value": "e5f25600b1e6483536bae239c5ff59e496fad54cd9ca1d82be94e26f27be5fa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086513, "uuid": "8c28bbfb-ac9b-4ffb-b80c-64e312328a71", "comment": "Malware payload", "value": "a5770520db5a464a2d1ec5fb9033391942ddf04c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086513, "uuid": "39bb167f-81b8-4042-9262-c0b23fbdc688", "comment": "Malware payload", "value": "8c4df3a66f3d2b945e929feb4dfadb7db1f0d1fad17f1f4fb2594dfdf9668d108daa8275b9a9323a103a04f5fc48cff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086513, "uuid": "2da84dc1-87b3-46ae-b264-a70b44d2455f", "value": "T1B9032A4D7FE18168C5FD067B06B2D41207BAE04B6E23DD1E8EF5649A37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086513, "uuid": "16aa6246-6005-40bb-a5be-74025eb85c0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086513, "uuid": "897054ed-9dab-47e6-9a6b-a4898a67e735", "value": "384:Uwxb7LsikZ9zNf/1uyU71evdjsOafMrAF+rMRTyN/0L+EcoinblneHQM3epzXCYx:Xxf4l1lU71e9FakrM+rMRa8NusYTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700086513, "uuid": "786b3821-3759-403e-9595-b7c874ee1f15", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700086513, "uuid": "cd553dc2-b0f6-4122-aa52-6f95a7dce76a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086513, "uuid": "f7aca051-ca3e-4cd3-abfc-1805619083cd", "value": "bcddf14b096307edfbfdc92384539645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ea3d7a-83d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700065045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065045, "uuid": "7940420c-42fb-43e7-9e07-925ed3192141", "comment": "Malware payload", "value": "b6d9c888c797d46ce06a18dcc88d1fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065045, "uuid": "6150d100-32f5-4afd-b973-1e141f6a1c65", "comment": "Malware payload", "value": "e61ed0d2ac83d2875180b1a33e04834aa6ca7dba7a5663e8d6e65a4482537576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065045, "uuid": "9f164d80-1a3b-4997-9657-ef22e92a34e7", "comment": "Malware payload", "value": "51c4baff7e555b86bcd288dfbd7667e297a21cd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065045, "uuid": "22576400-afd4-4fe2-ba46-66b7588dd4f0", "comment": "Malware payload", "value": "e77165538b1b00109bdbe4e2f211e260b097dffee0305a5efb04875964f077b273958138e663e1cbf4092b7f21f88f42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065045, "uuid": "3478c2ce-7878-4ccb-99dc-dc98c8507f79", "value": "T138748C1377A8E93BD1BE577AF03606154BB1D443BA16F38F9A5896B82C133868D413B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065045, "uuid": "c5fd15f2-9edc-4c5f-afbb-9c03274e0530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065045, "uuid": "2a1b8736-e5d2-4225-893f-1b90b4feaaa3", "value": "6144:32NHXf500MANYi80lzbdqueLLgvL994Ju1wwvO:Gd50im1UoRfiLEJu1zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700065045, "uuid": "d1cf9068-110f-4118-bc14-6e41c8a46c7e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700065045, "uuid": "bb51d36c-d2d3-461e-aba2-77f2b617faab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065045, "uuid": "f6b156c5-81a8-43d4-bff1-1abec7c451f0", "value": "bR4k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5489162-83b0-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700050547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050547, "uuid": "ebd908d1-92c0-43be-b06c-b44f137e396c", "comment": "Malware payload (RemcosRAT)", "value": "fdbe81e0dbff64353a0969ab084b50a1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050547, "uuid": "eccce044-7887-4cfb-8b00-e884f74994be", "comment": "Malware payload (RemcosRAT)", "value": "e6324e216c641b6d10f7acbd518cc6d859a842c80e5c58e852e64b6e8a0b7666", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050547, "uuid": "a1eadf8d-66f0-4b47-a7ec-d5a77dc02d83", "comment": "Malware payload (RemcosRAT)", "value": "ea609559c9878c70e2153f9a780898852602d280", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050547, "uuid": "b48e90f8-b56b-4fcc-a2eb-6255c7e4a76e", "comment": "Malware payload (RemcosRAT)", "value": "4ced8e2b48e17bf13ebfc1bd7adae8ec3bc9ea9bba14ec51517a41f769d97b7cc5dd30b7e94ac3c5f831e24d460de275", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050547, "uuid": "9be8322c-8b71-4379-b07b-4f91310b0f57", "value": "T120B4AF0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050547, "uuid": "b0603604-e296-4497-9bf4-3e07547c1d7b", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050547, "uuid": "da96c40b-bc85-417e-927f-759b0def4650", "value": "6144:lexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7mpUlLaEx:leZeWSpda70ADIgSoxgUW/zFun7OyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700050547, "uuid": "bd24019b-d216-4697-aa91-0092aded4347", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700050547, "uuid": "a529276d-9bd9-4620-bacc-515aaec7610b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050547, "uuid": "8dcc0457-8d07-4cc4-909e-821e4972b595", "value": "inform.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e95bfaa-8365-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700018082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018082, "uuid": "9ac8af2e-ceff-4aa2-87cc-f5d55ff20cae", "comment": "Malware payload (Gafgyt)", "value": "6d49fb6527f6dae0ffdc8cf7e9fd909d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018082, "uuid": "9df3627b-042a-4b63-b634-64df1b4e02ae", "comment": "Malware payload (Gafgyt)", "value": "e85426f6c3244bdf96fde023e7e2d25d88b061a7ae622203427247068af067cb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018082, "uuid": "1c0bbeba-6443-45d6-89c4-c525c1aa20ae", "comment": "Malware payload (Gafgyt)", "value": "208c64401813fe7b9cc4f9b6625031a195adc55e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018082, "uuid": "a3959f15-0aaf-4fd3-8a87-7de58cc0d41a", "comment": "Malware payload (Gafgyt)", "value": "b7570b44325248a96bd37b79c6f7fcfc79c5d285b1b07a4853772f89d0ea2cfa4d17f39c3ec287e057caff58b3f90cce", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018082, "uuid": "2f28a1c3-2724-4d1b-923f-12fd45ce4570", "value": "T15EC32917F9419F42C1C325BAFB8E964933136FF8E3EA7102D9249F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018082, "uuid": "99c84f03-a8f9-4919-8109-ed96a6c399e4", "value": "3072:F6nx6nlJosoawDh6iNwaVBgqO7sCk3Xr5h/ph1n:FSx6nlesoawF6iNwaLgYCk375hn1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700018082, "uuid": "2d831e0d-ab02-4169-b04c-a03d745c34fe", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700018082, "uuid": "eaf8e308-d917-47f8-a9a4-dbcc126d5e30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018082, "uuid": "e6cb55fa-1fd3-41e8-addb-fcde4014f5e0", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2320b45-834c-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700007592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007592, "uuid": "92c162d2-1e0d-40be-95fa-ce104f777168", "comment": "Malware payload (Smoke Loader)", "value": "ad0545d575fad92cfa4dbda8d379e1fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007592, "uuid": "7c34fbb4-1699-452f-af65-a0a93cf10b81", "comment": "Malware payload (Smoke Loader)", "value": "ea226ab509f8001582cace500f1890df678371771cf7ee1cf1d61f949f201c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007592, "uuid": "7e8e18a7-5c20-4735-a6f0-75c067e759bc", "comment": "Malware payload (Smoke Loader)", "value": "f313a4d199aab24ee8ab66ca88a497a332cf3758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007592, "uuid": "3d6ff0e3-51a0-4a28-b132-ccaf9798514b", "comment": "Malware payload (Smoke Loader)", "value": "482a486a4d513bd1ccbddac14a0497dd5437170671ff8eb92577cee2e8897b13bd34369bd37fcfbbc81ce9323a32ea62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007592, "uuid": "3a4c8da1-8222-4650-890c-b15946128913", "value": "T1C314BF3173E1C032F2274A384A72C565AA37BCB29B75C9CF27C41A6E4E356D1DA78316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007592, "uuid": "17d37513-ebce-411b-a318-5ee420f36bcf", "value": "6d9345bf08688119d85e339b601df9ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007592, "uuid": "c5c9fd50-f712-4d39-a326-9ec7c9365bff", "value": "3072:netf+534GcZ5t/kOZkEF30hsOudXes6SfwoWqrsX6j/:b5bcZ3/kOSQ30hsOuh2Eg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700007592, "uuid": "c5dfb0da-072a-4c5a-9c47-908da9010248", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700007592, "uuid": "99a0d0a0-f7a7-448a-8cbd-687941c6ae78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007592, "uuid": "ef247154-c2e5-4f60-8e31-a060c5d55222", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dd1b33-839d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700042394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042394, "uuid": "c8647d30-18b2-4be4-acfc-96da1e7dbcd8", "comment": "Malware payload", "value": "157b3ac41bee329d8777149567816bb6", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042394, "uuid": "68a107a4-2872-4567-8dc4-53bcda0c1d4a", "comment": "Malware payload", "value": "ea44b39b32fd766f5a4c9b0d426451065e3ed6d9d977cddcb7cfacfcd82be47d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042394, "uuid": "3fb02123-2886-4871-a623-5c208f1e6d1a", "comment": "Malware payload", "value": "e041465ce657086c3746575cba53d21823e80919", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700042394, "uuid": "334fe2d8-05d8-4dfe-9332-d55992894210", "comment": "Malware payload", "value": "3b8d069707ffe3f37718bf060e95b2e174fbab548f0fe7ed1a817e76a2edf691ac4a17ef93a0df3b7ce678214b017868", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042394, "uuid": "997d85fc-7aee-4dce-aa1f-12e6daf21153", "value": "T10304AF11759181BBDB9E223854FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042394, "uuid": "421e1876-14dc-4fb2-b920-778ebfc973fc", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042394, "uuid": "2231b8ad-c007-4bf9-a467-2cbe0bd510ca", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLwbVaKoXAxOPYe:I74elpowsxizqyStZlpel5UyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700042394, "uuid": "58ee5e79-467a-4930-ae82-3b6cb77e2f16", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700042394, "uuid": "de6cf719-f64d-4b14-8296-64208a8d8bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700042394, "uuid": "d9f13e9a-3a89-4976-a690-f6b68df64138", "value": "WCUtil_2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23002438-8405-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700086809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086809, "uuid": "69278db5-5fb3-4a88-80b0-b94ec1ef66d8", "comment": "Malware payload (LummaStealer)", "value": "95a9f606687aad764a75cfb3c1b20d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086809, "uuid": "61f570b8-bc3a-4041-b017-11b683baee56", "comment": "Malware payload (LummaStealer)", "value": "eb2a0541c88a8d839a3506d67260951e8f6bcf4e46741658cb69c7178da93634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086809, "uuid": "abc5daeb-5243-4171-a652-e00306fccb28", "comment": "Malware payload (LummaStealer)", "value": "9d5eb95de77d294bba79f83d800e9f067aa01645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700086809, "uuid": "a2ffdd4c-dc8c-4bb0-9415-7f951bc62e2f", "comment": "Malware payload (LummaStealer)", "value": "dcaab43a1836525e07cc6c956803a73f4269c0434507473fbe136c7a44d91cc2cc1c33da1d2fceb1b1ad37bf21e1b944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086809, "uuid": "18e04769-e03a-4152-a7ad-09e5f7767836", "value": "T1F31729C7F86141E4C1ADD334C6665267BA713C894B3027D32B50BEB82E36BD86EB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086809, "uuid": "23f217f7-0fb1-432d-9bb0-241a76b9ac39", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086809, "uuid": "5ee4ab91-8d31-4b2e-a1d4-a9173a133d83", "value": "98304:8ndHby/6Bg7E+zWqRjzLGPLTqZRC8HjGgE3kWFvcZbRAWtO+Hc25KEs:qtOEW3GPH8Dg3kWERUmc2cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700086809, "uuid": "b4b35240-bb77-4751-871b-3c81132e8cb7", "value": 18665472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700086809, "uuid": "2f7b9b72-8e7c-4843-b667-0baf65b8776f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700086809, "uuid": "0075af01-d20b-49a4-b16e-9888d21b4a6d", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b2e4a6-83c5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700059329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059329, "uuid": "a915afb5-581c-40f4-ad84-997b5fff8554", "comment": "Malware payload", "value": "a8aa567062eab1bd3e967f60fc7afef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059329, "uuid": "17e15a94-1031-46d6-a2cc-fbf02ead1fe3", "comment": "Malware payload", "value": "ecbff5a6e21170f5156f18ae42e78f6b2c38c36889fee23121683151b5e6e698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059329, "uuid": "0d9539cc-c102-4ab8-8f0e-08aa9ce4bf76", "comment": "Malware payload", "value": "dc7a3d89df7c1dd8274188953acadcb0a44e1de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700059329, "uuid": "9d28e7a5-a5d0-477c-8040-a98a96a8a968", "comment": "Malware payload", "value": "03088e0f9ac920995d75c9e14d5de832f9eac36da6450f04ac786069b309e0ea8041500de909e11b30942c766d24ee8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059329, "uuid": "86f8e295-98a8-4c2d-b0f1-f633724072ba", "value": "T139A40157B70C535EE36A9AB2383D47318BA89F5309526E0ABBC4FD6E113128DBD071D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059329, "uuid": "8f43699e-2fe8-4e1d-b15b-64b18c54aee1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059329, "uuid": "1c4b30bb-06e8-4d7e-93f7-578d930e1b41", "value": "12288:ZT5M1NNLv8oGC/w91psmh5SsAiM97ECBeP:ZT5eNBv8otSpZJvM97EZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700059329, "uuid": "1b5e4f3e-0022-4fde-bb61-9ca8a646bc78", "value": 474800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700059329, "uuid": "c68d3d58-48bd-4dcb-8d8d-773e3b136e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700059329, "uuid": "789f13b1-af32-4987-a2c5-a03be6bfde30", "value": "QUOTATION.RFQ#65748930_A2023_MATERIALS_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da91399-8365-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700018080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018080, "uuid": "d71dad19-e6ac-477f-a663-217ad5490461", "comment": "Malware payload", "value": "ea67a25ad7e367415e0b60a644f9dc0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018080, "uuid": "94fb2a01-17d1-4448-9ab8-5683d3ff1e8c", "comment": "Malware payload", "value": "edc9e39acb46cb0fd23edf9df42e7b94c3f33e20c01aa3eac58f02eb95a97f76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018080, "uuid": "587104a1-1509-46bb-b56e-dee7a5a237e4", "comment": "Malware payload", "value": "cd4033ef27adb114583e454403c15373603ecc9a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700018080, "uuid": "129a9df8-0020-4d94-96da-5ca0265fa123", "comment": "Malware payload", "value": "5ffe115adbe5b80d34d7cca4dd69576414fbd2a1be4610f0b81f2370697b7c1230b5fbd515da9babf62dabe429eaebb8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018080, "uuid": "3f82435c-1987-425c-bf54-d0697317ea72", "value": "T157932ADAFA42CE73D41310F116EA6B218971F9FB1C23D682D7647DA0DD211C29A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018080, "uuid": "e6a1c01c-5fb2-4b21-948f-04c613d3dba5", "value": "1536:j7ByW95LQG9SQ8/sYrLyEWPm7GUv0EqaTYRJLWjd2ZOqnJ33xZf0gA:XDJysYrLYm7csY/WJmJ3BZfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700018080, "uuid": "6e1a886e-497b-4202-bafb-c8e0a738ec94", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700018080, "uuid": "b0a45fa1-9257-4f90-b4b7-803e15e69e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700018080, "uuid": "f0bc4cd4-841f-4762-8ec0-83cc23b8af76", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a609908e-83d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700065983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065983, "uuid": "dfe335f9-2f74-4aab-84d8-522fad488dd8", "comment": "Malware payload", "value": "d2cadddcc9a84563d7b8db708d86f3a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065983, "uuid": "8b808fd4-2df8-47d9-8b13-04d160c14c43", "comment": "Malware payload", "value": "ee36161c6b3635240df4c30f370420483174cc1a4999a386952d452d0de03c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065983, "uuid": "768715b5-7259-48ff-8ecc-3c47d8db7521", "comment": "Malware payload", "value": "7938d2760e6f754620182d9b947c128fb2fcc138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700065983, "uuid": "4054b8ab-573b-4154-a7e7-ad6bb14d84c3", "comment": "Malware payload", "value": "465a7f6c71901703f3ad26ba60517b1018d2cf106b6dfa91d393c8a48b454c6f50d9fcc9fe307d118153b79514c55163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065983, "uuid": "c1c5b06c-3b17-404c-87a4-8e0362cc0a42", "value": "T17F442A2392D1BC95E926CA729E2EC1F8735DF9508E497B663228BF2F14B1172D277310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065983, "uuid": "50c3a119-3154-46e4-84a6-a59a8277b8d3", "value": "fb752e503b6d05b37aeae46cd3910859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065983, "uuid": "f79319f7-08f9-4ded-a92d-dbbe8712c76c", "value": "3072:0VJ1MvL0h5kCSlNvHYD1xi3fPQA78E/QSMrgzLR2PCAlco9CRa7:fL0h5k3qLQ78E/Qbk03lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700065983, "uuid": "690d8348-71fd-469b-afe0-f702eef37e6d", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700065983, "uuid": "5d0d6504-1914-49d1-873b-052bbab0dadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700065983, "uuid": "1c2ff422-bd84-44fd-aa7c-a3b2644d4748", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c304f2fe-836d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700021794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700021794, "uuid": "9cd08e2c-e82e-4d5f-af66-ddc732378e6a", "comment": "Malware payload (AgentTesla)", "value": "e073694e356a34ebc0f0e17890e01cb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700021794, "uuid": "08336d25-de13-4329-adcd-70852cc8c125", "comment": "Malware payload (AgentTesla)", "value": "ee87b91b6480592bf45354a624ef6b478ed812f5ef33e36dbb6775fe057dbcfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700021794, "uuid": "79ac87af-8c65-4b3e-8f45-82d79646262e", "comment": "Malware payload (AgentTesla)", "value": "1fa138be9ebeb0ebc0f08820282c3b6dbfb54a08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700021794, "uuid": "a1401cbc-b5c8-44f8-a9f3-f7cce2e70856", "comment": "Malware payload (AgentTesla)", "value": "a3f69c53f3f201a4366428022d8fb0b1411c208df4e27dccea68083171c9a8526c7375319021d941b9eeb107421e2613", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700021794, "uuid": "fc7d494d-44b3-4ffc-a999-5a84a34b1b1c", "value": "T153F4E6BF6A8C223780B9D697C3B3E062F17BC8A7713A5E2524D3DAD14647A0778C521D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700021794, "uuid": "e08b652c-61f4-4cc3-b8d2-da211f26e748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700021794, "uuid": "e52061d6-851d-478f-b6da-88ddaf774b07", "value": "12288:NxQDSIa+53vsMjZoAC0y7G5nzFLQXT7gPDdfTod:fSkMjZ20J9JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700021794, "uuid": "39ad8f5e-fdf9-4f78-afe8-2f3b7adce5ed", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700021794, "uuid": "6386a672-d54d-4b51-a2dd-4714c18a0bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700021794, "uuid": "e05b298a-a465-454b-81fa-67b408e5a2ed", "value": "SecuriteInfo.com.Win32.PWSX-gen.564.11389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85b1176-83de-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700070336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070336, "uuid": "3634b6d3-9290-4c31-8670-fcdb6f9f7578", "comment": "Malware payload (AgentTesla)", "value": "3c288f869290db9a0a736599823e837e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070336, "uuid": "8c3d3a5e-ee54-47a3-bee5-119e16702224", "comment": "Malware payload (AgentTesla)", "value": "f112d1e7c8414255846131a14109ae12e45ad65296bd014601d0a83c9ea90cb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070336, "uuid": "d7af368e-3e3e-4be1-b0f1-42ec78880ce8", "comment": "Malware payload (AgentTesla)", "value": "6ac8d55163b018275e32d7478f12b41926e48268", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070336, "uuid": "11307107-0da8-4966-b4a6-768006641802", "comment": "Malware payload (AgentTesla)", "value": "20e915282a75355edbf7896bfa9de17c6fe4153893e296376a0fb4de100e72e8ac72007e91485395b5c7ef8d8db32b5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070336, "uuid": "c3c6ce2a-2e6a-414f-9ddf-6a24d92de8bd", "value": "T10D259D80F56459A2CF599BB05B32C83473A23DA99470D5BC2ADA3D6B3BFBFB20011553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070336, "uuid": "f6f97579-b801-4fd8-8d8d-b46a4abd63b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070336, "uuid": "f8c330fa-4229-4fd9-92d7-971ea9d4cf04", "value": "12288:/IL5VcLYuPliBSpZAWzpNHP1MBkw9Jj6kKAQQtmxIlL5cjQUgjW9WB/P7r9r/+pj:85Oj1ZAWr4Jj6vA7UIh5cjojEC1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700070336, "uuid": "7ac7b190-8bec-454d-88f7-03278c8bc0d3", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700070336, "uuid": "473f5437-4141-40ba-8b46-3c8ce480cc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070336, "uuid": "6339960c-3fd8-4be5-b7e2-c66b5ecaebb9", "value": "invoice overdue.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b2dc30-83a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700044988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044988, "uuid": "a42692df-68e0-474b-87e2-060e8b049af7", "comment": "Malware payload", "value": "693a87312aa1f6a31906187bda5293df", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044988, "uuid": "8703177f-1ddb-4923-b247-1906113d920b", "comment": "Malware payload", "value": "f33cdca93db97c4b84af9f01216f3b7bcb3cf1865df84cb3b64fbbeed7057a2a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044988, "uuid": "5bf3ffbf-d6af-43bb-83c2-6810bd875720", "comment": "Malware payload", "value": "aaf236f3c5e791bd4f98d2c12758ff251c3b8474", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700044988, "uuid": "4b2649bd-c835-4189-b630-59383afa9c82", "comment": "Malware payload", "value": "831eba1f62a19df510896a0247f9269e5dde01712bcdaa515872bab3e7a27634a6315a957ff035a8187218eec5d45e04", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044988, "uuid": "7e8768cf-f6e2-484c-a41a-fa6cb2ccf0ca", "value": "T1BC63AF81F3E4A9D9F0BA4EB28C77D9500922BD1A94B58B0E398DB61D0DF23454863F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044988, "uuid": "971b588e-8fa4-4d63-a4a7-b13b2900c374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044988, "uuid": "c456c289-249b-4ad5-940d-82079570155e", "value": "1536:dfHn5T82s45tlDqwIdvKKBLutvfFoV/XUuL:dfH5TZsYnjIdbCNNoV/Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700044988, "uuid": "b48fa3c7-24b3-462f-9714-0129529c6117", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700044988, "uuid": "6cde5d3e-40d6-4207-8645-6e55e040e561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700044988, "uuid": "ede96208-e5f9-47b6-bd6f-99cc240b355e", "value": "resources.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b85ccb8-8411-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700091950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091950, "uuid": "da2ed17b-9d94-4922-a973-470491063271", "comment": "Malware payload", "value": "f46f73d5fa369883f2f0f7f1da7c646f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091950, "uuid": "02465584-f55c-4d6c-b5b5-85bc32849a91", "comment": "Malware payload", "value": "f4bdddb45e727c8699340ba8d520a37e07b0becb4c571a67b3c9f4ce3a138213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091950, "uuid": "48ab976e-1328-4877-bddc-89fa05d2de4f", "comment": "Malware payload", "value": "3d32694d4f2ab002fda7610117ea3e14fbe983ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700091950, "uuid": "8c096128-63fe-4b99-97ee-831dd77d6623", "comment": "Malware payload", "value": "849344f4cbe8274501e8b0bcc8dd15d5652900b66c66efeab898b1f9fb9abd4260aad8b36f5ff63ceed7fc561cfd1aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091950, "uuid": "9b112d31-65f9-4794-b8b9-e7659b0a494f", "value": "T185849D639291BC54E926CA728E2FC6F8761DF5509E093B663238FE2F14B1172D2B3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091950, "uuid": "9297ad6b-98b7-46e5-8a65-f0598c44d8e5", "value": "f62af2e8b5dd9dbbfa6927c42dc35c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091950, "uuid": "a9062b5b-11fa-48d4-abb1-700f98324a73", "value": "6144:WKNLSD2LqJGz0ZAdH2r/di2Pwd2olDDdpfM4Z:9WDumABC/Nwd2opdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700091950, "uuid": "b003fad4-92cf-4460-b124-974c8f9fceb0", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700091950, "uuid": "f8c31d95-5078-4c7f-94b9-81d3b3ec12e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700091950, "uuid": "84b2195d-0877-40ba-9f66-8bcbeb9ecbe7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fabdb6-83b0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700050550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050550, "uuid": "40aa0cd2-110f-4896-be02-eafdef921551", "comment": "Malware payload", "value": "7465bf2f3b6ed01b3b066ce8d7a7f811", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050550, "uuid": "7ddc9705-fbea-47ee-9c08-3682fd5614f4", "comment": "Malware payload", "value": "f4c4986fd011f3ef1223329e0433fd0d8766d27596bb02566b7afdcba0f21ea7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050550, "uuid": "26be9559-c69e-4ec7-b649-3b265f64d9fd", "comment": "Malware payload", "value": "d266bbede4ff2436ffadf79026d4a632084165ec", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700050550, "uuid": "f02a36c6-a94c-4a84-bffa-acbbc35cf818", "comment": "Malware payload", "value": "3a63cce8d5c726bab51a94e3ab444ba215ccc696f1e81e6367de610b4ca326266fbf18c26f908280565ceb6f5ec8acff", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050550, "uuid": "2729262b-bbd1-45a0-b8b8-441213013b29", "value": "T178B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050550, "uuid": "3786a36d-61ec-4463-98ee-fa30a9e14e94", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050550, "uuid": "79a1f2fc-0708-4de4-8f5a-08173979b0ed", "value": "6144:XexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O77pUlLaEx:XeZeWSpda70ADIgSoxgUW/zFun7OJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700050550, "uuid": "98c6cad4-c296-4d1d-8b3c-36e50e0040a4", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700050550, "uuid": "736da115-efb8-493a-ac80-ba2dd6543530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700050550, "uuid": "0be6d5fe-9c6a-411c-8bbf-44c720c7b101", "value": "intere.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd28393-834d-11ee-8907-42010a9c0042", "comment": "Malware payload (Arechclient2)", "timestamp": 1700007771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007771, "uuid": "9afa8841-397b-4299-af34-6a8097535462", "comment": "Malware payload (Arechclient2)", "value": "a61aac13f8a4841915791fb57aa2e275", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007771, "uuid": "41bad73a-73c3-443c-aff7-464e330882dc", "comment": "Malware payload (Arechclient2)", "value": "f50db870d11db91217a014fe2672069c51ae1e6c32547e09c99fef64c0a501fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007771, "uuid": "d5e473ce-3e82-4a65-a2d8-fd9e5057522a", "comment": "Malware payload (Arechclient2)", "value": "c34330fb238e0b9ea1cca921e42fb46966e1d577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007771, "uuid": "7a352f87-ad90-46ab-b5e0-dbcae8c3ad9a", "comment": "Malware payload (Arechclient2)", "value": "a8ab46a066432b582169834f861c622eae5f220f81664a8619321f3169e80121b261819e9a822c49905cec75add0d19c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007771, "uuid": "6fe8d74b-4ffd-4162-b5c2-bf0fd5f4311f", "value": "T1FB4633660C8574C4DC5DBA342BEFFE2E76751B798208CE1C25A46B83B6AF9742039643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007771, "uuid": "e775179d-a4de-445e-abb6-ba603761ecec", "value": "9ed5ffd9aebf2f772057cbc7c4430e2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007771, "uuid": "48a75db7-7a98-45e3-85ee-59bac51f116e", "value": "98304:YF85vlOC7s2wQPc8V94nWFQO0R6dheB4/ncnREmThJ45aTyFXBuirxD02g9rX:COvPgZeORpR67e4/ncRZTQXBFrWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700007771, "uuid": "527b3341-ccbd-4e80-9e6c-b990879eec3e", "value": 5772448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700007771, "uuid": "881504cf-2dca-43df-b22b-5d489b774bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007771, "uuid": "d25ef7bf-f6c8-4504-9815-ae626573429f", "value": "a61aac13f8a4841915791fb57aa2e275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c577786-8396-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700039338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039338, "uuid": "a3c69c46-16a4-4d0c-899b-a0989d544142", "comment": "Malware payload", "value": "30a47974121168e1381ecfa485942f75", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039338, "uuid": "3f4889a6-9e21-4248-8cdb-4c8d2ed9bc2a", "comment": "Malware payload", "value": "f52747475852e8cf7e34f28be8946365d35d52a8d2b5339ec8ce9a302a4bf049", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039338, "uuid": "71356ffd-7e6b-4f32-8e01-41cdf76e850e", "comment": "Malware payload", "value": "c78afeda6d0d2732ddb95c10456c5c2cc1518569", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700039338, "uuid": "fa6426d7-c0f1-4724-bdc4-5facbc1f2a99", "comment": "Malware payload", "value": "642c44566c63779f139ed73551e79502897874f2aa9ebc98b6c980e678ca409d7f0ab782d5022707482cecebb4c97fa2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039338, "uuid": "cb6fcf62-1319-4af8-8c4d-055042a080a0", "value": "T1CF8423033D00C72E74A4276828ED9A1B2F7D582DD7E4CB88691ED6BF91A9DC5C5031FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039338, "uuid": "7892ff1e-acab-4cb4-ae2b-11791006eef2", "value": "6144:DDnD3WwRjgLgBEMpidINrsMEfFlHBbEcmghC88KuAC6oZJkWaWKaMjoqsnHlsQ/z:DDDGUjgEBPidYrnQlYcrE88Ku1pKagoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700039338, "uuid": "89f3cbf2-9a6a-484b-980d-bae6666dc9ef", "value": 385685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700039338, "uuid": "042a9496-f79b-445f-bca3-5dad7a740604", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700039338, "uuid": "99d8f245-8d1f-4bff-a96d-c6bcea940c42", "value": "Doc04807910.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d50ff6-83de-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700070303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070303, "uuid": "77fca82c-bb9d-46dd-9c64-161bd58a382e", "comment": "Malware payload (AgentTesla)", "value": "245d758cc48655e06028ca8a5df47593", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070303, "uuid": "5d922413-4a0b-400b-ad8c-4c8292ab2374", "comment": "Malware payload (AgentTesla)", "value": "f6b96b0e4ca1b30e8f8973036205314b80f9ac4ebff7f0e46c1c74d51c72202a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070303, "uuid": "21dba27e-e263-4097-9649-ba746289e49d", "comment": "Malware payload (AgentTesla)", "value": "a949b906944cf781b48fa918da49e7b4756ef24d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700070303, "uuid": "20e1a814-8dfc-4333-a714-5d6577952420", "comment": "Malware payload (AgentTesla)", "value": "9f96c46b6e6b0c429cbbede6fdbeed0e4309524f094f6525a94dcaaae42a818dd0bf6a53a663891adcf50e394639de2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070303, "uuid": "e6907963-0061-4e97-90dc-dcfc8b0d5849", "value": "T1A505F7BF7B8C513780B9D6A7C3A3E062F27F88A7713A5E2524D3DA910687A0774C521D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070303, "uuid": "b409c248-f14f-463f-973b-c3a04cc98b51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070303, "uuid": "165504b6-c635-4eea-bd54-51e435525b7c", "value": "12288:5qNsxGaFcS40Awd41dUEiVYUG3ZD+r4viMqoPeJ2:ZxG0oiQAzoeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700070303, "uuid": "8b92e81c-f062-4063-bc26-05b0ac5e0852", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700070303, "uuid": "ef09665a-4eab-4279-9e28-eafc50cadb82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700070303, "uuid": "c092599c-dde5-43e8-9c46-dc46b66c3cce", "value": "SecuriteInfo.com.Trojan.Inject4.59820.4597.18951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01cbdf7-83f9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700081918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081918, "uuid": "b1208377-b0ad-4e0c-8a75-1ba03f88fe76", "comment": "Malware payload (AgentTesla)", "value": "f8285ed43f0a7ba1e7f114102547569c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081918, "uuid": "db07125b-c4d6-47b3-937b-c0e295deeea5", "comment": "Malware payload (AgentTesla)", "value": "f873fc0535d38b4ced119b8d2d555e23496174f01b5747b148c50925c2f60424", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081918, "uuid": "d860643d-c5eb-4383-96dc-6cadf79cb4e9", "comment": "Malware payload (AgentTesla)", "value": "feb088226b8c72556d37319b14c6191b384f5bd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700081918, "uuid": "0abfd814-753c-44c4-9e4d-4609b1fc4116", "comment": "Malware payload (AgentTesla)", "value": "4ebfed2933fdeaee35ae22a0f93a19d1cc0b9a8304ce2a778cca27b894c215ee4603700613b8868d4890e96cc3092605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700081918, "uuid": "b5224687-c74c-4ded-ba1f-e84402f00cc5", "value": "T128D41293F8586BF7CA388DF570AA086543BA1C3B8665D58F6CD83F690EE33119503A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700081918, "uuid": "94ddfd47-578a-434f-8e05-005190497e82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700081918, "uuid": "f35fb205-9eda-44a5-a2a0-10c5279d95be", "value": "12288:YQ0TkMhhqqSCDN7l90GDdzBqNI8k0p+3OHUtryUP65gr8C:OjQqbDNttBqtFUtuX51C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700081918, "uuid": "d95d2a6f-bd4f-41f6-a345-9a7f83cda905", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700081918, "uuid": "ef9dcc89-b86b-4fd6-8811-035f04376e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700081918, "uuid": "af84684a-d280-4d5b-b56a-56b46543dc0c", "value": "cRmu9LROM09hq1F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791828de-8387-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700032837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032837, "uuid": "f458eee1-91f2-4e12-a878-a85fe88d4a21", "comment": "Malware payload", "value": "18610a917a6b8f0b51384cd3e7b7da2c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032837, "uuid": "ffe1081a-5937-4658-9e8d-62be5795265a", "comment": "Malware payload", "value": "fd45836d17756388b7bf67083e5247fdbe2154149f4a9cf3d30fc8348e3020ac", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032837, "uuid": "e1e6d638-a190-46cf-ab1d-e6a19b8e8000", "comment": "Malware payload", "value": "528b819b3b4205e6c535692316c29ec9218b93ad", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700032837, "uuid": "0268056c-c47a-49d5-8e3f-1591e6d55119", "comment": "Malware payload", "value": "9d5f1e7e15f54ad2cbfc5b7c87d9e93e33ae490b7dc20edeb5bc9da89926f27295eb7aa638db61b5d2e82ebd03d27597", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032837, "uuid": "c0927ada-02c9-4a81-8e3a-6cebf03ddbcf", "value": "T1E504AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032837, "uuid": "3559281c-cccf-4098-8ea6-6f70f8724b9a", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032837, "uuid": "755ab290-1001-46b9-8ba6-278141bb0a99", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLvbVaKoXAxOPYe:I74elpowsxizqyStZlpel5LyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700032837, "uuid": "9b5ba1fc-fc7d-4084-bf71-b0a13ac10f3e", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700032837, "uuid": "f315c234-d242-4117-b9fd-f85e8beeabb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700032837, "uuid": "144fab88-d5d2-4754-afbc-7a6c0c7ec3c5", "value": "WCUtil.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97640c0-834b-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1700007255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007255, "uuid": "eb413a07-a0cf-4120-b8d8-380474dba67d", "comment": "Malware payload (Adware.Neoreklami)", "value": "76d3c65547e80c05f0bb46b63618d089", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007255, "uuid": "0a94f2d5-a40e-4417-bbce-84038e36ca8f", "comment": "Malware payload (Adware.Neoreklami)", "value": "fd5d862f187f2b06569ceba8c3cf0960f6446904d88ec36da96cde8ba984e17b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007255, "uuid": "e0493626-4403-4898-a2c4-aab87704a1c8", "comment": "Malware payload (Adware.Neoreklami)", "value": "8b41106766065e0093ce69c638128ee67d85e962", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007255, "uuid": "5ebd898e-892f-4cb5-8927-874e65cc0ffe", "comment": "Malware payload (Adware.Neoreklami)", "value": "3843292197ab9e9fd9a65a9e721dde1c5903f7541acba50094a935389729b908fbd9c56021fde3d6b2414a0408beea95", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007255, "uuid": "ee90be7b-2e69-4736-abc9-585c7ddbe348", "value": "T1F07633567EF3297FE071193A4076178992A1D3B22A6359BF234F0E0C1D3D889E254F9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007255, "uuid": "5dab205e-42b8-464e-af38-1d08e16ec9a2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007255, "uuid": "2f5078c9-2ddd-46d1-83f3-20e19e608b51", "value": "196608:91OCrSnjdqSAZBCE8JF7Z8ZhCoB/xEB8zETdaTTBP2UKgZq:3O1hUCnFleXR/EZaAak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700007255, "uuid": "68648607-118d-42e3-ad72-e821731c7040", "value": 7537125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700007255, "uuid": "a52c318c-cd97-44f5-996e-2b70ae126b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007255, "uuid": "a17c926b-2cd2-47af-99d5-fca3d44bed08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f21f41-836f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700022423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022423, "uuid": "312b6967-46a4-46d2-bbed-761d23882fce", "comment": "Malware payload", "value": "beba3433dad54f893f6e8c5c7bfb024d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022423, "uuid": "3b7db9b4-6082-4154-9555-7078ec520ed3", "comment": "Malware payload", "value": "fd84fbbb02015979484e56ee1f8de94df66b7c031c8df094c25ee8d4189e2f62", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022423, "uuid": "72a31235-9142-42d9-ac10-99115ee01aef", "comment": "Malware payload", "value": "d3b650571f65b4c021a551f05b3f6e2e645fc192", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700022423, "uuid": "11432b85-a784-4c9b-975f-cabf87abd1bf", "comment": "Malware payload", "value": "d60fab006ebb04cb1d28035d1109bcf431ce5728ea67180e7c0a3f1747f79ab721642ae9c73ffefd8999e727d3f5c212", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022423, "uuid": "3c8b24e1-981b-4205-bf27-514c2695b643", "value": "T13504AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022423, "uuid": "1782c817-3255-4c56-a9a4-d1cc0eb3b85a", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022423, "uuid": "43a7ef4f-069d-43f7-959c-c2058a4bb32d", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLMbVaKoXAxOPYe:I74elpowsxizqyStZlpel5AyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700022423, "uuid": "05d8453a-5209-403f-b055-da8d6158c5f7", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700022423, "uuid": "b1848fc7-c1cf-408c-93a0-5542692ec730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700022423, "uuid": "3ee527c8-88d6-4878-9bd5-23398c7ff581", "value": "WCUtil.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5aef32-83aa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700047987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047987, "uuid": "5ecc446e-c745-423c-8128-e47ac392ead9", "comment": "Malware payload", "value": "2fa213dacc742afea78a6f816797f3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047987, "uuid": "554a95f2-10e1-44ac-9941-14b4a9eb1204", "comment": "Malware payload", "value": "fe87527ba3585e4e2437669ad1d4922dca958a78ed2416ed8426a8abf0ee2f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047987, "uuid": "c76f3a02-163d-4d62-a13a-d4235163dc23", "comment": "Malware payload", "value": "9a0394e9dfd5342013df3076d1c0d40f1a9a7907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700047987, "uuid": "9f3737e6-27ce-456c-9ad6-600cb5cd5e68", "comment": "Malware payload", "value": "c2a0a553d173fe3986e4a56362820931ec07aa7bfadc5365593105d0f16cbcc5ab55e4571a8b062e6f79b190ed3bc2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047987, "uuid": "2f78ee90-7935-4633-829e-322c44927cf8", "value": "T193442A9392D1BD50E9168B73CE2ECAF8B61DF9508E4977A63218AF5F14B11F2D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047987, "uuid": "5474f951-9706-4128-a7fc-fce877832f5a", "value": "0a046e791e3122b7d021f9aaf3ba90b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047987, "uuid": "b5c768fa-213c-4db5-a10d-60a77759d3ea", "value": "3072:brm+PJXTLCbBg7LwYE7CjEtBlCGKvSOU1v7XkUKfjt3R2kvkW:bLCbBOwCiinUFjBKriiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700047987, "uuid": "f68b1c18-a8eb-4162-b5b7-4890331832ad", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700047987, "uuid": "d34c5a64-4275-4741-949a-bb40d31b8788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700047987, "uuid": "9972b9d4-b10a-4acd-9389-faa354ccd8b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f47709-838c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700034903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034903, "uuid": "66cdc6c2-8648-4c41-bee5-252b33323f89", "comment": "Malware payload (AgentTesla)", "value": "65285e7f44862c01a0be87ad7415c679", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034903, "uuid": "c887cbb1-1c50-408c-89c9-a9bfb1bad48d", "comment": "Malware payload (AgentTesla)", "value": "ff28a45905e0bb9d9af43c5e4d8e8fa27248880cb7a24d2bd7c16d5ddcdb8caf", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034903, "uuid": "7c888c87-ccdb-4d45-9085-14175b9de136", "comment": "Malware payload (AgentTesla)", "value": "7aa12fc43764f3dc38d15bc7e04470ee71e83bd3", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700034903, "uuid": "f9c712b9-96ca-4c8b-844a-49587cb7a3ba", "comment": "Malware payload (AgentTesla)", "value": "32ab0232c2d334cace3e3e8cd6ef18cd49e9eb8a55c4d03c15446a71f34045d5eb3a89e124c16cee48a2f265fe3babbb", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034903, "uuid": "0cb25930-bceb-4f7e-b6a7-f92161f3b03b", "value": "T15FD42354DE3A99CA7AAA0C9A0447D8F1C39F09CC6ED637857C34362F6C667142BC5E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034903, "uuid": "4747c51c-6cc4-49ad-9f61-505a7980722b", "value": "12288:Hs4DfDMA3wTyhaEfN0Q/p8aOg+ZOWlQWDSXSajIAZOi8:HfATyhX10+uaOgMOWCWeXSMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700034903, "uuid": "8f4deaec-9c60-450c-8742-a827a1b916af", "value": 614800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700034903, "uuid": "2327a968-77a0-4047-a163-a2dc0a75369d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700034903, "uuid": "5e341c15-f89e-442f-8151-c9315723c9b0", "value": "SOA PAYMENT OCTOBER 2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efefec28-83c2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700058376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058376, "uuid": "393fe2ce-ef17-4f05-aa8e-bd45a7373428", "comment": "Malware payload", "value": "4a54d5329f830a89bef8f7c9a139a1e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058376, "uuid": "0242ba3d-641e-4ae6-b885-8a013e9ca540", "comment": "Malware payload", "value": "ff625dd0483caccac07b4233e3f8174a2237b8382da090067dc66213f5d9c8f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058376, "uuid": "c6553a69-1072-4b44-8b67-834db7070e76", "comment": "Malware payload", "value": "cf1037640f8eff1f57dc39957b45924570e62141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700058376, "uuid": "f5fdbb5d-9293-4003-96da-e22571df13a1", "comment": "Malware payload", "value": "76599aedbe16a19b55792af5f460925fc4eccf0c33bb8eb10a74ae1062378d871efd3cf97a3afee72b47d94ac7bcd75d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058376, "uuid": "35c5ec1c-b287-46b7-81f9-1fc41ea9bb62", "value": "T179848D839290BD50D9164B73CE1ECAE8B61EF9508F6D7B762118AF5F14B21F2E263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058376, "uuid": "af5a4f00-fb2d-4e45-905a-e04e8c1282bc", "value": "840e4842bc97c9779b45301f8bbeab2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058376, "uuid": "87ac2d24-5657-45cc-850a-6244c0b1e5d6", "value": "6144:ELaHncfeWjEWFCLeXVJHjN2Pgi6iTbpht+GSmfJ09FX3N1pvYsS:E+EeWoWFxX7DNsgivTbphNS+JslS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700058376, "uuid": "d6fe6866-4bf8-4739-9c23-5c349e7ab89a", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700058376, "uuid": "4217c6b6-473e-4118-961f-c78b6a201bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700058376, "uuid": "6616852e-f212-4058-bf6b-551b99c0df94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176a3184-834d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700007762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007762, "uuid": "e0c6aef8-3c34-4103-84dd-b4ba323e2ad6", "comment": "Malware payload", "value": "d6a28fab04acec60305a5c6be5b105d2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007762, "uuid": "6e43da39-034f-4efe-9598-ebca5dc5e46b", "comment": "Malware payload", "value": "ff8973e265cde0ecfc91cb81ae4af75946b2cfcaa772b5cd1390c176e788175f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007762, "uuid": "f39f9e0a-7699-42ae-a007-928c923be15e", "comment": "Malware payload", "value": "8def206af9e2e8f463f15a2874b53c295fd28710", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700007762, "uuid": "888b835c-a1f1-4c1b-9535-e5a49c98d30c", "comment": "Malware payload", "value": "992a31682fffbebddd65ecb4a005f5fdf433684bb39a796fee95793f2aebae4a3fa77f2a5d3a0cc7d7dc1db2350d3f22", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007762, "uuid": "e1eca78f-afb9-4ae3-ab07-5428904c9893", "value": "T1AB073A87F89151E8C1ADD37486365262BA713C895B3027D72B50FEB42F32BD49EB9324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007762, "uuid": "b897f399-1eda-4460-8a16-67f7ee5c64cf", "value": "e6efb84c997b145566619aa9dc9a7eef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007762, "uuid": "e9e42c85-0257-4532-b01c-bd0962490949", "value": "98304:8+kKOOaV3XkVAvBscyI37T6UZcpNEfaR8u07FnQpUBqAS7gKUQtW0:8hXLAQTTZRfas7FQd7P1tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700007762, "uuid": "a5b03a58-e0f8-458a-90c9-d420aacf7efc", "value": 18374656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700007762, "uuid": "5d13361b-fa3e-44ae-9dcc-8d941e52e572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700007762, "uuid": "f01d9dfa-ebe2-4d2b-928d-777bab11e3ed", "value": "d6a28fab04acec60305a5c6be5b105d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }